Search: “Vawtrak”

26 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 17 Ransomware 7 Data breach 2 Threat actor 2 Phishing & fraud 1 Research 1 Vulnerability 1 Policy & legal 1

SeverityAll critical 5 high 8 medium 16 low 3 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Acronis warns of actively exploited flaw in its cPanel backup plugin

Acronis reports CVE-2026-87886, a CVSS 7.8 Linux privilege escalation in its cPanel/WHM and Plesk backup plugins, exploited in limited targeted attacks.

CVE-2026-87886 is a high-severity local privilege escalation flaw in Acronis Backup plugin for cPanel & WHM (fixed in 1.9.3 HF3) and the Plesk extension (fixed in 1.8.11). A low-privileged attacker can elevate permissions on a vulnerable Linux server to access or modify sensitive data without user interaction. Acronis says it detected exploitation in the wild in limited, targeted attacks based on a single customer report, with no IOCs published yet.

BleepingComputerupdated Sep 16, 11:08 UTC · 17h agofirst Sep 15, 21:37 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2026-87886

GitLab Vulnerability Exploited One Day After Disclosure

WatchTowr observed in-the-wild exploitation of critical GitLab path traversal CVE-2026-85706 one day after disclosure, letting unauthenticated attackers read arbitrary files.

WatchTowr detected the first in-the-wild probes for CVE-2026-85706 (CVSS 10.0), an unauthenticated path traversal in GitLab CE/EE that allows arbitrary file reads via a single HTTP request, and warns mass exploitation is likely. Affected versions include 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The fresh patches also fix 17 other vulnerabilities, including CVE-2026-87719 (CVSS 9.9), an insecure deserialization flaw in the GraphQL subscription serializer exposing Advanced Search credentials, plus six high-severity bugs enabling RCE, CI/CD variable access, XSS, and denial of service.

SecurityWeekupdated Sep 15, 00:52 UTC · 2d agofirst Sep 11, 16:11 UTC · 5d agoExploit / PoC in the wild 18 sources CVE-2026-85706 CVE-2026-877192· 1 read

VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data

VLC 3.0.0-3.0.23 has two flaws: a heap out-of-bounds write via malicious PNGs (CVE-2026-56711) and an out-of-bounds read via hostile RealRTSP servers.

CVE-2026-56711 is a heap out-of-bounds write (CVSS v4 8.6) caused by an integer overflow in VLC's AllocatePicture routine when processing PNG images with exceptionally large IHDR width and height values, allowing writes past the allocated buffer; it maps to CWE-190 and CWE-787 and was credited to Fabian Wahle of Hap Security. CVE-2026-73324 is a medium-severity out-of-bounds read (CVSS v4 6.9) in VLC's RealRTSP handling, where RtspReadLine copies response lines longer than 4,096 bytes into a fixed buffer without null termination, potentially leaking heap data back to a hostile RTSP server via the Session header. Both bugs affect VLC 3.0.0 through 3.0.23, and updated builds had not yet been released at the time of disclosure.

GBHackersupdated Sep 12, 14:31 UTC · 4d agofirst Sep 11, 12:03 UTC · 5d agoVulnerability 2 sources CVE-2026-56711 CVE-2026-73324

Re: CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

Follow-up on oss-security asks why CVE-2026-82434, Apache Storm ZooKeeper credential disclosure to read-only users and logs, lacks a severity rating.

Gabriel Ravier replied to the oss-security disclosure thread for CVE-2026-82434, which affects Apache Storm Nimbus and Apache Storm Client. The vulnerability involves disclosure of the topology ZooKeeper credential to read-only users and to logs. The reply questions whether the CVE was filed without a severity rating or if it is simply missing from the listing. No exploitation details or affected versions are provided in the post.

oss-securitySep 13, 19:51 UTC · 3d agoVulnerability 2 sources CVE-2026-82434

How the EITest Campaign's Path to Angler EK Evolved Over Time

Unit 42 documents how the EITest campaign's gate URLs and infrastructure evolved since 2014 while still routing victims to Angler EK and diverse malware.

