Covers: Detection & ResponseThreat Actors & Nation-StatePhishing & Social EngineeringMalwareVulnerabilities & PatchingSupply Chain & AppSecZero-Days & ExploitsData BreachesPrivacy
Volexity observed active in-the-wild exploitation of Microsoft Exchange vulnerabilities, with SSRF attacks (CVE-2021-26855) later dated to as early as January 3, 2021, used to steal the full contents of user mailboxes without any authentication. The...
On May 25, 2021, Volexity identified a phishing campaign targeting organizations in the United States and Europe, with emails purporting to come from USAID and carrying a link that delivered an ISO file containing a malicious LNK, a malicious DLL, and a...
Volexity found malicious code on the Daily NK website, a South Korean online newspaper covering North Korea, from at least late March 2021 until early June 2021, redirecting visitors to attacker-owned subdomains of jquery[.]services. The attackers used...
Volexity found two malware families on a single system belonging to a frequent target of North Korean actors: BLUELIGHT, loaded via a full Python 2.7 install and a Scheduled Task, and RokRAT, deployed less than 10 minutes later through a parallel...
Volexity identified compromises in 2020 and 2021 tied to a self-named "XE Group," a likely Vietnamese-origin criminal actor that compromises IIS web servers and injects credit card skimming JavaScript, loading it from domains such as object[.]fm and...
Volexity identified a threat actor it tracks as TEMP_Heretic running spear-phishing campaigns against a customer in December 2021 that exploited a zero-day cross-site scripting vulnerability in the Zimbra email platform, later assigned CVE-2022-24682 and...
Volexity found an intrusion in late 2021 on a MacBook Pro running macOS 11.6 (Big Sur), traced through a system running frp (fast reverse proxy) and subsequent internal port scanning, and recovered a macOS variant of a malware implant it calls GIMMICK from...
Over the 2022 U.S. Memorial Day weekend, Volexity investigated two internet-facing Atlassian Confluence Server systems where JSP webshells had been written to disk, and traced the compromise to a zero-day that allowed unauthenticated remote code execution,...
Volexity detected anomalous activity from a customer's Sophos Firewall on March 8, 2022, and forensic analysis found a backdoor and evidence of exploitation dating to March 5, 2022. The attacker modified the legitimate SessionCheckFilter.class file to...
Volexity tracks a North Korea-linked actor it calls SharpTongue, publicly known as Kimsuky, which since September 2021 has deployed a malicious Chrome and Edge extension named SHARPEXT that reads and exfiltrates webmail directly from a victim's logged-in...
Volexity investigated breaches of Zimbra Collaboration Suite email servers in July and early August 2022 and found the likely cause was CVE-2022-27925, an RCE patched in March 2022 in 8.8.15P31 and 9.0.0P24. Volexity determined the mboximport endpoint...
Volexity observed a North Korean Lazarus Group campaign targeting cryptocurrency users with AppleJeus malware, including a June 2022 domain bloxholder[.]com that cloned the legitimate HaasOnline trading site and an MSI installer bundling the open-source...
Volexity analyzed a tool called AVBurner, attributed to the Chinese APT it tracks as SnakeCharmer (Trend Micro's "Earth Longzhi"), which patches process-creation callbacks in kernel memory so EDR and AV software keeps running but is rendered useless. The...
On March 29, 2023, Volexity reported that endpoints running the 3CX Desktop application received a malicious update signed by 3CX and downloaded from its own servers through the default automatic update process, installing information-stealing malware...
Volexity reported on June 28, 2023 that Charming Kitten, an Iran-linked threat actor, used a multi-day spear-phishing exchange impersonating an Israeli media reporter to deliver a password-protected RAR file containing a malicious LNK that installed an...
Volexity attributes long-running, currently active mobile spyware campaigns to a threat actor it tracks as EvilBamboo (formerly Evil Eye), operating in the interest of the Chinese state and targeting Tibetan, Uyghur, and Taiwanese individuals and...
Volexity uncovered in-the-wild exploitation of two chained zero-day vulnerabilities enabling unauthenticated remote code execution on Ivanti Connect Secure VPN appliances, with suspect activity traced back to as early as December 3, 2023. The attacker,...
Volexity reported that attackers tracked as UTA0178 exploited two zero-day vulnerabilities, CVE-2024-21887 and CVE-2023-46805, in Ivanti Connect Secure VPN appliances, with widespread exploitation beginning January 11, 2024. Scanning roughly 30,000 ICS IP...
Volexity reported that after proof-of-concept exploit code for Ivanti Connect Secure VPN vulnerabilities CVE-2024-21887 and CVE-2023-46805 became public on January 16, 2024, it observed an increase in attacks from various threat actors, including criminal...
Volexity used memory forensics to confirm in-the-wild exploitation of two chained zero-day vulnerabilities in Ivanti Connect Secure VPN, decoding base64 POST payloads found in the heap of the uwsgi web server process (PID 2952) to recover the exploit path...
Volexity reports that the Iranian-origin threat actor CharmingCypress (aka Charming Kitten, APT42, TA453) ran spear-phishing campaigns through 2023 and into early 2024, including a fake webinar platform that required targets to install malware-laden VPN...
On April 10, 2024, Volexity identified zero-day exploitation of CVE-2024-3400, an unauthenticated OS command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect with a CVSS base score of 10.0, and observed identical exploitation at a second...
Volexity reported in-the-wild zero-day exploitation of CVE-2024-3400 in Palo Alto Networks PAN-OS GlobalProtect by a threat actor it tracks as UTA0218, which it assesses with moderate confidence is China-based. Palo Alto Networks released an advisory and...
Volexity identified a 2024 cyber-espionage campaign by a suspected Pakistan-based threat actor it tracks as UTA0137, using Golang Linux malware it calls DISGOMOJI against Indian government entities. DISGOMOJI is a fork of the open-source discord-c2 project...
Volexity investigated mid-2023 incidents in which StormBamboo (aka Evasive Panda) poisoned DNS responses at an ISP level to redirect automatic software update requests, delivering malware including MACMA and POCOSTICK to macOS and Windows systems. The...
Volexity identified exploitation of a zero-day credential disclosure vulnerability in Fortinet's Windows VPN client that let the DEEPDATA malware extract usernames, passwords, remote gateways, and ports from the client process memory, working against the...
Volexity traced a February 2022 breach of a customer's enterprise Wi-Fi network to GruesomeLarch, a Russian APT also known as APT28 and Fancy Bear, which was targeting data on individuals and projects involving Ukraine. The actor validated credentials...
Volexity describes its incident response services as running many actions in parallel, using existing data sources to collect evidence quickly and combining that with threat intelligence to determine whether an incident occurred and the scope of a breach....
Volexity describes its Network Security Monitoring service and Network Security Sensor, which combine open source and proprietary data and signatures to surface often-unnoticed traffic events. In one cited case, a leading technology company learned from...
Volexity describes proactive threat assessments as hunting for signs of suspicious activity across a client's infrastructure using its investigative experience and threat intelligence sources, rather than a checkbox-style audit. In one case, a large...