Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-26 20:21Z
2022-06-02
2022-06-02 00:00Z
HIGH

Collecting and operationalizing threat data from the Mozi botnet

Elastic Security Labs·elastic.co

Elastic Security Labs published a comprehensive walkthrough of collecting, analyzing, and operationalizing threat intelligence from the Mozi botnet—an active IoT malware campaign targeting SOHO devices via weak credentials and public exploits. The post demonstrates practical techniques for unpacking UPX-compressed ARM ELF binaries with anti-analysis protections, extracting indicators via static analysis, and enriching ThreatFox data into Elasticsearch for visualization and clustering of C2 infrastructure across 24+ countries.

SRFNetwork ApplianceTACTA0043SWMoziTYPResearchTYPThreat IntelSTGDiscoverySTGReconTECT1598
72
Edit Score
2022-06-02
2022-06-02 00:00Z
HIGH

Ransomware, interrupted: Sodinokibi and the supply chain

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs prevented a targeted Sodinokibi ransomware attack against an MSP customer by detecting and blocking process injection attempts. The attack chain leveraged ScreenConnect remote desktop software (accessed via a compromised upstream MSP) to deploy a Base64-encoded PowerShell script that attempted to download and inject ransomware from Pastebin. All six endpoint compromise attempts were blocked through behavior-based detection of process injection and fileless attack patterns.

SRFApplicationTACTA0005TACTA0001TACTA0002SRFSupply ChainSWScreenconnectSWSodinokibiVNDElastic
72
Edit Score
2022-06-02
2022-06-02 00:00Z
HIGH

Okta and LAPSUS$: What you need to know

Elastic Security Labs·elastic.coin the wild

LAPSUS$ group breached Okta's systems in January 2022, gaining access to administrative and customer tools with ability to reset passwords and MFA tokens for 2.5% of the customer base. The group used social engineering and spear phishing to target Okta, not for direct system compromise but to access Okta customers' accounts. Elastic provides threat hunting guidance and Okta log analysis queries to detect suspicious activity including MFA resets, email updates, privilege grants, and user impersonation.

TACTA0001TACTA0006SRFIdentitySRFCloudVNDOktaTYPThreat IntelTYPNewsSTGInitial Access
72
Edit Score
2022-06-02
2022-06-02 00:00Z
HIGH

Nimbuspwn: Leveraging vulnerabilities to exploit Linux via Privilege Escalation

Elastic Security Labs·elastic.coCVE-2022-29799CVE-2022-29800

Nimbuspwn is a collection of privilege escalation vulnerabilities in networkd-dispatcher affecting Linux systems, comprising directory traversal, symlink race, and TOCTOU race conditions. Microsoft 365 Defender identified the issues and coordinated patches with the upstream maintainer. Elastic Security Labs provides detection rules and remediation guidance for organizations running vulnerable versions.

SRFOsTACTA0004OSLinuxSWNetworkd DispatcherVNDMicrosoftTYPResearchTYPVulnerabilitySTGPrivesc
68
Edit Score
2022-06-01
2022-06-01 20:15Z
HIGH

CVE-2022-30190 — Microsoft Windows_10_1507: A remote code execution vulnerability exists when MSDT is called using the URL protocol

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-30190in the wild

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to CVSSv3.1 7.8 (HIGH) · EPSS 100th percentile

VNDMicrosoftTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
100
Edit Score
2022-06-01
2022-06-01 00:00Z
HIGH

Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 1)

Elastic Security Labs·elastic.co

Elastic Security Labs published a threat hunting guide demonstrating how to detect WMI Event Subscription persistence (T1084) using Elastic Endpoint and SIEM. The post explains the mechanics of WMI abuse, provides EQL queries for hunting malicious subscriptions, and walks through detection workflows including template-based hunts and custom rule creation in Elastic SIEM.

SRFApplicationSRFOsTACTA0003SWElastic SecuritySWElastic EndpointSWElastic SiemVNDElasticTYPResearch
68
Edit Score
2022-06-01
2022-06-01 00:00Z
HIGH

Collecting Cobalt Strike Beacons with the Elastic Stack

Elastic Security Labs·elastic.co

Elastic Security Labs published a technical guide on extracting and analyzing Cobalt Strike beacon payloads from Windows endpoint memory using the Elastic Stack. The article details Fleet policy configuration to collect shellcode and malicious memory regions, then demonstrates extraction and decoding of beacon binaries from compressed telemetry data using CyberChef, with plans for beacon configuration extraction in a follow-up.

SRFApplicationTACTA0007SWCobalt StrikeSWKibanaVNDElasticTYPResearchSTGDiscoverySTGCollection
72
Edit Score
728 × 90 / responsive · programmatic ad slot
2022-06-01
2022-06-01 00:00Z
MED

Practical security engineering: Stateful detection

Elastic Security Labs·elastic.co

Elastic Security Labs presents a detection engineering methodology called 'stateful detection' that formalizes security monitoring across three states: creation (configuration), runtime (execution), and cleanup (covering tracks). Using T1015 (Accessibility Features abuse via Image File Execution Options) as a case study, the post demonstrates how to build EQL detection rules for each state to close detection gaps, particularly for backdoors established weeks or months prior and for attackers who sanitize their presence.

