The Threat CodexNov 25, 2024
Unveiling the Past and Present of APT-K-47 Weapon: Asyncshell
#APT_K_47 #Asyncshell #CVE_2023–38831
https://medium.com/@knownsec404team/unveiling-the-past-and-present-of-apt-k-47-weapon-asyncshell-5a98f75c2d68
Unveiling the Past and Present of APT-K-47 Weapon: Asyncshell

Author：Knownsec 404 Advanced Threat Intelligence team date：November 22, 2024 中文版：https://paper.seebug.org/3240 Recently, in the course of daily APT tracking,the Knownsec 404 Advanced Threat…

Medium
The Threat CodexNov 25, 2024
Infrastructure Analysis: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023–4966 Citrix Bleed Vulnerability
#CVE_2023–4966 #LockBit #ShadowSyndicate
https://osintteam.blog/infrastructure-analysis-lockbit-3-0-799a4ff1ca59
Infrastructure Analysis: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023–4966 Citrix Bleed Vulnerability

In this blog post, we’re going to take a look at the recent IOCs provided by Boeing in the joint CISA/FBI/ACSC report. LockBit 3.0 affiliates are exploiting CVE-2023–4966, known as Citrix Bleed, in…

OSINT Team
Caitlin CondonSep 22, 2023
As @iagox86 has pointed out for weeks now, the #Juniper RCE headlines on #CVE_2023-36844 and #CVE_2023_36845 consistently miss a pretty important point: All the known exploits land you in a restrictive BSD jail with no meaningful OS access. Rapid7 details one method for breakout in our analysis from early September, but oddly, nobody else seems to be acknowledging the caveat to exploitation (at least with known PoCs): https://attackerkb.com/topics/1PKX0CCXkX/cve-2023-36844/rapid7-analysis
rbowes-r7's assessment of CVE-2023-36844 | AttackerKB

The work done by watchTowr and later VulnCheck is super cool, and outlines different great ways to exploit the vulnerability (we based the Rapid7 Analysis on w…

AttackerKB
Caitlin CondonApr 3, 2023
Pew pew, full #Adobe #ColdFusion #RCE exploit chain and analysis for #CVE_2023-26359 and #CVE-2023-26360 via @stephenfewer https://attackerkb.com/topics/1iRdvtUgtW/cve-2023-26359/rapid7-analysis
CVE-2023-26359 | AttackerKB

Update #1 - April 3, 2023: Updated analysis to include arbitrary file read as well as unauthenticated remote code execution. Added context around the CVE-2023-…

AttackerKB