Cyber Security Informer

Zimbra urges customers to manually fix actively exploited zero-day reported by Google TAG

Security Affairs

JULY 13, 2023

Zimbra has released updates to address a zero-day vulnerability actively exploited in attacks aimed at Zimbra Collaboration Suite (ZCS) email servers. Zimbra urges customers to manually install updates to fix a zero-day vulnerability that is actively exploited in attacks against Zimbra Collaboration Suite (ZCS) email servers.

Hacking

Hacking Backups Cyber threats Authentication

CISA tags Microsoft SharePoint RCE bug as actively exploited

Bleeping Computer

MARCH 27, 2024

CISA warns that attackers are now exploiting a Microsoft SharePoint code injection vulnerability that can be chained with a critical privilege escalation flaw for pre-auth remote code execution attacks. [.]

Google TAG details cyber activity with regard to the invasion of Ukraine

Security Affairs

MARCH 31, 2022

The Google TAG uses uncovered phishing attacks targeting Eastern European and NATO countries, including Ukraine. “ However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence.” In one case observed by the TAG team.

Phishing

Phishing Accountability Government Hacking

Microsoft Defender tags Office updates as ransomware activity

Bleeping Computer

MARCH 16, 2022

Windows admins were hit today by a wave of Microsoft Defender for Endpoint false positives where Office updates were tagged as malicious in alerts pointing to ransomware behavior detected on their systems. [.].

Ransomware

Email Security Flaw Found in the Wild

Schneier on Security

NOVEMBER 21, 2023

TAG has observed four different groups exploiting the same bug to steal email data, user credentials, and authentication tokens. Most of this activity occurred after the initial fix became public on Github.

Authentication

Authentication Government Software

Microsoft fixes two Windows zero-days exploited in malware attacks

Bleeping Computer

APRIL 9, 2024

Microsoft has fixed two actively exploited zero-day vulnerabilities during the April 2024 Patch Tuesday, although the company failed to initially tag them as such. [.]

Malware

Sophos Identifies Potential Tag-Team Ransomware Activity

Dark Reading

AUGUST 22, 2022

Company research indicates ransomware gangs may be working in concert to orchestrate multiple attacks, explains Sophos’ John Shier.

Ransomware

Russia-linked APT TAG-70 targets European government and military mail servers exploiting Roundcube XSS

Security Affairs

FEBRUARY 19, 2024

An APT group, tracked as TAG-70, linked to Belarus and Russia exploited XSS flaws in Roundcube webmail servers to target over 80 organizations. Researchers from Recorded Future’s Insikt Group identified a cyberespionage campaign carried out by an APT group, tracked as TAG-70, linked to Belarus and Russia.

Government

Government Social Engineering Engineering Hacking

Commercial spyware vendors are behind most zero-day exploits discovered by Google TAG

Security Affairs

FEBRUARY 6, 2024

Google’s TAG revealed that Commercial spyware vendors (CSV) were behind most of the zero-day vulnerabilities discovered in 2023. Google’s TAG tracked the activity of around 40 CSVs focusing on the types of software they develop. ” reads the report published by Google. ” concludes Google.

Spyware

Spyware Surveillance Government Software

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Security Affairs

MARCH 28, 2024

Google’s Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively exploited zero-day vulnerabilities in 2023. In 2023, Google (TAG) and Mandiant discovered 29 out of 97 vulnerabilities exploited in the wild. ” reads the report published by Google TAG.

Government

Government Surveillance Cybercrime Ransomware

Attackers use Google Calendar RAT to abuse Calendar service as C2 infrastructure

Security Affairs

NOVEMBER 6, 2023

Google Calendar RAT is a PoC of Command&Control (C2) over Google Calendar Events, it was developed red teaming activities. The abuse of the Google service makes it hard for defenders to uncover malicious activity. ” Google TAG has previously observed threat actors abusing Google services in their operations.

