30
45
30
35
30
35
35
Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
Kaspersky reports Mustang Panda's updated CoolClient backdoor now deploys a signed kernel-mode Windows rootkit, hitting government victims in Myanmar, Mongolia, Pakistan, and Russia.
Kaspersky identified a new CoolClient variant attributed to HoneyMyte (Mustang Panda) that installs a digitally signed Windows kernel driver, msagent.sys, to hide and protect malicious processes, files, registry keys, and C2 network information. CoolClient is consistently deployed as a secondary backdoor after PlugX, with confirmed victims including government entities in Myanmar, Mongolia, Pakistan, and Russia. In a Myanmar campaign, PlugX was used to deploy CoolClient via a renamed Sangfor executable for DLL side-loading, a scheduled task for persistence, and RPC-based process creation with PPID spoofing. The driver, signed with a 2013 certificate issued to Nanjing Ranyi Technology, implements 33 IOCTL handlers, process hiding via unlinking, a filesystem minifilter, and registry callbacks.
62
30
30
30
30
30
30
30
30
Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability
Cisco patched an authenticated command injection in ThousandEyes Virtual Appliance allowing arbitrary OS command execution with root privileges.
Improper validation of user-supplied input in the web-based management interface of Cisco ThousandEyes Virtual Appliance enables command injection. An authenticated remote attacker with valid administrative credentials can save configuration details containing malicious values to execute arbitrary operating system commands with root privileges. Cisco has released software updates that address the vulnerability.
28
30
35
30
30
30
30
50
30
35
35
30
30
30
30
AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments
Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.
Unit 42's automated BOLA detection tool, built on generative AI, uncovered 15 broken object-level authorization flaws in the open-source scheduling application Easy!Appointments, tracked as CVE-2023-3285 through CVE-2023-3290 and CVE-2023-38047 through CVE-2023-38055. Nine flaws scored CVSS 9.9, letting logged-in customers view or manipulate appointments and accounts of providers and admins, including creating admin users for privilege escalation. The maintainers patched all issues in version 1.5.0. The same tool previously found a BOLA in Grafana (CVE-2024-1313).
48
30
50
30
50
30
30
30
30