Threats November 2024

HOT NEWS 2024 NOVEMBER January(137) February(207) March(430) April(317) May(278) June(237) July(216) August(316) September(186) October(24) November(114) December(126) | HOT NEWS 2026 HOT NEWS 2025 HOT NEWS 2024

DATE	NAME	INFO	CATEGORY	SUBCATE
29.11.24	Operation Undercut	"Operation Undercut"Shows Multifaceted Nature of SDA’s Influence Operations	OPERATION	OPERATION
29.11.24	Rockstar 2FA	Trustwave SpiderLabs has been actively monitoring the rise of Phishing-as-a-Service (PaaS) platforms, which are increasingly popular among threat actors.	PHISHING	PHISHING
29.11.24	CVE-2024-50359	A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3),	VULNEREBILITY	CVE
28.11.24	Dozens of Machines Infected	Dozens of Machines Infected: Year-Long NPM Supply Chain Attack Combines Crypto Mining and Data Theft	HACKING	HACKING
28.11.24	Gaming	Gaming Engines: An Undetected Playground for Malware Loaders	MALWARE	LOADER
28.11.24	U.S. Telecom Giant T-Mobile Detects Network Intrusion	An Update on Recent Cyberattacks Targeting the US Wireless Companies	INCIDENT	INCIDENT
28.11.24	CVE-2024-11680	ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability.	VULNEREBILITY	CVE
27.11.24	Bootkitty	Bootkitty: Analyzing the first UEFI bootkit for Linux	MALWARE	BOOTKIT
27.11.24	APT-C-60	Attacks by the attack group APT-C-60 using legitimate services	APT	APT
27.11.24	Matrix	Matrix Unleashes A New Widespread DDoS Campaign	BOTNET	BOTNET
26.11.24	CVE-2024-10542	The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing	VULNEREBILITY	CVE
26.11.24	CVE-2024-10781	The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty value check on the 'api_key'	VULNEREBILITY	CVE
26.11.24	CVE-2024-9680	(CVSS score: 9.8) - A use-after-free vulnerability in Firefox's Animation component (Patched by Mozilla in October 2024)	VULNEREBILITY	CVE
26.11.24	CVE-2024-49039	(CVSS score: 8.8) - A privilege escalation vulnerability in Windows Task Scheduler (Patched by Microsoft in November 2024)	VULNEREBILITY	CVE
26.11.24	RomCom	RomCom exploits Firefox and Windows zero days in the wild	GROUP	GROUP
26.11.24	GHOSTSPIDER	Chinese Hackers Use GHOSTSPIDER Malware to Hack Telecoms Across 12+ Countries	MALWARE	RAT
26.11.24	Game of Emperor	Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions	GROUP	GROUP
26.11.24	CVE-2023-28461	Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution.	VULNEREBILITY	CVE
25.11.24	Supply Chain Attack on OPA Using Malicious Policies	The Dark Side of Domain-Specific Languages: Uncovering New Attack Techniques in OPA and Terraform	ATTACK	ATTACK
25.11.24	GHOSTENGINE	When Guardians Become Predators: How Malware Corrupts the Protectors	MALWARE	ROOTKIT
23.11.24	Sapphire Slee	Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON	GROUP	GROUP
22.11.24	APT-K-47	Unveiling the Past and Present of APT-K-47 Weapon: Asyncshell	APT	APT
22.11.24	TAG-110	Russia-Aligned TAG-110 Targets Asia and Europe with HATVIBE and CHERRYSPY	GROUP	GROUP
22.11.24	TAG-112	China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike	GROUP	GROUP
22.11.24	JarkaStealer	Malicious packages for AI integration containing infostealer malware were found in the Python Package Index repository.	MALWARE	STEALER