Unit 42 traced network traffic changes in the EITest campaign, which Malwarebytes identified in October 2014 across thousands of compromised websites. The campaign's injected script patterns have remained consistent, but its gate URLs changed repeatedly, and since January 2016 gates used the 85.93.0.0/24 IP block, often with .tk domains. The gate returns a Flash file that redirects victims to Angler EK, which delivered malware including Vawtrak, Tinba, TeslaCrypt, Bedep, Kovter, Ursnif, and Zeus variants from 2014 through 2016.

Palo Alto Unit 42Aug 17, 09:51 UTC · Aug 17, 2026Threat actor in the wild

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability NotesAug 25, 16:11 UTC · 22d agoVulnerability

EITest Campaign Evolution: From Angler EK to Neutrino and Rig

Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.

Unit 42 updated its tracking of the EITest campaign, first identified in October 2014, which compromises websites with injected scripts that redirect victims through a gate to exploit kits. After Angler EK disappeared in June 2016, EITest switched to Neutrino and then primarily used Rig EK by August 2016. In September 2016 the campaign began using hex-obfuscated JavaScript and simplified gate URLs, while continuing to distribute payloads including Gootkit, Cerber, Bart, CryptFile2, Vawtrak, Ursnif, and Tinba. Gate infrastructure consistently reused IP blocks such as 85.93.0.0/24 even as domain names changed.

Palo Alto Unit 42Aug 17, 09:52 UTC · Aug 17, 2026Threat actor in the wild

KRBanker Targets South Korea Through Adware and Exploit Kits

Unit 42 details KRBanker banking trojan targeting South Korean bank users via KaiXin exploit kit and NEWSPOT adware, using pharming and process hollowing.

KRBanker (aka Blackmoon) is a banking trojan targeting online banking users in the Republic of Korea, with roughly 2,000 unique samples and 200+ pharming servers observed by Unit 42 over six months. It is distributed through the KaiXin exploit kit exploiting Adobe Flash CVE-2014-0569 and CVE-2015-3133, and through the NEWSPOT adware update channel that also delivers the Venik trojan. The trojan uses process hollowing, retrieves pharming server IPs from Qzone profile nickname fields, and abuses Proxy Auto-Config with a local proxy to redirect banking traffic to forged sites.

Palo Alto Unit 42Aug 17, 12:57 UTC · Aug 17, 2026Malware in the wildCVE-2014-0569 CVE-2015-3133

GuardBreaker: Derailing AI-assisted malware analysis with a code comment

ESET names 'GuardBreaker': UAC-0099 embeds a nuclear-weapon question in VBScript comments to trip LLM scanner guardrails during analysis of its MATCHBOIL loader.

ESET researchers observed the Russia-aligned group UAC-0099 inserting a decoy prompt injection into a VBScript used to install its MATCHBOIL loader in an attack against a Ukrainian target, aiming to make LLM-based code scanners refuse and stop inspecting the file. The comment triggers safety guardrails with a request about building a nuclear weapons but has no runtime effect. Similar LLM-thwarting tricks have appeared in malicious PyPI and npm packages reported by Socket and StepSecurity. ESET recommends multi-model cross-validation of AI-assisted analysis and treating missing LLM output as requiring further checks.

ESET WeLiveSecurityupdated Sep 11, 14:32 UTC · 5d agofirst Sep 10, 09:00 UTC · 6d agoAI safety & security 3 sources1

Understanding Angler Exploit Kit

Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.

Unit 42 published the second part of its Angler EK analysis, covering the kit's history since 2013, its SaaS rental model, and its focus on Flash, Internet Explorer, and Silverlight exploits. Angler integrated the CVE-2015-5119 Flash zero-day from the Hacking Team leak within hours and later added exploits for CVE-2015-2419 and CVE-2016-0034 roughly a month after Microsoft patched them. Campaigns use Angler to deliver ransomware such as CryptoWall, TeslaCrypt, and CryptXXX, plus banking trojans and stealers via EITest. Since August 2014, Angler has used fileless, in-memory execution, most often for Bedep, which later downloads CryptXXX and click-fraud malware.