Accountability

Accountability Hacking Information Security Malware

Multiple APT groups exploited WinRAR flaw CVE-2023-38831

Security Affairs

OCTOBER 18, 2023

Google TAG reported that both Russia and China-linked threat actors are weaponizing the a high-severity vulnerability in WinRAR. Google’s Threat Analysis Group (TAG) reported that in recent weeks multiple nation-state actors were spotted exploiting the vulnerability CVE-2023-38831 in WinRAR. ” reported Google TAG.

Cybercrime

Cybercrime Malware Software Hacking

Zero-Day Flaw in Zimbra Email Software Exploited by Four Hacker Groups

The Hacker News

NOVEMBER 16, 2023

Most of this activity occurred after the initial fix became public on GitHub," Google Threat Analysis Group (TAG) said in a report shared with The Hacker News. The flaw, tracked as CVE-2023-37580 (CVSS score:

Software

Software Authentication

Chinese Hackers TAG-74 Targets South Korean Organizations in a Multi-Year Campaign

The Hacker News

SEPTEMBER 26, 2023

Recorded Future's Insikt Group, which is tracking the activity under the moniker TAG-74, said the adversary has been linked to "Chinese military intelligence and poses a significant threat to academic, aerospace and defense, government,

Government

China-linked APT Curious Gorge targeted Russian govt agencies

Security Affairs

MAY 3, 2022

China-linked Curious Gorge APT is targeting Russian government agencies, Google Threat Analysis Group (TAG) warns. Google Threat Analysis Group (TAG) reported that an APT group linked to China’s People’s Liberation Army Strategic Support Force (PLA SSF), tracked as Curious Gorge , is targeting Russian government agencies.

Manufacturing

Manufacturing Government Phishing Passwords

Zero-Day Alert: Google Chrome Under Active Attack, Exploiting New Vulnerability

The Hacker News

NOVEMBER 28, 2023

Google has rolled out security updates to fix seven security issues in its Chrome browser, including a zero-day that has come under active exploitation in the wild. Benoît Sevens and Clément Lecigne of Google's Threat Analysis Group (TAG) have been

North Korea-linked threat actors target cybersecurity experts with a zero-day

Security Affairs

SEPTEMBER 8, 2023

The attacks that took place in the past weeks were detected by researchers at Google’s Threat Analysis Group (TAG). “Recently, TAG became aware of a new campaign likely from the same actors based on similarities with the previous campaign. ” reads the advisory published by Google TAG.

Cybersecurity

Cybersecurity Media Accountability Software

Zimbra fixed actively exploited zero-day CVE-2023-38750 in ZCS

Security Affairs

JULY 27, 2023

Two weeks ago Zimbra urged customers to manually install updates to fix a zero-day vulnerability , now tracked as CVE-2023-38750 , that is actively exploited in attacks against Zimbra Collaboration Suite (ZCS) email servers. Google TAG researchers focus on identifying and countering advanced and persistent threats.

Hacking

Hacking Cyber threats Risk Information Security

Recently patched Apple and Chrome zero-days exploited to infect devices in Egypt with Predator spyware

Security Affairs

SEPTEMBER 22, 2023

Citizen Lab and Google’s TAG revealed that the three recently patched Apple zero-days were used to install Cytrox Predator spyware. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.” Apple fixed the flaw with improved checks.

Spyware

Spyware Surveillance Mobile Hacking

China-Linked Hackers Strike Worldwide: 17 Nations Hit in 3-Year Cyber Campaign

The Hacker News

AUGUST 9, 2023

Cybersecurity firm Recorded Future attributed the intrusion set to a nation-state group it tracks under the name RedHotel (previously Threat Activity Group-22 or TAG-22), which overlaps with a cluster of activity broadly

Cybersecurity

Fines as a Security System

Schneier on Security

FEBRUARY 20, 2023

Tile has an interesting security solution to make its tracking tags harder to use for stalking: The Anti-Theft Mode feature will make the devices invisible to Scan and Secure, the company’s in-app feature that lets you know if any nearby Tiles are following you.

Surveillance

Surveillance Government

Ghostwriter v3.2 Release

Security Boulevard

FEBRUARY 8, 2023

We overhauled how you interact with operation logs and added support for tagging clients, projects, reports, findings, evidence files, domains, servers, operation logs, and log entries. Tagging Tags will help you organize and customize your projects. Tags are comma-separated and appear as grey badges in the interface.

