December 2023
06.12.2023
US CERT
Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns
Title
Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns
Published
Dec. 6, 2023, 9:18 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a
Summary
The Russia-based actor is targeting organizations and individuals in the UK and other geographical areas of interest. OVERVIEW The Russia-based actor Star Blizzard (formerly known as SEABORGIUM, also known as Callisto Group/TA446/COLDRIVER/TAG-53/BlueCharlie) continues to successfully use spear-phishing attacks against targeted organizations and individuals in the UK, and other geographical areas ...
04.12.2023
US CERT
Threat Actors Exploit Adobe ColdFusion CVE-2023-26360 for Initial Access to Government Servers
Title
Threat Actors Exploit Adobe ColdFusion CVE-2023-26360 for Initial Access to Government Servers
Published
Dec. 4, 2023, 7:05 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-339a
Summary
SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) is releasing a Cybersecurity Advisory (CSA) in response to confirmed exploitation of CVE-2023-26360 by unidentified threat actors at a Federal Civilian Executive Branch (FCEB) agency. This vulnerability presents as an improper access control issue impacting Adobe ColdFusion versions 2018 Update 15 (and ...
01.12.2023
US CERT
IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities
Title
IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities
Published
Dec. 1, 2023, 11:21 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a
Summary
SUMMARY The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), and the Israel National Cyber Directorate (INCD)—hereafter referred to as "the authoring agencies"—are disseminating this joint Cybersecurity Advisory (CSA) to highlight continued malicious cyber activity against operational technology devices ...
November 2023
21.11.2023
US CERT
#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability
Title
#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability
Published
Nov. 21, 2023, 2:50 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a
Summary
SUMMARY Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...
15.11.2023
US CERT
Scattered Spider
Title
Scattered Spider
Published
Nov. 15, 2023, 3:55 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
Summary
SUMMARY The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory (CSA) in response to recent activity by Scattered Spider threat actors against the commercial facilities sectors and subsectors. This advisory provides tactics, techniques, and procedures (TTPs) obtained through FBI investigations ...
14.11.2023
US CERT
#StopRansomware: Rhysida Ransomware
Title
#StopRansomware: Rhysida Ransomware
Published
Nov. 14, 2023, 5:45 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
Summary
SUMMARY Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders detailing various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect ...
October 2023
13.10.2023
US CERT
Threat Actors Exploit Atlassian Confluence CVE-2023-22515 for Initial Access to Networks
Title
Threat Actors Exploit Atlassian Confluence CVE-2023-22515 for Initial Access to Networks
Published
Oct. 13, 2023, 10:48 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a
Summary
SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint Cybersecurity Advisory (CSA) in response to the active exploitation of CVE-2023-22515. This recently disclosed vulnerability affects certain versions of Atlassian Confluence Data Center and Server, ...
10.10.2023
US CERT
#StopRansomware: AvosLocker Ransomware (Update)
Title
#StopRansomware: AvosLocker Ransomware (Update)
Published
Oct. 10, 2023, 5:46 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-284a
Summary
SUMMARY Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...
02.10.2023
US CERT
NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations
Title
NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations
Published
Oct. 2, 2023, 9:42 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a
Summary
A plea for network defenders and software manufacturers to fix common problems. EXECUTIVE SUMMARY The National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint cybersecurity advisory (CSA) to highlight the most common cybersecurity misconfigurations in large organizations, and detail the tactics, techniques, and procedures ...
September 2023
26.09.2023
US CERT
People's Republic of China-Linked Cyber Actors Hide in Router Firmware
Title
People's Republic of China-Linked Cyber Actors Hide in Router Firmware
Published
Sept. 26, 2023, 9:45 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a
Summary
Executive Summary The United States National Security Agency (NSA), the U.S. Federal Bureau of Investigation (FBI), the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Japan National Police Agency (NPA), and the Japan National Center of Incident Readiness and Strategy for Cybersecurity (NISC) (hereafter referred to as the “authoring agencies”) ...
18.09.2023
US CERT
#StopRansomware: Snatch Ransomware
Title
#StopRansomware: Snatch Ransomware
Published
Sept. 18, 2023, 11:27 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a
Summary
SUMMARY Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...
06.09.2023
US CERT
Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475
Title
Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475
Published
Sept. 6, 2023, 7:03 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a
Summary
SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Cyber National Mission Force (CNMF) identified the presence of indicators of compromise (IOCs) at an Aeronautical Sector organization as early as January 2023. Analysts confirmed that nation-state advanced persistent threat (APT) actors exploited CVE-2022-47966 to gain ...
August 2023
29.08.2023
US CERT
Identification and Disruption of QakBot Infrastructure
Title
Identification and Disruption of QakBot Infrastructure
Published
Aug. 29, 2023, 9:28 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-242a
Summary
SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory (CSA) to disseminate QakBot infrastructure indicators of compromise (IOCs) identified through FBI investigations as of August 2023. On August 25, FBI and international partners executed a coordinated operation to disrupt ...
