{"id":16980,"date":"2023-03-27T20:37:07","date_gmt":"2023-03-28T03:37:07","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=16980"},"modified":"2023-04-21T14:21:56","modified_gmt":"2023-04-21T21:21:56","slug":"articles-securins-threat-intelligence-mar-27-2023-mar-31-2023","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/securins-threat-intelligence-mar-27-2023-mar-31-2023\/","title":{"rendered":"Securin&#8217;s Threat Intelligence: Mar 27, 2023 &#8211; Mar 31, 2023"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"16980\" class=\"elementor elementor-16980\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-02c8318 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"02c8318\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ddbe16e\" data-id=\"ddbe16e\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a3fa264 elementor-widget elementor-widget-text-editor\" data-id=\"a3fa264\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\" style=\"line-height: 1.8; background-color: #ffffff; margin-top: 0pt; margin-bottom: 0pt; padding: 0pt 0pt 4pt; text-align: left;\"><strong><span style=\"color: #000000;\">This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/span><\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d81a1c5 elementor-widget elementor-widget-heading\" data-id=\"d81a1c5\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Check out our Threat Intelligence Podcast hosted by David Rushton!<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cd79f16 elementor-widget elementor-widget-text-editor\" data-id=\"cd79f16\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div style=\"padding: 56.25% 0 0 0; position: relative;\"><iframe style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%;\" title=\"UNC961 | Spyware | 3CX Application | Securin Threat Intelligence\" src=\"https:\/\/player.vimeo.com\/video\/813642691?h=1160383c37&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/div>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0f513b4 elementor-widget elementor-widget-spacer\" data-id=\"0f513b4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-06e09ce elementor-widget elementor-widget-heading\" data-id=\"06e09ce\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d7532f9 elementor-widget elementor-widget-text-editor\" data-id=\"d7532f9\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#unicode-support-in-python-exploited-to-evade-detection\">Unicode Support in Python Exploited to Evade Detection<\/a><\/li><li><a href=\"#chinese-app-exploited-zero-day-on-millions-of-devices\">Chinese App Exploited Zero-Day on Millions of Devices<\/a><\/li><li><a href=\"#spyware\">Spyware Vendors Exploit Several Vulnerabilities in Popular Platforms<\/a><\/li><li><a href=\"#3cx-supply-chain\">Hackers Compromise 3CX Application to Launch Supply Chain Attacks<\/a><\/li><li><a href=\"#alienfox\">New Malware Harvests API Keys<\/a><\/li><li><a href=\"#cisa-31-03\">CISA Adds 10 Vulnerabilities to the KEV catalog<\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-45e16b3 elementor-widget elementor-widget-heading\" data-id=\"45e16b3\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-78d7bb2 elementor-widget elementor-widget-text-editor\" data-id=\"78d7bb2\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#cve-2023-23529-apples-webkit-zero-day\"><span style=\"font-weight: 400;\">CVE-2023-23529: Apple\u2019s WebKit Zero-Day<\/span><\/a><\/li><li><a href=\"#cve-2023-22809-linux-sudo-vulnerability\">CVE-2023-22809: Linux Sudo Vulnerability<\/a><\/li><li><a href=\"#moobot-shellbot\">MooBot and ShellBot Malware Resurface<\/a><\/li><li><a href=\"#cve-2023-23383\">CVE-2023-23383: Azure Service Fabric Explorer (SFX) Vulnerability<\/a><\/li><li><a href=\"#cve-2022-27926\">CVE-2022-27926: Hackers Exploit this Zimbra Vulnerability<\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c5581d4 elementor-widget elementor-widget-spacer\" data-id=\"c5581d4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1272e27 elementor-widget elementor-widget-heading\" data-id=\"1272e27\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-585df2e elementor-widget elementor-widget-spacer\" data-id=\"585df2e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d252bc8 elementor-widget elementor-widget-menu-anchor\" data-id=\"d252bc8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"unicode-support-in-python-exploited-to-evade-detection\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-13dc0cf elementor-widget elementor-widget-heading\" data-id=\"13dc0cf\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Unicode Support in Python Exploited to Evade Detection<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-55db5e8 elementor-widget elementor-widget-text-editor\" data-id=\"55db5e8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">An unnamed threat actor was discovered using onyxproxy, a malicious package to harvest and exfiltrate credentials and other sensitive data, on the Python Package Index. To avoid detection while carrying out this attack, attackers used the Python interpreter to obfuscate their malware. The Python interpreter was used to generate a novel kind of obfuscated code that appears ordinary without divulging exactly what the code is trying to steal. Other attackers are expected to use this technique in their target environments to avoid detection.\u00a0<\/span><\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-42574\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-42574<\/span><\/a><span style=\"font-weight: 400;\"> is a vulnerability in Unicode BiDi that handles the order in which text displays. Threat actors have exploited this to carry out malicious script installation.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Given below is a timeline of this CVE on Securin\u2019s Vulnerability Intelligence platform.