Fake attachment. Roundcube mail server attacks exploit CVE-2024-37383 vulnerability.


In September 2024, threat intelligence experts from the Positive Technologies Security Expert Center (PT ESC) discovered an email sent to a governmental organization belonging to a CIS country. Timestamps indicate that the email was sent back in June 2024. The email appeared to be a message without text, containing only an attached document.

However, the email client didn’t show the attachment. The body of the email contained distinctive tags with the statement eval(atob(…)), which decode and execute JavaScript code:

Read more…
Source: Positive Technologies


Sign up for our Newsletter


Related:

  • CVE-2024-9379: Ivanti Cloud Service Appliance Authenticated SQL Injection

    November 1, 2024

    The SonicWall Capture Labs threat research team became aware of an authenticated SQL injection vulnerability affecting Ivanti Cloud Service Appliances (CSA). Identified as CVE-2024-9379 and with a moderate score of 6.5 CVSSv3, the vulnerability is more severe than it initially appears due to reported exploitation attempts. Recently, in its October security update, Ivanti announced, “We are ...

  • Loose-lipped neural networks and lazy scammers

    October 31, 2024

    One topic being actively researched in connection with the breakout of LLMs is capability uplift – when employees with limited experience or resources in some area become able to perform at a much higher level thanks to LLM technology. This is especially important in information security, where cyberattacks are becoming increasingly cost-effective and larger-scale, causing ...

  • Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network

    October 31, 2024

    Since August 2023, Microsoft has observed intrusion activity targeting and successfully stealing credentials from multiple Microsoft customers that is enabled by highly evasive password spray attacks. Microsoft has linked the source of these password spray attacks to a network of compromised devices we track as CovertNetwork-1658, also known as xlogin and Quad7 (7777). Microsoft is publishing ...

  • Android malware FakeCall intercepts your calls to the bank

    October 31, 2024

    An Android banking Trojan called FakeCall is capable of hijacking the phone calls you make to your bank. Instead of reaching your bank, your call will be redirected to the cybercriminals. The Trojan accomplishes this by installing itself as the default call handler on the infected device. The default call handler app is responsible for managing ...

  • Peru: Cybercriminals demand 4 million dollars for Interbank customer data

    October 31, 2024

    Organized crime in Peru has taken a worrying turn, extending its activities from attacks on public transport companies and kidnapping businessmen to cybercrime. These criminals use advanced technology to extort money from large companies, including the recent attack on Interbank bank. Reportedly criminals have breached Interbank’s security systems, stealing the database of millions of customers and ...

  • Ireland: Almost 7,000 Government data breaches over last ten years

    October 30, 2024

    There have been 6,885 data breaches across Government departments over the last ten years. More than half of the breaches, 3,637 of them, occurred at the Department of Social Protection. The Department of Justice accounted for 862 of the breaches, with 757 breaches reported at the Department of Foreign Affairs. The majority of the data breaches ...