Social Engineering

Social Engineering Technology Engineering Cybersecurity

Critical flaw in Ninja Forms WordPress Plugin actively exploited in the wild

Security Affairs

JUNE 19, 2022

In middle June, the Wordfence Threat Intelligence team noticed a back-ported security update in the popular WordPress plugin Ninja Forms, which has over one million active installations. The researchers believe that this vulnerability is being actively exploited in the wild, it has been rated with a CVSS score of 9.8.

Hacking

Hacking Cybersecurity Information Security

Russian COLDRIVER Hackers Expand Beyond Phishing with Custom Malware

The Hacker News

JANUARY 18, 2024

Google's Threat Analysis Group (TAG), which shared details of the latest activity, said the attack chains leverage PDFs as decoy documents to trigger the infection sequence. The lures are

Malware

Malware Phishing

Cybercriminals launched “Leaksmas” event in the Dark Web exposing massive volumes of leaked PII and compromised data

Security Affairs

DECEMBER 28, 2023

The actual damage resulting from this activity could potentially amount to millions of dollars. Even as the New Year approached and the world celebrated the festive Christmas season, the cybercriminal community did not pause their activities. Over 50 million records containing PII of consumers from around the world have been leaked.

Identity Theft

Identity Theft Data breaches Government Hacking

Microsoft Warns of COLDRIVER's Evolving Evading and Credential-Stealing Tactics

The Hacker News

DECEMBER 7, 2023

The threat actor known as COLDRIVER has continued to engage in credential theft activities against entities that are of strategic interests to Russia while simultaneously improving its detection evasion capabilities. It's also called Blue Callisto, BlueCharlie (or TAG-53),

Google TAG warns of Russia-linked APT groups targeting Ukraine

Security Affairs

APRIL 20, 2023

The researchers from Google TAG are warning of Russia-linked threat actors targeting Ukraine with phishing campaigns. Russia-linked threat actors launched large-volume phishing campaigns against hundreds of users in Ukraine to gather intelligence and aimed at spreading disinformation, states Google’s Threat Analysis Group (TAG).

Phishing

Phishing Education Accountability Telecommunications

Ex-members of the Conti ransomware gang target Ukraine

Security Affairs

SEPTEMBER 8, 2022

Researchers from Google’s Threat Analysis Group (TAG) reported that some former members of the Conti cybercrime group were involved in five different campaigns targeting Ukraine between April and August 2022. The activities overlap with operations attributed to a group tracked by CERT-UA as UAC-0098 [ 1 , 2 , 3 ]. .

Ransomware

Ransomware Cybercrime Government Media

Apple released iOS 17.2 to address a dozen of security flaws

Security Affairs

DECEMBER 12, 2023

Apple rolled out emergency security updates to backport patches for two actively exploited zero-day flaws to older devices. Apple this week rolled out emergency security updates to backport patches for two actively exploited zero-day flaws to older devices. The company released iOS 17.2 and iPadOS 17.2 The company released iOS 16.7.3

Surveillance

Surveillance Hacking Information Security

Google Chrome Hit by Second Zero-Day Attack - Urgent Patch Update Released

The Hacker News

APRIL 19, 2023

Google on Tuesday rolled out emergency fixes to address another actively exploited high-severity zero-day flaw in its Chrome web browser. Clément Lecigne of Google's Threat Analysis Group (TAG) has been credited with discovering and reporting the flaw on April 12, 2023. "

Zero-Day Alert: Google Issues Patch for New Chrome Vulnerability - Update Now!

The Hacker News

JUNE 6, 2023

Google on Monday released security updates to patch a high-severity flaw in its Chrome web browser that it said is being actively exploited in the wild. Clement Lecigne of Google's Threat Analysis Group (TAG) has been credited with reporting the issue on June 1, 2023.