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-192430e elementor-widget elementor-widget-image\" data-id=\"192430e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"1217\" height=\"288\" src=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/Screen-Shot-2023-03-28-at-8.44.36-PM.png\" class=\"attachment-full size-full wp-image-16982\" alt=\"\" srcset=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/Screen-Shot-2023-03-28-at-8.44.36-PM.png 1217w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/Screen-Shot-2023-03-28-at-8.44.36-PM-300x71.png 300w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/Screen-Shot-2023-03-28-at-8.44.36-PM-1024x242.png 1024w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/Screen-Shot-2023-03-28-at-8.44.36-PM-768x182.png 768w\" sizes=\"(max-width: 1217px) 100vw, 1217px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2b086a7 elementor-widget elementor-widget-spacer\" data-id=\"2b086a7\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9178bd6 elementor-widget elementor-widget-menu-anchor\" data-id=\"9178bd6\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"chinese-app-exploited-zero-day-on-millions-of-devices\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7595659 elementor-widget elementor-widget-heading\" data-id=\"7595659\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Chinese App Exploited Zero-Day on Millions of Devices<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e72d174 elementor-widget elementor-widget-text-editor\" data-id=\"e72d174\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">The Pinduoduo app is used for e-commerce. The legitimate application is not available in the Google app store prompting users to download third-party versions. A malicious version of the application is available on these third-party websites which when downloaded and installed, exploits several zero-days and known vulnerabilities. One of the zero-days is <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-20963\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-20963<\/span><\/a><span style=\"font-weight: 400;\">, an Android vulnerability that was <\/span><a href=\"https:\/\/source.android.com\/docs\/security\/bulletin\/2023-03-01\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">patched<\/span><\/a><span style=\"font-weight: 400;\"> by Google two weeks ago. It can allow attackers to escalate privileges to download code from a developer-designated site and run it within a privileged environment. This vulnerability is actively being exploited in Samsung phones. The Pinduoduo application has about 900 million monthly active users and anyone who has downloaded it from unknown sources should verify its legitimacy.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-36afe28 elementor-widget elementor-widget-spacer\" data-id=\"36afe28\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f99739b elementor-widget elementor-widget-spacer\" data-id=\"f99739b\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d9cfb9b elementor-widget elementor-widget-menu-anchor\" data-id=\"d9cfb9b\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"spyware\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8cd00d5 elementor-widget elementor-widget-heading\" data-id=\"8cd00d5\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Spyware Vendors Exploit Several Vulnerabilities in Popular Platforms<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bb3adc4 elementor-widget elementor-widget-text-editor\" data-id=\"bb3adc4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Several zero-day and n-day vulnerabilities are exploited in two campaigns carried out by threat actors selling spyware. They target Google (Pixel), Android, and iOS devices of government officials, journalists, activists, etc, to spy on them. Some of the vulnerabilities being exploited are:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/support.apple.com\/en-gb\/HT213597\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-42856<\/span><\/a><span style=\"font-weight: 400;\">, a WebKit remote code execution exploiting a type confusion issue within the JIT compiler. The exploit used a PAC bypass technique which was <\/span><a href=\"https:\/\/bugs.webkit.org\/show_bug.cgi?id=237867\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">fixed<\/span><\/a><span style=\"font-weight: 400;\"> in March 2022 when Apple removed DYLD_INTERPOSE from WebKit.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/support.apple.com\/en-us\/HT212872\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-30900<\/span><\/a><span style=\"font-weight: 400;\">, a sandbox escape and privilege escalation bug in AGXAccelerator, Apple.\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/chromereleases.googleblog.com\/2022\/10\/stable-channel-update-for-desktop_27.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-3723<\/span><\/a><span style=\"font-weight: 400;\">, a type confusion vulnerability in Chrome which was exploited in the wild.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/chromereleases.googleblog.com\/2022\/11\/stable-channel-update-for-desktop_24.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-4135<\/span><\/a><span style=\"font-weight: 400;\">, a Chrome GPU sandbox bypass only affecting Android\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/chromereleases.googleblog.com\/2022\/12\/stable-channel-update-for-desktop.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-4262<\/span><\/a><span style=\"font-weight: 400;\">, a type confusion vulnerability in Chrome fixed in December 2022.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/chromereleases.googleblog.com\/2022\/08\/stable-channel-update-for-desktop_30.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-3038<\/span><\/a><span style=\"font-weight: 400;\">, a sandbox escape in Chrome fixed in August 2022.