Covers: Detection & ResponseThreat Actors & Nation-StatePhishing & Social EngineeringMalwareVulnerabilities & PatchingSupply Chain & AppSecZero-Days & ExploitsData BreachesPrivacy
Volexity's September 24, 2014 post flagged CVE-2014-6271, a remotely exploitable vulnerability in bash, noting patches were already available for most major Linux distributions at the time the details went public. The post described simple IDS signatures...
Volexity reported in October 2014 that it was tracking an advanced persistent threat operation using strategic web compromises of websites in Hong Kong and Japan, with malicious JavaScript added to legitimate code that served exploits and malicious Java...
A critical SQL injection vulnerability in Drupal 7 was disclosed on October 15, 2014 by Stefan Horst in SA-CORE-2014-005, allowing anonymous users to send specially crafted requests that result in arbitrary SQL execution, privilege escalation, or arbitrary...
Volexity announced on November 4, 2014 that it named Michael Hale Ligh, a lead developer of the Volatility memory forensics software, as its Chief Technology Officer. Ligh joined from Verizon Terremark, where he was Director of Malware Research, and...
Starting late in the afternoon on April 8, 2015, Volexity observed a sharp increase in Shellshock scanning over HTTP, driven by a worm-like script that exploits the User-Agent header and walks a list of cgi-bin paths. Successful hosts download a tarball...
Volexity reported in June 2015 that malicious code had resurfaced on cdn.afghanistan.af, a content delivery network serving Afghan government offices, ministries, and authorities, turning a large portion of those sites into attack surfaces against...
Volexity reported on July 8, 2015 that the APT group Wekby ran a spear phishing campaign with spoofed Adobe emails linking to a page that served a malicious SWF exploiting CVE-2015-5119, a Flash 0-day from the Hacking Team data dump that Adobe had patched...
Volexity announced on September 17, 2015 that Andrew Case joined the company as Director of Research. Case is a core developer of the Volatility memory forensics software and a board member of the Volatility Foundation, and he joins from Verizon Terremark,...
Volexity reported that attackers modified the login pages of Cisco Clientless SSL VPN portals on ASA devices to implant JavaScript that steals employee credentials at login, with its earliest known abuse traced to November 2014 through CVE-2014-3393. The...
Volexity observed five spear-phishing waves launched within six hours of Donald Trump becoming President-Elect on November 9, 2016, targeting U.S. think tanks and NGOs focused on national security, defense, international affairs, and public policy. The...
Volexity reported in March 2017 that organizations worldwide were receiving alerts claiming servers were infected with the Gh0st RAT, and that these alerts were very likely false positives caused by Shodan scanning the Internet to identify Gh0st command...
Volexity found that attackers breached a Georgian media outlet's website and used JavaScript on its Georgian-language index page to target Mac OS X visitors who had not previously visited the site and were not running Google Chrome. Qualifying visitors...
Volexity began tracking a mass digital surveillance and attack campaign in May 2017, tied to the Vietnam-based APT group OceanLotus (APT32), which compromised more than 100 websites - over 80 belonging to Vietnamese individuals and organizations critical...
A patch for a critical Drupal remote code execution vulnerability, CVE-2018-7600, was released on March 28, 2018, and after public exploit code appeared on April 13, 2018, Volexity observed thousands of scan and exploitation attempts against unpatched...
In March and April 2018, Volexity attributed multiple spear phishing campaigns to Patchwork, an Indian APT group also known as Dropping Elephant, which pivoted to targeting US-based think tanks by mimicking the Council on Foreign Relations, CSIS, and...
Volexity announced Surge Collect, a commercially supported memory acquisition tool for Windows, Linux, and macOS, built by a team it began recruiting three years earlier. The company cites a recent empirical study showing most open source or commercial...
Volexity began tracking a financial data theft framework called JS Sniffer in late 2017, which injects JavaScript into compromised e-commerce checkout pages to capture names, addresses, credit card data, and login credentials, base64-encoding them into an...
Volexity announced on August 2, 2018 that it is expanding its research and development operations with a new office in Ellicott City, Maryland, to accommodate continued hiring growth in support of product development. The company, founded in 2013 and based...
The Apache Foundation released a bulletin on August 22, 2018 for CVE-2018-11776, a critical Apache Struts flaw allowing remote code execution through improper validation of namespace input data; a proof-of-concept exploit followed on August 23 and a Python...
Volexity, working with RiskIQ, found malicious JavaScript on Newegg's checkout page at secure.newegg.com that collected billing form data and sent it over SSL/TLS to the attacker-registered domain neweggstats.com. The domain was registered on August 13,...
Volexity observed a suspected Chinese APT group exploiting CVE-2018-15961, an unauthenticated file upload vulnerability in Adobe ColdFusion patched on September 11, 2018, by uploading a China Chopper webshell to a server missing that single update. The...
Volexity tracked a series of phishing campaigns impersonating Microsoft Office 365 password-expiration notices, using sender domains closely structured to mimic Microsoft's and white-colored characters inserted between words to evade keyword flagging....
Volexity reports that at least 11 Uyghur and East Turkistan websites have been compromised and used for surveillance and exploitation, with some continuously attacking visitors for at least four years. The activity includes Scanbox deployment on...
Volexity reported that APT actors began exploiting CVE-2019-11510, an arbitrary file read flaw in Pulse Secure SSL VPNs, roughly a week after researchers detailed it at Black Hat USA on August 7, 2019. Attackers read session databases and files holding...
Microsoft released cumulative updates on February 11, 2020, fixing a remote code execution vulnerability (CVE-2020-0688) in Exchange 2010, 2013, 2016, and 2019, and Volexity began observing APT actors exploiting it in the wild shortly after the Zero Day...
Volexity tracked strategic web compromises beginning in May 2019 in which a Chinese APT it calls Storm Cloud injected obfuscated JavaScript into more than two dozen Tibetan websites to serve fake Adobe Flash update prompts to a limited subset of visitors....
Volexity reports that the Evil Eye threat actor resumed attacks on Uyghur websites in January 2020, using an open-source framework called IRONSQUIRREL to deliver a WebKit exploit against iOS versions 12.3, 12.3.1, and 12.3.2, which installs an implant...
Volexity identified multiple OceanLotus campaigns using fake Vietnamese-language news websites and Facebook pages, some with over 10,000 scraped articles, that profile visitors and deliver malware for Windows, OSX, and Android. On one baomoivietnam.com...
Volexity tied the SolarWinds Orion backdoor campaign that FireEye attributed to UNC2452 to three separate incidents it investigated at a US-based think tank in late 2019 and 2020, tracking the actor as Dark Halo. In the second incident the actor read the...
Volexity published a guide on December 16, 2020, to help organizations determine whether they were compromised in the SolarWinds breach tied to the group it calls Dark Halo, following its earlier post on multiple incident response efforts. The guide says...