Attacks, Vulnerabilities and Actors 01 to 07 July 2024

For a detailed threat digest, download the pdf file here

Summary

HiveForce Labs has recently made substantial advancements in identifying cybersecurity
threats. In just the past week, HiveForce Labs detected eleven executed attacks,
reported five vulnerabilities, and identified three active adversaries. These findings
underscore the persistent and escalating danger of cyber intrusions.

Moreover, the 8220 Gang, also known as Water Sigbin, has been aggressively targeting
Oracle WebLogic servers to install cryptocurrency miners. In another development,
unidentified threat actors are exploiting the previously patched CVE-2021-40444
security vulnerability in Microsoft MSHTML to disseminate MerkSpy.

Additionally, the “regreSSHion” vulnerability, CVE-2024-6387, in OpenSSH allows
unauthenticated remote code execution with root privileges on glibc-based Linux
systems. A cyber espionage group known as Velvet Ant, linked to China, has been
exploiting the CVE-2024-20399 zero-day vulnerability since April to spread malware.
These increasing threats present a significant and immediate danger to users worldwide.

Subscribe to receive our weekly threat digests and newsletters directly in your inbox.