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22706\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-22706<\/span><\/a><span style=\"font-weight: 400;\">, a vulnerability in Mali GPU Kernel Driver <\/span><a href=\"https:\/\/developer.arm.com\/Arm%20Security%20Center\/Mali%20GPU%20Driver%20Vulnerabilities\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">fixed<\/span><\/a><span style=\"font-weight: 400;\"> by ARM in January 2022 and marked as being used in the wild. An attacker can gain system access by exploiting this vulnerability.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-0266\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-0266<\/span><\/a><span style=\"font-weight: 400;\">, a race condition vulnerability in the Linux kernel sound subsystem reachable from the system user and that gives the attacker kernel read and write access.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">Attackers look for unpatched devices to exploit these vulnerabilities. Therefore, all users must cautiously update their devices as soon as the vendor releases patches.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d832123 elementor-widget elementor-widget-spacer\" data-id=\"d832123\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cd2e457 elementor-widget elementor-widget-menu-anchor\" data-id=\"cd2e457\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"3cx-supply-chain\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1365d06 elementor-widget elementor-widget-heading\" data-id=\"1365d06\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Hackers Compromise 3CX Application to Launch Supply Chain Attacks\n<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-befa1f3 elementor-widget elementor-widget-text-editor\" data-id=\"befa1f3\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Labyrinth Chollima, a subset of the Lazarus group is suspected to have been launching supply chain attacks using a trojanized version of the 3CX application. The 3CX desktop app is a computer program available for Mac and Windows that allows users to make and receive VoIP calls from their computer via the internet. A digitally signed malicious version of this app is used to target the company\u2019s customers. This campaign is called SmoothOperator and installs malicious DLL, which can deploy secondary payloads. The malware is then used to extract system info, steal data and stored credentials from Chrome, Edge, Brave, and Firefox user profiles.<\/span><\/p><p><span style=\"font-weight: 400;\">3CX users should watch out for malicious versions of the app and download it only from trusted sources.<\/span><\/p><p><span style=\"font-weight: 400;\"><strong>Update<\/strong>: The Lazarus group is found to be behind these supply chain attacks. The vulnerabilty being exploited by this gang is tracked as\u00a0<\/span>CVE-2023-29059, a Windows zero-day.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c0cceed elementor-widget elementor-widget-spacer\" data-id=\"c0cceed\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4f87b68 elementor-widget elementor-widget-menu-anchor\" data-id=\"4f87b68\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"alienfox\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c839ffa elementor-widget elementor-widget-heading\" data-id=\"c839ffa\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">New Malware Harvests API Keys\n<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cfd0d32 elementor-widget elementor-widget-text-editor\" data-id=\"cfd0d32\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">A new toolkit, AlienFox, that steals authentication secrets and credentials is available in the market. It targets misconfigured hosting frameworks, such as Laravel, Drupal, WordPress, etc to collect credentials, API keys, authentication tokens, etc. It also collects lists of misconfigured cloud endpoints from security scanning platforms like LeakIX and SecurityTrails. This information is leveraged by threat actors to break into organization networks and deploy ransomware or take over systems. The toolkit is sold on a private Telegram channel to threat actors. There are several versions of this toolkit. The second version features an exploit for <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-31279\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-31279<\/span><\/a><span style=\"font-weight: 400;\">, a deserialization vulnerability on Laravel PHP Framework. The third version features initialization variables, Python classes with modular functions, and process threading.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7e7fdd7 elementor-widget elementor-widget-menu-anchor\" data-id=\"7e7fdd7\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"cisa-31-03\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bd528a9 elementor-widget elementor-widget-heading\" data-id=\"bd528a9\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">CISA Adds 10 Vulnerabilities to the KEV catalog<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4e1e9e0 elementor-widget elementor-widget-text-editor\" data-id=\"4e1e9e0\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Following the active exploitation of vulnerabilities in popular platforms such as Google, Apple, etc., to install spyware, the CISA added them to the KEV catalog on March 31, 2022 to raise awareness. They are:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-30900\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-30900<\/span><\/a><span style=\"font-weight: 400;\">, Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-38181\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-38181<\/span><\/a><span style=\"font-weight: 400;\">, Arm Mali GPU Kernel Driver Use-After-Free Vulnerability<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-0266\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-0266<\/span><\/a><span style=\"font-weight: 400;\">, Linux Kernel Use-After-Free