Palo Alto Unit 42Aug 17, 09:50 UTC · Aug 17, 2026Research in the wildCVE-2015-5119 CVE-2015-2419 CVE-2016-0034

GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks

Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.

Group-IB's 'Hook for Gold' investigation found GoldFactory ships Vwork, a modified fork of the open-source Shelter app, alongside its Gigabud Android banking trojan, active since 2022. Vwork abuses Android Work Profile provisioning to clone banking apps into an isolated environment, weakening the link between detected malware signals and fraudulent transactions. Gigabud has targeted victims in Southeast Asia, Latin America, the Middle East, Africa, and beyond via fake airline, tax, and government apps requesting Accessibility and overlay permissions. In Indonesia, telemetry recorded about 1,469 compromised devices and roughly $960,939 in estimated losses between February and July 2026.

GBHackersSep 9, 10:49 UTC · 7d agoMalware in the wild

MicroHasTEE: Bare-Metal Haskell for Type-Level Peripheral Ownership on Armv8-M

MicroHasTEE expresses TrustZone secure and non-secure firmware as one typed Haskell program, catching peripheral-ownership inconsistencies at compile time.

MicroHasTEE is a multiparty Haskell framework that models both TrustZone firmware images as participants in a single typed program, using type-level capability ledgers to track peripheral acquisition, configuration, transfer, and finalization. MicroHs compiles the shared program twice to produce separate bare-metal Secure and Non-secure firmware images. The framework rejects inconsistent resource use, post-configuration attribution changes, wrong-domain callbacks, and calls to unregistered Secure services. A door-lock case study on an STM32U5 Nucleo board produced images of 232.7 KiB and 228.4 KiB of flash with roughly 220 KiB of SRAM per domain.

arXiv cs.CRSep 11, 08:34 UTC · 5d agoResearch1

ZDI-26-639: Oracle VirtualBox VMSVGA Heap-based Buffer Overflow Local Privilege Escalation Vulnerability

ZDI disclosed a heap-based buffer overflow in Oracle VirtualBox's VMSVGA component (CVE-2026-71116) enabling local privilege escalation.

Zero Day Initiative published ZDI-26-639, a CVSS 7.5 heap-based buffer overflow in the VMSVGA component of Oracle VirtualBox. Local attackers who already execute high-privileged code on the guest system can leverage the flaw to escalate privileges on affected installations. The vulnerability is tracked as CVE-2026-71116. No exploitation is reported.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoVulnerability 6 sources CVE-2026-71116

CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name

Unsanitised topology.blobstore.map local names in Apache Storm enable path traversal writes on supervisors as the supervisor user.

CVE-2026-82427 affects Apache Storm Nimbus (org.apache.storm:storm-server) versions 3.0.0 before 3.1.0, rated important. Topology submitters can choose a local name for each blob in topology.blobstore.map, which AsyncLocalizer and Container.createBlobstoreLinks used to build paths under the topology's working directory without normalisation. Crafted names allow path traversal, letting a submitter create or overwrite files outside the intended directory on supervisors, with symlink handling also affected. Fixed in version 3.1.0.

oss-securitySep 13, 14:21 UTC · 3d agoVulnerability CVE-2026-82427

VectraRAT Malware-as-a-Service Lets Hackers Bypass UAC and Hijack Windows Systems

New VectraRAT malware-as-a-service at $250/month combines RAT capabilities, credential theft, clipboard hijacking, and a UACME-based UAC bypass; 38 victims observed.

VectraRAT is a previously undocumented MaaS platform with a Go-based VectraHub Linux C2 server embedding a Vue3 operator panel and a C++ Windows implant, rented from $250/month and linked to the aliases Vectra and Nyxel. It communicates over TCP port 3308 via a proprietary MessagePack protocol, steals browser and file-based credentials, and abuses UACME method 41 with debug-object handle hijacking via winver.exe and computerdefaults.exe. SOCRadar identified 38 live victim sessions in one week, 48% on corporate Windows editions, with delivery via the Amadey loader and ClickFix pages impersonating TurboTax.