22.11.24	CVE-2024-0012	CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)	VULNEREBILITY	CVE
22.11.24	CVE-2024-9474	CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface	VULNEREBILITY	CVE
21.11.24	WolfsBane	Unveiling WolfsBane: Gelsemium’s Linux counterpart to Gelsevirine	MALWARE	LINUX BACK.
21.11.24	Gelsemium	Unveiling WolfsBane: Gelsemium’s Linux counterpart to Gelsevirine	GROUP	GROUP
21.11.24	FrostyGoop/BUSTLEBERM	Attacks on Ukraine’s Energy Infrastructure: Harm to the Civilian Population	MALWARE	MALWARE
21.11.24	CVE-2024-9143	Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes.	VULNEREBILITY	CVE
21.11.24	NodeStealer	Python NodeStealer Targets Facebook Ads Manager with New Techniques	MALWARE	STEALER
20.11.24	Ghost Tap	Ghost Tap: New cash-out tactic with NFC Relay	HACKING	NFC
19.11.24	CVE-2024-48990	Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.	VULNEREBILITY	CVE
19.11.24	CVE-2024-48991	Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own,	VULNEREBILITY	CVE
19.11.24	CVE-2024-48992	Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.	VULNEREBILITY	CVE
19.11.24	CVE-2024-11003	Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands.	VULNEREBILITY	CVE
19.11.24	LIMINAL PANDA	Unveiling LIMINAL PANDA: A Closer Look at China's Cyber Threats to the Telecom Sector	GROUP	GROUP
19.11.24	CVE-2024-44308	(CVSS score: 8.8) - A vulnerability in JavaScriptCore that could lead to arbitrary code execution when processing malicious web content	VULNEREBILITY	CVE
19.11.24	CVE-2024-44309	(CVSS score: 6.1) - A cookie management vulnerability in WebKit that could lead to a cross-site scripting (XSS) attack when processing malicious web content	VULNEREBILITY	CVE
19.11.24	CVE-2024-21287	Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension).	VULNEREBILITY	CVE
19.11.24	NSOCKS	One Sock Fits All: The use and abuse of the NSOCKS botnet	BOTNET	BOTNET
19.11.24	Helldown	Helldown Ransomware: an overview of this emerging threat	RANSOMWARE	RANSOMWARE
19.11.24	CVE-2024-1212	Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.	VULNEREBILITY	CVE
19.11.24	BabbleLoader	Babble Babble Babble Babble Babble Babble BabbleLoader	MALWARE	LOADER
18.11.24	Dolphin	The Abuse of ITarian RMM by Dolphin Loader	MALWARE	LOADER
18.11.24	LodaRAT	LodaRAT: Established Malware, New Victim Patterns	MALWARE	RAT
18.11.24	Mr.Skeleton RAT	Mr.Skeleton RAT - new malware based on the njRAT code	MALWARE	RAT
18.11.24	CVE-2024-10924	The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1.	VULNEREBILITY	CVE
16.11.24	CVE-2024-0012	CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)	VULNEREBILITY	CVE
16.11.24	BrazenBamboo	BrazenBamboo Weaponizes FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA	GROUP	GROUP
16.11.24	DEEPDATA	BrazenBamboo Weaponizes FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA	MALWARE	STEALER
15.11.24	WezRat	Malware Spotlight: A Deep-Dive Analysis of WezRat	MALWARE	RAT
15.11.24	PXA Stealer	New PXA Stealer targets government and education sectors for sensitive information	MALWARE	STEALER
15.11.24	CVE-2024-10979	PostgreSQL PL/Perl environment variable changes execute arbitrary code	VULNEREBILITY	CVE
15.11.24	CVE-2024-9463	(CVSS score: 9.9) - Palo Alto Networks Expedition OS Command Injection Vulnerability	VULNEREBILITY	CVE
15.11.24	CVE-2024-9465	(CVSS score: 9.3) - Palo Alto Networks Expedition SQL Injection Vulnerability	VULNEREBILITY	CVE
14.11.24	Sitting Ducks	DNS Predators Hijack Domains to Supply their Attack Infrastructure	ATTACK	DNS
14.11.24	RustyAttr	Stealthy Attributes of Lazarus APT Group: Evading Detection with Extended Attributes	MALWARE	DOWNLOADER
14.11.24	CVE-2024-43451	CVE-2024-43451: A New Zero-Day Vulnerability Exploited in the wild	VULNEREBILITY	CVE
13.11.24	WIRTE	Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity	GROUP	GROUP
13.11.24	Dream Job	Iranian “Dream Job” Campaign 11.24	CAMPAIGN	CAMPAIGN
13.11.24	CVE-2024-43451	(CVSS score: 6.5) - Windows NTLM Hash Disclosure Spoofing Vulnerability	VULNEREBILITY	CVE
13.11.24	CVE-2024-49039	(CVSS score: 8.8) - Windows Task Scheduler Elevation of Privilege Vulnerability	VULNEREBILITY	CVE