Vulnerability<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-3038\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-3038<\/span><\/a><span style=\"font-weight: 400;\">, Google Chrome Use-After-Free Vulnerability<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22706\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-22706<\/span><\/a><span style=\"font-weight: 400;\">, Arm Mali GPU Kernel Driver Unspecified Vulnerability<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">The rest of the vulnerabilities are:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2013-3163\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2013-3163<\/span><\/a><span style=\"font-weight: 400;\">, Microsoft Internet Explorer RCE Vulnerability<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2014-1776\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2014-1776<\/span><\/a><span style=\"font-weight: 400;\">, Microsoft Internet Explorer Use-after-free RCE Vulnerability<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-7494\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2017-7494<\/span><\/a><span style=\"font-weight: 400;\">, Samba RCE Vulnerability<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-42948\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-42948<\/span><\/a><span style=\"font-weight: 400;\">, Cobalt Strike RCE Vulnerability<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-39197\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-39197<\/span><\/a><span style=\"font-weight: 400;\">, Cobalt Strike cross-site scripting (XSS) Vulnerability<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">All these vulnerabilities need to be patched by April 20, 2023.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-41163b6 elementor-widget elementor-widget-spacer\" data-id=\"41163b6\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0937f84 elementor-widget elementor-widget-heading\" data-id=\"0937f84\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d574dff elementor-widget elementor-widget-spacer\" data-id=\"d574dff\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ba4d590 elementor-widget elementor-widget-menu-anchor\" data-id=\"ba4d590\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"cve-2023-23529-apples-webkit-zero-day\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-77b0b26 elementor-widget elementor-widget-heading\" data-id=\"77b0b26\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2023-23529: Apple\u2019s WebKit Zero-Day<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-32bb1a4 elementor-widget elementor-widget-text-editor\" data-id=\"32bb1a4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Apple recently <\/span><a href=\"https:\/\/www.securin.io\/securins-threat-intelligence-feb-13-2023-feb-17-2023\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">addressed<\/span><\/a><span style=\"font-weight: 400;\"> this zero day vulnerability in its macOS and iOS devices. <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-23529\" target=\"_blank\" rel=\"noopener\">CVE-2023-23529<\/a> allows arbitrary code execution with maliciously crafted web content. This actively exploited CVE affects older Apple devices such as iPhone 6s and 7 (all models),\u00a0 iPhone SE (first generation), iPad Air 2, iPad Mini (fourth generation), and iPod Touch (seventh generation) for which the <\/span><a href=\"https:\/\/support.apple.com\/en-us\/HT213673#:~:text=CVE%2D2023%2D23529%3A%20an%20anonymous%20researcher\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">patches<\/span><\/a><span style=\"font-weight: 400;\"> are available now.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-26cfb01 elementor-widget elementor-widget-spacer\" data-id=\"26cfb01\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-400fc39 elementor-widget elementor-widget-menu-anchor\" data-id=\"400fc39\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"cve-2023-22809-linux-sudo-vulnerability\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8d718d5 elementor-widget elementor-widget-heading\" data-id=\"8d718d5\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">CVE-2023-22809: Linux Sudo Vulnerability<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-74fff7d elementor-widget elementor-widget-text-editor\" data-id=\"74fff7d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">This <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-22809\" target=\"_blank\" rel=\"noopener\">CVE-2023-22809<\/a> vulnerability is in QNAP\u2019s Linux-powered network-attached storage (NAS) devices, specifically, in the. If exploited, attackers can escalate privileges by editing unauthorized files after appending arbitrary entries to the list of files to process. QNAP has released an <\/span><a href=\"https:\/\/www.qnap.com\/en\/security-advisory\/qsa-23-11\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">advisory<\/span><\/a><span style=\"font-weight: 400;\"> to patch all affected devices and recommends that users patch ASAP.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d47b516 elementor-widget elementor-widget-spacer\" data-id=\"d47b516\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-50c679f elementor-widget elementor-widget-menu-anchor\" data-id=\"50c679f\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"moobot-shellbot\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6b214ac elementor-widget elementor-widget-heading\" data-id=\"6b214ac\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">MooBot and ShellBot Malware Resurface\n<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9d33ffe elementor-widget elementor-widget-text-editor\" data-id=\"9d33ffe\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Threat actors have been deploying the ShellBot and Moobot malware while exploiting CVE-2021-35394 (Realtek) and CVE-2022-46169 (Cacti) vulnerabilities.