GBHackersupdated Sep 16, 14:36 UTC · 13h agofirst Sep 16, 13:11 UTC · 15h agoMalware in the wild 3 sources

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security NewsSep 8, 12:10 UTC · 8d agoThreat actor in the wild

THost9 Android RAT Pairs Packed Loader With ADB Worm

Dark Atlas details THost9, a packed Android RAT paired with an ADB worm that installs itself on devices with exposed Android Debug Bridge services.

Dark Atlas researchers described the Hagaseca cluster, whose THost9 packed loader hides executable code in an embedded asset decoded with single-byte XOR and gzip before loading a tc9.dex second stage. The second stage adds shell execution, file transfer, tunneling, reverse shells, downloadable modules and a self-propagating ADB worm that expands single addresses into 65,025-host scan ranges. Newer builds include anti-analysis checks for Frida, and incident reports connect THost9 and THost4 to Android phones and Redroid containers with exposed ADB from October 2024 through 2026.

Infosecurity MagazineSep 8, 11:15 UTC · 8d agoMalware in the wild

Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.

Group-IB says Gigabud installs a helper app called Vwork, derived from the open-source Shelter tool, which creates an Android work profile and drops a tampered banking app inside it, hiding the trojan from banking apps' malware scans. Gigabud, active since 2022 and linked by Group-IB to the GoldFactory group, abuses Accessibility access and overlay screens to steal credentials and run fraudulent payments while a black screen conceals the operator's actions. Group-IB confirmed the full attack chain on infected devices in Indonesia, counting about 1,469 compromised devices and estimated losses of roughly $960,000 between February and July 2026. Vwork-compatible Gigabud samples have been found targeting 11 countries including Brazil, Mexico, Indonesia, Thailand, and Türkiye, though only the Indonesian chain is confirmed.

The Hacker Newsupdated Sep 11, 12:14 UTC · 5d agofirst Sep 10, 11:33 UTC · 6d agoMalware in the wild 3 sources1

IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications

IDORacle intercepts MyBatis/JDBC SQL sinks to block horizontal privilege escalation in legacy Java apps with sub-millisecond guard latency.

IDORacle is a template-guided SQL-sink interception and rewriting framework that prevents IDOR/BOLA horizontal privilege escalation at runtime in Java database applications. It propagates authenticated identity context across HTTP requests, asynchronous tasks, and data-access boundaries via a server-side trace identifier, and computes dual SQL fingerprints at the MyBatis/JDBC boundary to generate reusable mediation plans. On a Java-SQL benchmark grounded in real-world CVE reports, it blocks tested violations with worst-case guard latency of 0.17 ms, reduced to 0.017 ms average for hot templates via redundancy-aware optimization.

arXiv cs.CRSep 11, 04:20 UTC · 5d agoResearch1

CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

CVE-2026-16028: Protocol::HTTP2 Perl library before 1.14 lets closed streams linger in the connection table, enabling remote memory exhaustion.

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion because closed streams are never removed from the connection stream table by stream_state. The flaw was disclosed on oss-security by Robert Rothenberg on September 7, 2026. Users should upgrade to Protocol-HTTP2 1.14 or later on CPAN.

oss-securitySep 7, 18:45 UTC · 9d agoVulnerability CVE-2026-16028

You've Got a BUD in Me: Authenticated Reads from Per-Block Write Logs

Researchers propose BUD, per-block write-log digests enabling blockchain validators to serve historical membership and exclusion proofs far cheaper than state-wide tries.