13.11.24	CVE-2023-28649	(CVSS v4 score: 9.2), which allows an attacker to impersonate a hub and hijack a device	VULNEREBILITY	CVE
13.11.24	CVE-2023-31241	(CVSS v4 score: 9.2), which allows an attacker to claim arbitrary unclaimed devices by bypassing the requirement for a serial number	VULNEREBILITY	CVE
13.11.24	CVE-2023-28386	(CVSS v4 score: 9.2), which allows an attacker to upload arbitrary firmware updates resulting in code execution	VULNEREBILITY	CVE
13.11.24	CVE-2024-50381	(CVSS v4 score: 9.1), which allows an attacker to impersonate a hub and unclaim devices arbitrarily and subsequently exploit other flaws to claim it	VULNEREBILITY	CVE
12.11.24	CVE-2024-8068	(CVSS score: 5.1) - Privilege escalation to NetworkService Account access	VULNEREBILITY	CVE
12.11.24	CVE-2024-8069	(CVSS score: 5.1) - Limited remote code execution with the privilege of a NetworkService Account access	VULNEREBILITY	CVE
12.11.24	Flutter	APT Actors Embed Malware within macOS Flutter Applications	MALWARE	MacOS
12.11.24	RustyStealer	Ymir: new stealthy ransomware in the wild	MALWARE	STEALER
11.11.24	Gootloader	Bengal cat lovers in Australia get psspsspss’d in Google-driven Gootloader campaign	MALWARE	LOADER
11.11.24	Machine Learning Bug Bonanza	Machine Learning Bug Bonanza – Exploiting ML Services	AI	EXPLOIT
08.11.24	Androxgh0st	Mozi Resurfaces as Androxgh0st Botnet: Unraveling The Latest Exploitation Wave	BOTNET	BOTNET
08.11.24	ElizaRAT	Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT	MALWARE	RAT
08.11.24	Skuld	Roblox Developers Targeted with npm Packages Infected with Skuld Infostealer and Blank Grabber	MALWARE	STEALER
08.11.24	CRON#TRAP	CRON#TRAP: Emulated Linux Environments as the Latest Tactic in Malware Staging	MALWARE	LINUX
08.11.24	CVE-2024-43093	Android Framework Privilege Escalation Vulnerability	VULNEREBILITY	CVE
08.11.24	CVE-2024-51567	CyberPanel Incorrect Default Permissions Vulnerability	VULNEREBILITY	CVE
08.11.24	CVE-2019-16278	Nostromo nhttpd Directory Traversal Vulnerability	VULNEREBILITY	CVE
08.11.24	CVE-2024-5910	Palo Alto Expedition Missing Authentication Vulnerability	VULNEREBILITY	CVE
08.11.24	BlueNoroff	BlueNoroff Hidden Risk \| Threat Actor Targets Macs with Fake Crypto News and Novel Persistence	MALWARE	CRYPTO
07.11.24	CopyRh(ight)adamantys	CopyRh(ight)adamantys Campaign: Rhadamantys Exploits Intellectual Property Infringement Baits	CAMPAIGN	EXPLOIT
07.11.24	SteelFox	New SteelFox Trojan mimics software activators, stealing sensitive data and mining cryptocurrency	MALWARE	TROJAN
07.11.24	CVE-2024-20418	A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Points could allow an unauthenticated	VULNEREBILITY	CVE
07.11.24	VEILDrive	Unmasking VEILDrive: Threat Actors Exploit Microsoft Services for C2	CAMPAIGN	EXPLOIT
06.11.24	Winos4.0	Threat Campaign Spreads Winos4.0 Through Game Application	MALWARE	TROJAN
06.11.24	ToxicPanda	ToxicPanda: a new banking trojan from Asia hit Europe and LATAM	MALWARE	BANKING
05.11.24	2024-10443	Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720	VULNEREBILITY	CVE
05.11.24	Typosquat	Typosquat Campaign Targeting npm Developers	CAMPAIGN	MALWARE
05.11.24	CVE-2024-43093	In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization.	VULNEREBILITY	CVE
04.11.24	FakeCall	As part of our ongoing mission to identify emerging threats to mobile security, our zLabs team has been actively tracking a new variant of a well-known malware	MALWARE	ANDROID
04.11.24	CVE-2024-39719	(CVSS score: 7.5) - A vulnerability that an attacker can exploit using /api/create an endpoint to determine the existence of a file in the server (Fixed in version 0.1.47)	VULNEREBILITY	CVE
04.11.24	CVE-2024-39720	(CVSS score: 8.2) - An out-of-bounds read vulnerability that could cause the application to crash by means of the /api/create endpoint, resulting in a DoS condition (Fixed in version 0.1.46)	VULNEREBILITY	CVE
04.11.24	CVE-2024-39721	(CVSS score: 7.5) - A vulnerability that causes resource exhaustion and ultimately a DoS when invoking the /api/create endpoint repeatedly when passing the file "/dev/random" as input (Fixed in version 0.1.34)	VULNEREBILITY	CVE
