Overview Cyble has identified multiple instances of exploitation attempts, malware intrusions, financial fraud, and brute-force attacks. The data is captured in real-time via Cyble's comprehensive network of Honeypot sensors, providing valuable insights into the nature of cyber threats. Cyble's latest Sensor Intelligence report from December 4th to December 10th, 2024, provides in-depth analysis on a range of vulnerabilities, including high-profile malware variants, phishing scams, and CVE (Common Vulnerabilities and Exposures) attempts. Cyble's Global Sensors Intelligence (CGSI) network has ..read more

Overview The Romanian National Cyber Security Directorate (DNSC) has issued a critical advisory urging all entities, especially those in the energy sector, to scan their IT and critical infrastructure for malicious binaries associated with the LYNX ransomware cybercrime group. This recommendation follows a ransomware attack targeting the Electrica Group, Romania’s leading energy provider. DNSC said even organizations unaffected by the attack must act proactively to detect and mitigate potential risks. The Directorate advised using the provided YARA scanning scripts to identify the malicious b ..read more

Overview  The Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Public Safety Communications and Cyber Resiliency Toolkit, adding seven new resources aimed at enhancing the resilience and security of public safety communications across the nation. This update comes as part of CISA’s ongoing effort to support public safety, national security, and emergency preparedness communities in ensuring seamless and secure communications during both everyday operations and emergency situations.  Public safety agencies rely heavily on communication systems to coord ..read more

Executive Summary On December 6, 2024, Cyble Research & Intelligence Labs (CRIL) observed that the hacktivist alliance known as the “Holy League” on their Telegram channel declared cyberattacks against France. According to the alliance, these operations were executed in retaliation to France’s continued support of Ukraine and Israel. Prominent members of the alliance, including the pro-Russian group NoName057(16), the pro-Islamic threat actor Mr. Hamza, and the pro-Palestinian collective Anonymous Guys, amplified the announcement across their platforms. Shortly after, these groups activel ..read more

Overview The Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability, CVE-2024-49138, to its Known Exploited Vulnerabilities (KEV) catalog based on evidence that this flaw is being actively exploited. The vulnerability, identified in the Microsoft Windows Common Log File System (CLFS), is a heap-based buffer overflow issue that has the potential to allow attackers to escalate privileges on vulnerable systems. As part of Microsoft’s Patch Tuesday release, this flaw was patched alongside other critical vulnerabilities. CVE-2024-49138 is a heap-based buffer overflo ..read more

Overview New Zealand’s National Cyber Security Centre (NCSC) has revealed its Cyber Security Insights Report for Q3 2024, offering a detailed overview of the cyber threats impacting New Zealand. The third-quarter report highlights an increase in cyber incidents, providing a deeper understanding of threat actors targeting individuals, businesses, and organizations across the country. According to the NCSC's Cyber Security Insights Report, the number of reported incidents surged to 1,905 in Q3 2024, marking a 58% increase compared to the previous quarter. While this rise might initially seem di ..read more

Key takeaways Cyble Research and Intelligence Labs (CRIL) has identified a campaign associated with the infamous group Head Mare aimed at targeting Russians. This campaign involves a ZIP archive containing both a malicious LNK file and an executable. The executable is cleverly disguised as an archive file to deceive users and facilitate its malicious operations. The LNK file contains commands designed to extract and execute the disguised, which has been identified as PhantomCore. PhantomCore is a backdoor utilized by the hacktivist group Head Mare. It has been active since 2023 and is known ..read more

Overview In response to the growing threat of cyber and financial crimes targeting individuals and organizations, INTERPOL has launched a new campaign called “Think Twice.” The campaign aims to raise awareness about the dangers of increasingly complex online threats, urging people to pause and think before making decisions online. The campaign highlights five key cyber threats: ransomware attacks, malware attacks, phishing, generative AI scams, and romance baiting. With these crimes becoming more advanced and widespread, the campaign serves as a timely reminder of the importance of vigilance ..read more

Overview The TP-Link Archer C50 V4, a popular dual-band wireless router designed for small office and home office (SOHO) networks, has been found to contain multiple security vulnerabilities that could expose users to a range of cyber threats. These TP-Link Archer router vulnerabilities, identified under the CVE-2024-54126 and CVE-2024-54127 identifiers, affect all firmware versions prior to Archer C50(EU)_V4_240917. The Indian Computer Emergency Response Team (CERT-In) flagged these vulnerabilities and the security of TP-Link Archer routers. The vulnerabilities identified in the TP-Link Arch ..read more

Overview The Cyble Research & Intelligence Labs (CRIL) has released its Weekly Vulnerability Insights Report, highlighting a series of critical vulnerabilities reported between November 27, 2024, and December 3, 2024. This week's findings focus on various vulnerabilities that pose risks to organizations, ranging from open-source applications to widely used enterprise software. The analysis includes vulnerabilities that have been actively exploited or are likely to be exploited in the near future, with some already accompanied by proof-of-concept (PoC) exploit code. One of the most notewor ..read more