exploitation

  1. AA21-055A: Exploitation of Accellion File Transfer Appliance

    Original release date: February 24, 2021 Summary This joint advisory is the result of a collaborative effort by the cybersecurity authorities of Australia,[Link Removed] New Zealand,[2] Singapore,[3] the United Kingdom,[4] and the United States.[Link Removed][6] These authorities are aware of...
    • News
    • Thread
    • accellion cisa cyber actors cybersecurity data theft end of life exploitation extortion file sharing file transfer incident response iocs malware mitigation patch remediation security advisory sql injection vulnerabilities zero-day
    • Replies: 0
    • Forum: Security Alerts

  2. AA21-042A: Compromise of U.S. Water Treatment Facility

    Original release date: February 11, 2021 Summary On February 5, 2021, unidentified cyber actors obtained unauthorized access to the supervisory control and data acquisition (SCADA) system at a U.S. drinking water treatment plant. The unidentified actors used the SCADA system’s software to...
    • News
    • Thread
    • access denied cisa cyber hygiene cyber threats cybersecurity epa exploitation fbi hygiene infrastructure security legacy systems mitigation password management physical security rdp vulnerability scada social engineering teamviewer water treatment windows 7
    • Replies: 0
    • Forum: Security Alerts

  3. AA20-283A: APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations

    Original release date: October 9, 2020 Summary This joint cybersecurity advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. Note: the analysis in this joint...
    • News
    • Thread
    • active directory apt cisa cve-2020-1472 cybersecurity elections exploitation fortinet incident response legacy systems malware mitigation monitoring netlogon network security privilege escalation remote access vpn vulnerabilities windows
    • Replies: 0
    • Forum: Security Alerts

  4. AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902

    Original release date: July 24, 2020 Summary The Cybersecurity and Infrastructure Security Agency (CISA) is issuing this alert in response to recently disclosed exploits that target F5 BIG-IP devices that are vulnerable to CVE-2020-5902. F5 Networks, Inc. (F5) released a patch for CVE-2020-5902...
    • News
    • Thread
    • cisa credential theft cve-2020-5902 cybersecurity data exfiltration detection digital security exploitation f5 big-ip incident response malware mitigation network segmentation patch management remote code execution security security advisory system compromise threat actors vulnerability
    • Replies: 0
    • Forum: Security Alerts

  5. AA20-195A: Critical Vulnerability in SAP NetWeaver AS Java

    Original release date: July 13, 2020 Summary On July 13, 2020 EST, SAP released a Link Removed to address a critical vulnerability, Link Removed, affecting the SAP NetWeaver Application Server (AS) Java component LM Configuration Wizard. An unauthenticated attacker can exploit this...
    • News
    • Thread
    • access application attacker cisa configuration cve-2020-6287 cybersecurity data exploitation integrity java mitigation monitoring netweaver patch recommendations sap security system vulnerability
    • Replies: 0
    • Forum: Security Alerts

  6. AA20-133A: Top 10 Routinely Exploited Vulnerabilities

    Original release date: May 12, 2020 Summary The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the broader U.S. Government are providing this technical guidance to advise IT security professionals at public and private sector...
    • News
    • Thread
    • adobe flash best practices cisa cve cybersecurity exploitation fbi foreign actors indicator malware microsoft mitigation network security o365 patch management ransomware security threats vpn vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  7. AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

    Original release date: April 16, 2020 | Last revised: June 30, 2020 Summary Note: This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques and mitigations...
    • News
    • Thread
    • active directory cisa credential dumping cve-2019-11510 cybersecurity detection exploitation incident response indicators of compromise iocs lateral movement mitigation network security pulse secure ransomware remote access remote services threat actors vpn vulnerability
    • Replies: 0
    • Forum: Security Alerts

  8. AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor

    Original release date: July 1, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) and Pre-ATT&CK framework. See the ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques. This advisory—written by the...
    • News
    • Thread
    • anonymity apt cisa command and control cybersecurity data exfiltration data manipulation denial of service exploitation fbi incident response indicators of compromise malicious software network monitoring network security reconnaissance risk mitigation security software threat actors tor
    • Replies: 0
    • Forum: Security Alerts

  9. AA20-133A: Top 10 Routinely Exploited Vulnerabilities

    Original release date: May 12, 2020 Summary The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the broader U.S. Government are providing this technical guidance to advise IT security professionals at public and private sector...
    • News
    • Thread
    • apachestruts cisa cloud computing cve cybersecurity education exploitation malware microsoft mitigation network security ole patch management ransomware remote work security best practices threats vpn vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  10. AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

    Original release date: April 16, 2020 Summary Note: This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques and mitigations. This Alert provides an update...
    • News
    • Thread
    • active directory credential theft cve-2019-11510 cyber threats cybersecurity data exfiltration detection exploitation incident response indicators of compromise lateral movement malware mitigation network security patch management pulse secure remote access threat actors vpn vulnerability
    • Replies: 0
    • Forum: Security Alerts

  11. AA20-099A: COVID-19 Exploited by Malicious Cyber Actors

    Original release date: April 8, 2020 Summary This is a joint alert from the United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC). This alert provides information on...
    • News
    • Thread
    • apt groups cisa covid 19 credential theft cyber threats cybersecurity exploitation indicators of compromise malicious software malware mitigation ncsc phishing ransomware remote access scam social engineering teleconferencing telework vpn
    • Replies: 0
    • Forum: Security Alerts