Engineering

Google Takes Down 50,000 Instances of Pro-Chinese DRAGONBRIDGE Influence Operation

The Hacker News

JANUARY 26, 2023

Google on Thursday disclosed it took steps to dismantle over 50,000 instances of activity orchestrated by a pro-Chinese influence operation known as DRAGONBRIDGE in 2022. However, a

Google Releases Urgent Chrome Update to Fix Actively Exploited Zero-Day Vulnerability

The Hacker News

APRIL 14, 2023

Google on Friday released out-of-band updates to resolve an actively exploited zero-day flaw in its Chrome web browser, making it the first such bug to be addressed since the start of the year. Clement Lecigne of Google's Threat Analysis Group (TAG) has been

Engineering

Google TAG: Russia, Belarus-linked APTs targeted Ukraine

Security Affairs

MARCH 8, 2022

Google TAG observed Russian, Belarusian, and Chinese threat actors targeting Ukraine and European government and military orgs. Google TAG observed Russian, Belarusian, and Chinese threat actors targeting Ukrainian and European government and military organizations, as well as individuals. ” concludes the report.

DDOS

DDOS Phishing Government Hacking

Microsoft Defender flags Google Chrome updates as suspicious

Bleeping Computer

APRIL 20, 2022

Microsoft Defender for Endpoint has been tagging Google Chrome updates delivered via Google Update as suspicious activity due to a false positive issue. [.].

Google TAG Warns of Russian Hackers Conducting Phishing Attacks in Ukraine

The Hacker News

APRIL 19, 2023

Google's Threat Analysis Group (TAG), which is monitoring the activities of the actor under the name FROZENLAKE, said the attacks continue the "group's 2022 focus

Phishing

Coldriver threat group targets high-ranking officials to obtain credentials

Malwarebytes

JANUARY 22, 2024

Researchers at Google’s Threat Analysis Group (TAG) have published their findings about a group they have dubbed Coldriver. Their activities are aligned with those of the Russian government, so it’s pretty safe to say that Coldriver is a state-sponsored group. TAG has created a YARA rule that cab help find the Spica backdoor.

Social Engineering

Social Engineering Government Media DNS

Winter Vivern APT exploited zero-day in Roundcube webmail software in recent attacks

Security Affairs

OCTOBER 25, 2023

The Winter Vivern group was first analyzed in 2021, it has been active since at least 2020 and it targets governments in Europe and Central Asia. The analysis of the email HTML source code revealed the presence of a SVG tag at the end, which contains a base64-encoded payload. The messages were sent from team.managment@outlook[.]com

Software

Software Government Phishing Internet

Google Rolls Out New Chrome Browser Update to Patch Yet Another Zero-Day Vulnerability

The Hacker News

DECEMBER 2, 2022

Search giant Google on Friday released an out-of-band security update to fix a new actively exploited zero-day flaw in its Chrome web browser. Clement Lecigne of Google's Threat Analysis Group (TAG) has been credited with reporting the issue on November 29, 2022.

Engineering

Google links three exploitation frameworks to Spanish commercial spyware vendor Variston

Security Affairs

NOVEMBER 30, 2022

Google’s Threat Analysis Group (TAG) linked three exploitation frameworks to a Spanish surveillance spyware vendor named Variston. While tracking the activities of commercial spyware vendors, Threat Analysis Group (TAG) spotted an exploitation framework likely linked Variston IT, a Spanish firm. ” TAG concludes.

Spyware

Spyware Surveillance Risk Internet

Russian Hackers Spotted Targeting U.S. Military Weapons and Hardware Supplier

The Hacker News

DECEMBER 7, 2022

Recorded Future attributed the new infrastructure to a threat activity group it tracks under the name TAG-53, and is broadly known by the cybersecurity community as Blue Callisto, based military weapons and hardware supplier.

Hacking

Hacking Cybersecurity

APT37 used Internet Explorer Zero-Day in a recent campaign

Security Affairs

DECEMBER 8, 2022

North Korea-linked APT37 group (aka ScarCruft , Reaper, and Group123) actively exploited an Internet Explorer zero-day vulnerability, tracked as CVE-2022-41128 , in attacks aimed at South Korean users. ” reads the post published by TAG. Google TAG shared indicators of compromise (IOCs) for this campaign. CVE-2017-0199 ).

