Threat Source Newsletter (Jan. 20, 2022)
Summary: Cisco Talos reported a campaign discovered in October 2021 delivering Nanocore, Netwire and AsyncRAT variants, with victims primarily in the United States, Italy and Singapore, using multi-stage obfuscation in the downloader script. The newsletter also cited CVE-2021-42392, a remote code execution flaw in the H2 open-source Java SQL database tied to JNDI remote class loading, similar to Log4Shell but considered harder to exploit.
Why it matters: The H2 flaw gives attackers a Log4Shell-style path into a database framework widely used in web and internet-of-things platforms, and the RAT campaign shows actors misusing Azure and AWS to distribute malware across three countries.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Mentions
- CVE-2021-42392
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026