  12. AA20-031A: Detecting Citrix CVE-2019-19781

    Original release date: January 31, 2020 Summary Unknown cyber network exploitation (CNE) actors have successfully compromised numerous organizations that employed vulnerable Citrix devices through a critical vulnerability known as CVE-2019-19781.Link Removed Though mitigations were released...
    • News
    • Thread
    • alert apache backdoor citrix cve-2019-19781 cybersecurity detection exploitation firmware intrusion iocs log review mitigation network network traffic process remediation security technical vulnerability
    • Replies: 0
    • Forum: Security Alerts

  13. AA20-020A: Critical Vulnerability in Citrix Application Delivery Controller, Gateway, and SD-WAN WANOP

    Original release date: January 20, 2020<br/><h3>Summary</h3><p>On January 19, 2020, Citrix released firmware updates for Citrix Application Delivery Controller (ADC) and Citrix Gateway versions 11.1 and 12.0 to address CVE-2019-19781. Citrix expects to release updates for other vulnerable...
    • News
    • Thread
    • adc appliances cisa citrix critical cve-2019-19781 cybersecurity detection execution exploitation firmware gateway impact mitigation nsa remote sd-wan security update vulnerability
    • Replies: 0
    • Forum: Security Alerts

  14. AA20-014A: Critical Vulnerabilities in Microsoft Windows Operating Systems

    Original release date: January 14, 2020 Summary New vulnerabilities are continually emerging, but the best defense against attackers exploiting patched vulnerabilities is simple: keep software up to date. Timely patching is one of the most efficient and cost-effective steps an organization can...
    • News
    • Thread
    • certificate cryptography api cve-2020-0601 cve-2020-0609 cve-2020-0610 cve-2020-0611 cybersecurity exploitation information technology malware mitigation network patch management rdp remote desktop security threats vulnerabilities windows
    • Replies: 0
    • Forum: Security Alerts

  15. AA20-010A: Continued Exploitation of Pulse Secure VPN Vulnerability

    Original release date: January 10, 2020 Summary Unpatched Pulse Secure VPN servers continue to be an attractive target for malicious actors. Affected organizations that have not applied the software patch to fix a remote code execution (RCE) vulnerability, known as CVE-2019-11510, can become...
    • News
    • Thread
    • access denied cisa cve-2019-11510 cyber threats cybersecurity exploitation incident response malware mitigation network security patch management pulse secure rce remote access security advisory software update threat actors unpatched servers vpn vulnerability
    • Replies: 0
    • Forum: Security Alerts

  16. Patch new wormable vulnerabilities in Remote Desktop Services (CVE-2019-1181/1182)

    Today Microsoft released a set of fixes for Remote Desktop Services that include two critical Remote Code Execution (RCE) vulnerabilities, CVE-2019-1181 and CVE-2019-1182. Like the previously-fixed ‘BlueKeep’ vulnerability (CVE-2019-0708), these two vulnerabilities are also ‘wormable’, meaning...
    • News
    • Thread
    • bluekeep cve-2019-1181 cve-2019-1182 exploitation fixes malware microsoft patch propagation rce remote desktop security vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  17. SATIRE US Visit . What Could Possible Go Wrong ?

    🇺🇸 :p
    • whoosh
    • Thread
    • exploitation labor labor rights workplace safety
    • Replies: 1
    • Forum: The Water Cooler

  18. Tutorial: Analyzing Malicious PDFs

    Hi all, in this post we will be exploring malicious PDF files and how the bad guys leverage them to infect computer systems. I'm sure a lot of people are familiar with receiving a strange email often times seemingly from a known person containing an attachment. You open it and miraculously...
    • Neemobeer
    • Thread
    • analysis data extraction documents embedded files execution exploitation infection javascript macro malicious files malware oletools openaction payload pdf python security tutorial
    • Replies: 3
    • Forum: Windows Security

  19. AA19-168A: Microsoft Operating Systems BlueKeep Vulnerability

    Original release date: June 17, 2019 Summary The Cybersecurity and Infrastructure Security Agency (CISA) is issuing this Activity Alert to provide information on a vulnerability, known as “BlueKeep,” that exists in the following Microsoft Windows Operating Systems (OSs), including both 32- and...
    • News
    • Thread
    • authentication bluekeep cisa cve-2019-0708 cybersecurity end of life exploitation malware microsoft mitigation operating system patch patch management rdp remote access security tcp/ip user rights vulnerability windows
    • Replies: 0
    • Forum: Security Alerts

  20. TA18-106A: Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices

    Original release date: April 16, 2018 Systems Affected Generic Routing Encapsulation (GRE) Enabled Devices Cisco Smart Install (SMI) Enabled Devices Simple Network Management Protocol (SNMP) Enabled Network Devices Overview This joint Technical Alert (TA) is the result of analytic efforts...
    • News
    • Thread
    • command and control critical infrastructure cybersecurity dhs espionage exploitation fbi hacking indicators of compromise infrastructure international security legacy protocols malware mitigation network devices russian actors smart install snmp telnet tftp
    • Replies: 0
    • Forum: Security Alerts