CISA flags SimpleHelp, Samsung and D-Link flaws as actively exploited
SimpleHelp flaws were previously observed in ransomware attacks, while Samsung and D-Link vulnerabilities were exploited in Mirai-based malware campaigns.
The activity spanned 70 countries and targeted more than 14,000 unique IP addresses.
SimpleHelp flaws were previously observed in ransomware attacks, while Samsung and D-Link vulnerabilities were exploited in Mirai-based malware campaigns.
Attackers use the Kali365 Live phishing-as-a-service (PhaaS) platform to scale operations and automate attacks.
The fast16.sys driver intercepts programs as they are loaded from disk and modifies their code directly in memory.
In brief: CISA flags 9 vulnerabilities as exploited, UAT-4356 targets Cisco devices with the Firestarter backdoor, and more.
The attackers leverage Go-based malware, deploying a modular toolkit that includes injectors, loaders, and multiple backdoors.
Lotuslite acts as a backdoor that communicates with command-and-control servers over HTTPS using dynamic DNS services.