RedSun — New Windows Defender 0-day Actively Exploited
Top 5 Most Frequently Detected Network Vulnerabilities Among Our Clients
During deployments of Ikare, our vulnerability scanner, certain network vulnerabilities consistently resurface, regardless of the industry or scale of the analyzed environments. This article highlights the five most common types of vulnerabilities identified across our client base, supported by representative metrics: over 70,000 detected vulnerabilities and more than 50,000 scanned IP addresses. 1. Obsolete Encryption: SSL and Deprecated TLS Versions. The use of legacy cryptographic protocols or cipher suites, such as TLS 1.0 or SSLv3, remains widespread. These technologies no longer meet modern security standards [...]
Top 10 Attackers' Favorite Cyber Vulnerabilities in 2023
VSEs, SMEs, large corporations, public organizations... every organization will inevitably face cyber attacks at some point. Between 2022 and 2023, our security audits revealed that organizations of all sizes presented critical risks. Even more concerning, our configuration audits show that 100% of organizations exhibit critical risks that could often be mitigated through straightforward measures. The attack suffered by the Brest University Hospital—crippled for several days following the compromise of a healthcare worker's credentials leaked online—clearly illustrates the devastating impact of such vulnerabilities. Relying on our [...]
🚨 SOC Alert – Zero-Day Vulnerability Exploiting CVE-2024-21410
Discovery of a vulnerability exploiting CVE-2024-21410. A critical Microsoft Exchange security vulnerability was identified on February 13, 2024. Rated with a CVSS score of 9.8, it enables an NTLM Relay attack. An attacker exploiting this vulnerability could authenticate in place of a legitimate user using information transmitted across the network (Net NTLMv2 Hash). Affected products: The vulnerability was identified by Microsoft teams and impacts all versions of Microsoft Exchange. Remediation: Apply the latest Microsoft Exchange security update available on the Microsoft website: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410 [...]
🚨 SOC Alert – Citrix NetScaler Zero-Day Vulnerability – CVE-2023-4966
Discovery of a vulnerability exploiting CVE-2023-4966. A critical security flaw within the Citrix environment was disclosed on October 10, 2023, affecting NetScaler ADC and NetScaler Gateway. An update was released on November 20 to provide further technical details. This vulnerability allows an attacker to exploit Citrix NetScaler ADC and NetScaler Gateway appliances configured as a Gateway, VPN virtual server, ICA Proxy, CVPN, RDP Proxy, or AAA virtual server. This vulnerability is tracked as CVE-2023-4966. The LockBit ransomware group is actively targeting vulnerable appliances. Affected products: NetScaler ADC and NetScaler Gateway versions [...]
🚨 SOC Alert – Zero-Day vulnerability in the Web UI on Cisco IOS XE devices
A critical security vulnerability within the Cisco IOS XE environment was identified on October 16, 2023, affecting the Web UI protocol. What is it? This vulnerability allows an unauthenticated remote attacker to create an account on the target system. This account receives privilege level 15 access, granting complete control over the compromised device. The attacker can then leverage this account to take full control of the affected system. The vulnerability has been publicly acknowledged by Cisco and is assigned CVE-2023-20198. Affected products: Devices running Cisco IOS XE if the feature [...]
🚨 SOC Alert – HTTP/2 Protocol Zero-Day Vulnerability
A flaw has been identified in the handling of multiplexed streams within the HTTP/2 protocol. What is it? The HTTP/2 protocol enables Denial-of-Service (DoS) attacks because request cancellations can rapidly reset numerous connections, as observed in real-world exploitation. The CVSS score for this vulnerability is 7.5. Known as HTTP/2 Rapid Reset, this attack vector exploits a specific capability of HTTP/2: multiplexing concurrent requests over a single TCP connection. Threat actors initiate multiple HTTP/2 connections wherein they transmit requests immediately followed [...]
🚨 SOC Alert – Zero-day vulnerability in EXIM software
Apply security patches immediately! Vulnerabilities have been identified in the EXIM mail transfer agent software. Affected versions are those prior to 4.96.1 and 4.97. What is it? EXIM MTA is an open-source email server utilized across UNIX-based environments. In EXIM versions prior to 4.96.1 and 4.97, multiple vulnerabilities have been disclosed. Improper validation of user-supplied inputs allows an attacker to perform various malicious actions, notably memory corruptions to exfiltrate confidential data. For flaws where the vendor provides a [...]
SOC LEVEL 1 ALERT
Orange Cyberdefense hit by a cyberattack No rest for cybercriminals! Following TikTok and WeChat, this week Orange Cyberdefense was targeted. The cybersecurity arm of the telecom giant suffered the theft of personal data belonging to over 1,500 clients. The threat actor reportedly published a list on the dark web containing names, phone numbers, email addresses, and company names. This list appears to exclusively affect customers subscribed to the "Micro-SOC Endpoint" service. Affected entities include municipal offices, healthcare facilities, media outlets, and more. While the attackers have not officially stated their motives, the data breach [...]
🚨 SOC Alert – Zero-Day Vulnerability in Atlassian Confluence
Apply patches immediately! A critical zero-day security flaw was discovered on June 2 in Atlassian Confluence. It affects all supported versions of Confluence Server and Data Center, as well as all versions subsequent to 1.3.0. Known as CVE-2022-26134, this flaw allows an unauthenticated attacker to trigger remote arbitrary code execution. What is this about? Security researchers have observed that threat actors are exploiting this vulnerability to install the Chopper webshell and other malware. This prompted the Agency for [...]