Storm Watch | Cyber News | ALPHV/BlackCat: BUSTED!?, Lazarus' Log4j Larks, Stopping Cloud Attackers Cold With The "AWS Kill Switch"

Summary: GreyNoise's Storm Watch episode discusses the rumored takedown of the ALPHV/BlackCat ransomware site, which has been offline for days amid speculation that law enforcement may have caught up with the group. The episode also covers the North Korea-linked Lazarus Group's exploitation of the two-year-old Log4j vulnerability in a global campaign targeting manufacturing, agriculture, and physical security companies, and profiles the AWS Kill Switch, an open-source tool for locking down AWS accounts and IAM roles during an incident.
Why it matters: Lazarus is still exploiting Log4j two years on to reach manufacturers, agriculture firms, and physical security providers, and the ALPHV/BlackCat site going dark is only a rumor until law enforcement confirms it.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-47246
Related: CVE-2023-47246: Sys Aid Server Path Traversal Vulnerability Known Exploited Vulnerabilities · Nov 13, 2023
Using Grey Noise EAP Sensors For Novel Exploitation Discovery For CVE-2023-47246 | Grey Noise Blog Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026