04.11.24	CVE-2024-39722	(CVSS score: 7.5) - A path traversal vulnerability in the api/push endpoint that exposes the files existing on the server and the entire directory structure on which Ollama is deployed (Fixed in version 0.1.46)	VULNEREBILITY	CVE
1.11.24	New variant of FakeCall Android malware	A new variant of the Android malware called FakeCall has been observed in the wild.	ALERTS	VIRUS
1.11.24	Sauron - a new ransomware variant in the wild	Sauron is a new ransomware variant recently found in the wild. The malware appends ".sauron" extension to the encrypted files. The ransom note is dropped in form of a text file called "#HowToRecover.txt" on the affected machines.	ALERTS	RANSOM
1.11.24	UNC5812 campaigns against Ukraine with Android and Windows malware	A recent report highlighted activity attributed to a suspected Russian threat actor identified as UNC5812.	ALERTS	GROUP
1.11.24	A possible Bumblebee Loader resurgence	A new campaign delivering the Bumblebee loader has been reported this month. Bumblebee is a highly sophisticated downloader variant discovered initially back in 2022.	ALERTS	VIRUS
1.11.24	CVE-2024-40711 - Veeam Backup and Replication deserialization vulnerability exploited by ransomware actors	CVE-2024-40711 is a recently disclosed critical (CVSS score 9.8) deserialization vulnerability affecting the Veeam Backup and Replication software in version 12.1.2.172 or older.	ALERTS	VULNEREBILITY
1.11.24	Malicious "Lounge Pass" app targets air travelers in India	A campaign involving a malicious Android app called "Lounge Pass" targeting air travelers at Indian airports has been observed.	ALERTS	VIRUS
1.11.24	Adware Campaign uses Fake CAPTCHA to deliver Lumma and Amadey malware	Threat actors are increasingly using fake CAPTCHA as an initial attack vector.	ALERTS	VIRUS
1.11.24	TeamTNT targets cloud-native environments in new Cryptojacking campaign	A new campaign by the cryptojacking group TeamTNT has been reported targeting cloud-native environments for cryptocurrency mining and reselling compromised servers.	ALERTS	CRYPTOCURRENCY
1.11.24	Rekoobe malware found potentially targeting TradingView users	An open directory has been discovered hosting Rekoobe malware, potentially aimed at targeting TradingView users along with other cyber espionage campaigns.	ALERTS	VIRUS
1.11.24	Daggerfly targets Taiwanese entities with new CloudScout Toolset	China-linked threat actor Daggerfly (also known as Evasive Panda) has been reported targeting a government entity and a religious organization in Taiwan with a previously undocumented post-compromise toolset called CloudScout.	ALERTS	APT
1.11.24	Daggerfly targets Taiwanese entities with new CloudScout Toolset	Researchers have recently uncovered a malicious campaign spreading the XWorm RAT trojan via fake emails posing as official communications from Namirial, a software and service company.	ALERTS	VIRUS
1.11.24	Phishing Campaign Distributing XWorm RAT	Researchers have recently uncovered a malicious campaign spreading the XWorm RAT trojan via fake emails posing as official communications from Namirial, a software and service company.	ALERTS	PHISHING
1.11.24	HeptaX Cyberattack Operations	A researcher recently identified a multi-stage cyberattack targeting the healthcare industry, initiated through a ZIP file containing a malicious shortcut (.lnk) file, likely spread via phishing emails.	ALERTS	OPERATION
1.11.24	Update on the Recall preview feature	Even before making Recall available to customers, we have heard a clear signal that we can make it easier for people to choose to enable Recall on their Copilot+ PC a nd improve privacy and security safeguards.	SECURITY	SECURITY
1.11.24	Xiū Gǒu Phishing Kit	Every Doggo Has Its Day: Unleashing the Xiū Gǒu Phishing Kit	PHISHING	PHISHING KIT
1.11.24	LightSpy	In May 2024, ThreatFabric published a report about LightSpy for macOS. During that investigation, we discovered that the threat actor was using the same server for both macOS and iOS campaigns.	MALWARE	iOS
1.11.24	Rare Case of Privilege Escalation Patched in LiteSpeed Cache Plugin	This blog post is about the LiteSpeed plugin vulnerability. If you’re a LiteSpeed user, please update the plugin to at least version 6.5.2.	VULNEREBILITY	VULNEREBILITY