\u00a0<\/span><\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-35394\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-35394<\/span><\/a><span style=\"font-weight: 400;\"> is an arbitrary command injection vulnerability that affects UDPServer due to insufficient legality detection on commands received from clients.\u00a0<\/span><\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-46169\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-46169<\/span><\/a><span style=\"font-weight: 400;\"> is a command injection vulnerability that allows an unauthenticated user to execute arbitrary code on a server running Cacti.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Both these are marked as high-severity vulnerabilities and can be used for remote code execution. Moobot malware can deploy brute force attacks, while ShellBot variants can install other malware from their C2 server.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fda4b9f elementor-widget elementor-widget-spacer\" data-id=\"fda4b9f\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5b0be8f elementor-widget elementor-widget-menu-anchor\" data-id=\"5b0be8f\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"cve-2023-23383\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-361cb14 elementor-widget elementor-widget-heading\" data-id=\"361cb14\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">CVE-2023-23383: Azure Service Fabric Explorer (SFX) Vulnerability<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5fc111c elementor-widget elementor-widget-text-editor\" data-id=\"5fc111c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">This <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-23383\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">flaw <\/span><\/a><span style=\"font-weight: 400;\">is named FabriXss. It impacts the Azure Service Fabric Explorer and is rated 8.2 in the CVSS scale. Attackers can exploit it by sending a crafted URL to any Azure Service Fabric user and then remotely execute code on the container which is deployed to the cluster. An attacker can even take over critical systems.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Microsoft <\/span><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2023-23383\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">fixed<\/span><\/a><span style=\"font-weight: 400;\"> this vulnerability and is urging users to apply it.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0946e8e elementor-widget elementor-widget-spacer\" data-id=\"0946e8e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a062bfc elementor-widget elementor-widget-menu-anchor\" data-id=\"a062bfc\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"cve-2022-27926\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3eba985 elementor-widget elementor-widget-heading\" data-id=\"3eba985\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">CVE-2022-27926: Hackers Exploit this Zimbra Vulnerability<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f0cdb97 elementor-widget elementor-widget-text-editor\" data-id=\"f0cdb97\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-27926\" target=\"_blank\" rel=\"noopener\">CVE-2022-27926<\/a> is a cross-site scripting (XSS) vulnerability in Zimbra Collaboration products. An unauthenticated attacker can execute arbitrary web script or HTML via request parameters by exploiting this vulnerability. A hacking group known as Winter Vivern has been exploiting this vulnerability in attacks against NATO entities. They mimicked European agency sites fighting cybercrime to spread malware that pretends to be a virus scanner. Initial access is gained through phishing emails with a link that exploits <\/span><span style=\"font-weight: 400;\">CVE-2022-27926<\/span><span style=\"font-weight: 400;\"> and injects other JavaScript payloads into the webpage. The payloads then extract usernames, passwords, and tokens from cookies received from the compromised Zimbra endpoint.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b1b0790 elementor-widget elementor-widget-spacer\" data-id=\"b1b0790\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5661ac2 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5661ac2\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-12cd24e\" data-id=\"12cd24e\" data-element_type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6a79af4 elementor-widget elementor-widget-spacer\" data-id=\"6a79af4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8edd1c elementor-widget elementor-widget-text-editor\" data-id=\"f8edd1c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #000000;\">Follow our weekly blog and podcast to get proactive alerts on trending threats.<\/span><\/strong><\/p><p style=\"text-align: center;\"><strong>Leverage our expertise and manage your threats continuously to stay safe from attackers. <\/strong><a href=\"\/contact-us\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Talk to Us!<\/span><\/a><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-56b9a97 elementor-widget elementor-widget-spacer\" data-id=\"56b9a97\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>We bring you threats that are currently trending as well as new vulnerabilities that hackers are exploiting.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[80,146],"tags":[172,614,630,627,629,149],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/16980"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/comments?post=16980"}],"version-history":[{"count":37,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/16980\/revisions"}],"predecessor-version":[{"id":17952,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/16980\/revisions\/17952"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=16980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/categories?post=16980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/tags?post=16980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}