02.08.2023
US CERT
2022 Top Routinely Exploited Vulnerabilities
Title
2022 Top Routinely Exploited Vulnerabilities
Published
Aug. 2, 2023, 8:57 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a
Summary
SUMMARY The following cybersecurity agencies coauthored this joint Cybersecurity Advisory (CSA): United States: The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Federal Bureau of Investigation (FBI) Australia: Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) Canada: Canadian Centre for Cyber Security (CCCS) New Zealand: New Zealand ...
01.08.2023
US CERT
Threat Actors Exploiting Ivanti EPMM Vulnerabilities
Title
Threat Actors Exploiting Ivanti EPMM Vulnerabilities
Published
Aug. 1, 2023, 4:42 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a
Summary
SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) are releasing this joint Cybersecurity Advisory (CSA) in response to active exploitation of CVE-2023-35078 and CVE-2023-35081. Advanced persistent threat (APT) actors exploited CVE-2023-35078 as a zero day from at least April 2023 through July ...
July 2023
26.07.2023
US CERT
Preventing Web Application Access Control Abuse
Title
Preventing Web Application Access Control Abuse
Published
July 26, 2023, 11:10 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-208a
Summary
SUMMARY The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), U.S. Cybersecurity and Infrastructure Security Agency (CISA), and U.S. National Security Agency (NSA) are releasing this joint Cybersecurity Advisory to warn vendors, designers, and developers of web applications and organizations using web applications about insecure direct object reference (IDOR) vulnerabilities. ...
20.07.2023
US CERT
Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells
Title
Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells
Published
July 20, 2023, 9:28 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a
Summary
SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this Cybersecurity Advisory to warn network defenders about exploitation of CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway. In June 2023, threat actors exploited this vulnerability as a zero-day ...
11.07.2023
US CERT
Enhanced Monitoring to Detect APT Activity Targeting Outlook Online
Title
Enhanced Monitoring to Detect APT Activity Targeting Outlook Online
Published
July 11, 2023, 11:55 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a
Summary
SUMMARY In June 2023, a Federal Civilian Executive Branch (FCEB) agency identified suspicious activity in their Microsoft 365 (M365) cloud environment. The agency reported the activity to Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA), and Microsoft determined that advanced persistent threat (APT) actors accessed and exfiltrated unclassified Exchange ...
05.07.2023
US CERT
Increased Truebot Activity Infects U.S. and Canada Based Networks
Title
Increased Truebot Activity Infects U.S. and Canada Based Networks
Published
July 5, 2023, 11:30 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-187a
Summary
SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Canadian Centre for Cyber Security (CCCS) are releasing this joint Cybersecurity Advisory (CSA) in response to cyber threat actors leveraging newly identified Truebot malware variants against ...
June 2023
12.06.2023
US CERT
Understanding Ransomware Threat Actors: LockBit
Title
Understanding Ransomware Threat Actors: LockBit
Published
June 12, 2023, 6:22 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a
Summary
SUMMARY In 2022, LockBit was the most deployed ransomware variant across the world and continues to be prolific in 2023. Since January 2020, affiliates using LockBit have attacked organizations of varying sizes across an array of critical infrastructure sectors, including financial services, food and agriculture, education, energy, government and emergency ...
06.06.2023
US CERT
#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability
Title
#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability
Published
June 6, 2023, 10:58 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
Summary
SUMMARY Note: this joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...
May 2023
23.05.2023
US CERT
People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection
Title
People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection
Published
May 23, 2023, 8:06 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
Summary
Summary The United States and international cybersecurity authorities are issuing this joint Cybersecurity Advisory (CSA) to highlight a recently discovered cluster of activity of interest associated with a People’s Republic of China (PRC) state-sponsored cyber actor, also known as Volt Typhoon. Private sector partners have identified that this activity affects ...
15.05.2023
US CERT
#StopRansomware: BianLian Ransomware Group
Title
#StopRansomware: BianLian Ransomware Group
Published
May 15, 2023, 6:29 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a
Summary
Summary Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...
10.05.2023
US CERT
Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG
Title
Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG
Published
May 10, 2023, 11:35 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a
Summary
SUMMARY The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory (CSA) in response to the active exploitation of CVE-2023-27350. This vulnerability occurs in certain versions of PaperCut NG and PaperCut MF and enables an unauthenticated actor to execute malicious code ...
08.05.2023
US CERT
Hunting Russian Intelligence “Snake” Malware
Title
Hunting Russian Intelligence “Snake” Malware
Published
May 8, 2023, 11:02 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a
Summary
SUMMARY The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia’s Federal Security Service (FSB) for long-term intelligence collection on sensitive targets. To conduct operations using this tool, the FSB created a covert peer-to-peer (P2P) network of numerous Snake-infected computers worldwide. ...

Last Updates

BOSCH PSIRT
31.10.2024
SIEMENS CERT
26.11.2024
US CERT
08.11.2024
US CERT (ICS)
03.12.2024

By Source

Archive

2024
2023
2022
2021
2020
2019
2018
2017

Feeds