The paper introduces Block Update Digests (BUD), which authenticate each block's write log with predecessor pointers, plus a SuperBUD and exponential hierarchy to turn long unchanged intervals into short proofs. Soundness against adversarial provers and up to f Byzantine validators is proven under archive, attestation, and committee evidence assumptions. Benchmarks show a 50x state-size increase raises the base-BUD path only 1.24x versus 3.1x for in-memory and 69.5x for disk-backed Merkle Patricia tries, with read payloads below 800 bytes and p99 warm verification at 146 microseconds.

arXiv cs.CRSep 10, 08:46 UTC · 6d agoResearch

CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

Unauthenticated remote memory exhaustion in Apache Storm Worker 3.0.x Netty decoder fixed in 3.1.0, allowing pre-auth denial of service.

CVE-2026-82435 (rated important) affects Apache Storm Worker (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. The worker's Netty message decoder sits ahead of SASL authentication handlers and processes frames before any authentication occurs. It allocates buffers sized from an attacker-controlled length field, so a single frame from an unauthenticated peer reaching the worker can exhaust memory. Users must upgrade to 3.1.0.

oss-securitySep 13, 14:35 UTC · 3d agoVulnerability CVE-2026-824353

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Wiz Research confirms in-the-wild exploitation of three JFrog Artifactory vulnerabilities, chained to gain administrative control, deploy Groovy plugins, and install Rust backdoors.

Wiz Research identified active exploitation of CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 in JFrog Artifactory between August 15 and September 8, 2026. Attackers chain the anonymous-token exposure (CVE-2026-42018) with the token scope-validation flaw (CVE-2026-42016) to obtain admin-scoped tokens, while CVE-2026-82329 allows unauthenticated administrative access in default configurations. Observed post-exploitation includes persistent administrator accounts created in under five minutes, malicious Groovy plugin deployment, ad-hoc command execution, Rust-based C2 backdoors dropped to writable paths, and webshell uploads. Wiz measured that 59-62% of organizations running Artifactory remained vulnerable to the chained CVEs weeks after disclosure, and the vulnerabilities were already included in CISA KEV.

Wiz Blogupdated Sep 14, 09:27 UTC · 2d agofirst Sep 10, 19:04 UTC · 6d agoExploit / PoC in the wild 7 sources CVE-2026-42016 CVE-2026-42018 CVE-2026-823292· 1 read

CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

CVE-2026-59739: Apache ZooKeeper missing ACL check in SetWatches reconnect replay lets attackers discover ACL-restricted znode paths.

Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 contain a critical information disclosure (CVE-2026-59739) caused by a missing ACL check during SetWatches reconnect replay. An attacker can register exists-watches on non-existent paths and reconnect after those paths are created, revealing the existence of ACL-restricted paths. The issue is fixed in patched releases.

oss-securitySep 15, 18:21 UTC · 1d agoVulnerability CVE-2026-59739

CVE-2026-73178: Apache Syncope: JWT Access Token takeover

Apache Syncope discloses CVE-2026-73178, an important-severity flaw enabling JWT access token takeover in versions 3.0.x through 4.1.2.

Apache Syncope disclosed CVE-2026-73178, an Exposure of Sensitive Information to an Unauthorized Actor vulnerability rated important that allows JWT access token takeover. Affected versions include syncope-core-provisioning-java 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to the latest fixed releases.

oss-securitySep 14, 15:19 UTC · 2d agoVulnerability CVE-2026-731781

Another Artifactory CVE under attack by AI agents or humans

Attackers are actively exploiting CVE-2026-82329, a critical JFrog Artifactory authentication bypass, minting admin tokens on exposed servers days after patch release.

CVE-2026-82329 is a CVSS 9.8 unauthenticated authentication bypass in JFrog Artifactory, disclosed Friday, that allows attackers to create new administrative credentials. watchTowr's honeypots recorded exploitation from a small number of IPs within days, including enumeration of users, groups, credential sets, and federated access topologies. Researchers urge urgent patching, credential rotation, and treating exposed instances as potentially compromised to prevent build-pipeline tampering and downstream supply-chain impact.

The Register · SecuritySep 1, 21:07 UTC · 15d agoExploit / PoC in the wild 2 sources CVE-2026-82329