Internet

Internet Internet Engineering Malware

Apple fixed the 17th zero-day flaw exploited in attacks

Security Affairs

OCTOBER 4, 2023

Apple released emergency security updates to address a new actively exploited zero-day vulnerability impacting iPhone and iPad devices. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.” “A local attacker may be able to elevate their privileges.

Hacking

Hacking Mobile Information Security

Update now! Apple issues patches for older iPhones and other devices

Malwarebytes

DECEMBER 12, 2023

Apple has issued emergency updates that include patches for older iOS devices concerning the two actively used zero-day vulnerabilities that were patched last week in newer devices. But both vulnerabilities were credited to Clément Lecigne of Google’s Threat Analysis Group (TAG). Updates are available for: Safari 17.2

Spyware

Spyware Risk Cybersecurity

Zimbra urges customers to manually fix actively exploited zero-day reported by Google TAG

CISA tags Microsoft SharePoint RCE bug as actively exploited

Trending Sources

Google TAG details cyber activity with regard to the invasion of Ukraine

Microsoft Defender tags Office updates as ransomware activity

Email Security Flaw Found in the Wild

Microsoft fixes two Windows zero-days exploited in malware attacks

Sophos Identifies Potential Tag-Team Ransomware Activity

Russia-linked APT TAG-70 targets European government and military mail servers exploiting Roundcube XSS

Commercial spyware vendors are behind most zero-day exploits discovered by Google TAG

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Attackers use Google Calendar RAT to abuse Calendar service as C2 infrastructure

Multiple APT groups exploited WinRAR flaw CVE-2023-38831

Zero-Day Flaw in Zimbra Email Software Exploited by Four Hacker Groups

Chinese Hackers TAG-74 Targets South Korean Organizations in a Multi-Year Campaign

China-linked APT Curious Gorge targeted Russian govt agencies

Zero-Day Alert: Google Chrome Under Active Attack, Exploiting New Vulnerability

North Korea-linked threat actors target cybersecurity experts with a zero-day

Zimbra fixed actively exploited zero-day CVE-2023-38750 in ZCS

Recently patched Apple and Chrome zero-days exploited to infect devices in Egypt with Predator spyware

China-Linked Hackers Strike Worldwide: 17 Nations Hit in 3-Year Cyber Campaign

Fines as a Security System

Ghostwriter v3.2 Release

Critical flaw in Ninja Forms WordPress Plugin actively exploited in the wild

Russian COLDRIVER Hackers Expand Beyond Phishing with Custom Malware

Cybercriminals launched “Leaksmas” event in the Dark Web exposing massive volumes of leaked PII and compromised data

Microsoft Warns of COLDRIVER's Evolving Evading and Credential-Stealing Tactics

Google TAG warns of Russia-linked APT groups targeting Ukraine

Ex-members of the Conti ransomware gang target Ukraine

Apple released iOS 17.2 to address a dozen of security flaws

Google Chrome Hit by Second Zero-Day Attack - Urgent Patch Update Released

Zero-Day Alert: Google Issues Patch for New Chrome Vulnerability - Update Now!

Google Takes Down 50,000 Instances of Pro-Chinese DRAGONBRIDGE Influence Operation

Google Releases Urgent Chrome Update to Fix Actively Exploited Zero-Day Vulnerability

Google TAG: Russia, Belarus-linked APTs targeted Ukraine

Microsoft Defender flags Google Chrome updates as suspicious

Google TAG Warns of Russian Hackers Conducting Phishing Attacks in Ukraine

Coldriver threat group targets high-ranking officials to obtain credentials

Winter Vivern APT exploited zero-day in Roundcube webmail software in recent attacks

Google Rolls Out New Chrome Browser Update to Patch Yet Another Zero-Day Vulnerability

Google links three exploitation frameworks to Spanish commercial spyware vendor Variston

Russian Hackers Spotted Targeting U.S. Military Weapons and Hardware Supplier

APT37 used Internet Explorer Zero-Day in a recent campaign

Apple fixed the 17th zero-day flaw exploited in attacks

Update now! Apple issues patches for older iPhones and other devices

Stay Connected