Threat Source newsletter (Oct. 28, 2021)

Summary: Cisco Talos reported that a malware loader called SQUIRRELWAFFLE is spreading more widely through spam campaigns and is being used to deliver other malware including Qakbot and the penetration-testing tool Cobalt Strike. Talos also reported active exploitation of a path traversal and file disclosure vulnerability in Apache HTTP Server (CVE-2021-41733), introduced in version 2.4.49, whose 2.4.50 fix was insufficient and led to a second vulnerability (CVE-2021-42013) now addressed in version 2.4.51.
Why it matters: SQUIRRELWAFFLE gives attackers an initial foothold that Talos expects to persist across the threat landscape for the foreseeable future, and the Apache flaw is of very low exploitation complexity and poses a critical threat to all users of the software.

Read the original at Cisco Talos ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2021-41733 CVE-2021-42013
Related: Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers Cyber Risks ·
Threat Source newsletter (Oct. 14, 2021) Cyber Risks ·
CVE-2021-42013: Apache HTTP Server Path Traversal Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021