SRFOsTACTA0005TACTA0003OSWindowsTYPResearchSTGDefense EvasionSTGPersistenceTECT1547.008
72
Edit Score
2022-06-01
2022-06-01 00:00Z
HIGH

Embracing offensive tooling: Building detections against Koadic using EQL

Elastic Security Labs·elastic.co

Elastic Security Labs published a comprehensive detection engineering guide demonstrating behavioral analytics against Koadic, an open-source post-exploitation framework used by APT28. The post walks through EQL (Event Query Language) detection strategies across the attack lifecycle—from spearphishing attachment delivery through discovery, UAC bypass, and data exfiltration—with concrete query examples and process tree visualizations.

SRFOsTACTA0004TACTA0001TACTA0002TACTA0007TACTA0003TACTA0009OSWindows
72
Edit Score
2022-05-26
2022-05-26 17:15Z
HIGH

CVE-2022-22576 — Haxx Curl: An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only). CVSSv3.1 8.1 (HIGH) · EPSS 57th percentile

CWECWE 306CWECWE 287VNDNetappVNDHaxxTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2022-05-25
2022-05-25 16:15Z
HIGH

CVE-2022-27305 — Gibbonedu Gibbon: v23 does not generate a new session ID cookie after a user authenticates

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-27305

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation. CVSSv3.1 8.8 (HIGH) · EPSS 59th percentile

CWECWE 384VNDGibboneduVNDGibbonTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-05-23
2022-05-23 18:16Z
HIGH

CVE-2022-28944 — Emcosoftware Msi_package_builder: The impact is: execute arbitrary code (remote).

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-28944

Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. CVSSv3.1 8.8 (HIGH)

CWECWE 494VNDCertainVNDEmcosoftwareTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-05-23
2022-05-23 16:16Z
HIGH

CVE-2022-30014 — Simple_food_website_project Simple_food_website: Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-30014

Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to takeover admin/moderater account. CVSSv3.1 8.8 (HIGH) · EPSS 45th percentile

CWECWE 352VNDSimple Food Website ProjectVNDLumidekTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-05-23
2022-05-23 16:16Z
CRIT

CVE-2022-28932 — Dlink Dsl-g2452dg_firmware: D-Link DSL-G2452DG HW:T1\\tFW:ME_2.00 was discovered to contain insecure permissions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-28932

D-Link DSL-G2452DG HW:T1\\tFW:ME_2.00 was discovered to contain insecure permissions. CVSSv3.1 9.8 (CRITICAL) · EPSS 86th percentile

CWECWE 276VNDDlinkVNDLinkTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-05-16
2022-05-16 14:15Z
CRIT

CVE-2022-29351 — Tiddlywiki Tiddlywiki5: An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-29351

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here. CVSSv3.1 9.8 (CRITICAL) · EPSS 82th percentile

CWECWE 434VNDTiddlywikiTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-05-13
2022-05-13 13:15Z
HIGH

CVE-2020-22983 — Microstrategy Microstrategy_web: A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-22983

A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a server-side request forgery (SSRF) attack via the srcURL parameter to the shortURL task. CVSSv3.1 8.1 (HIGH) · EPSS 81th percentile

CWECWE 918VNDMicrostrategyTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2022-05-13
2022-05-13 08:15Z
HIGH

CVE-2022-25762 — Apache Tomcat: This could result in subsequent connections using the same object concurrently which could result

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-25762

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result i CVSSv3.1 8.6 (HIGH) · EPSS 95th percentile

CWECWE 404VNDApacheVNDOracleTYPVulnerability
8.6
CVSS v3.1
96
Edit Score
2022-05-12
2022-05-12 08:15Z
HIGH

CVE-2022-29885 — Apache Tomcat: While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-29885

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile

CWECWE 400VNDApacheTYPVulnerability
7.5
CVSS v3.1
100
Edit Score
2022-05-10
2022-05-10 21:15Z
MED

CVE-2022-26934 — Microsoft 365_apps: Windows Graphics Component Information Disclosure Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-26934

Windows Graphics Component Information Disclosure Vulnerability CVSSv3.1 6.5 (MEDIUM) · EPSS 95th percentile

VNDMicrosoftTYPVulnerability
6.5
CVSS v3.1
88
Edit Score
2022-05-10
2022-05-10 20:15Z
CRIT

CVE-2022-1505 — Carrcommunications Rsvpmaker: The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1505

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.6. CVSSv3.1 9.8 (CRITICAL) · EPSS 88th percentile

CWECWE 89VNDCarrcommunicationsVNDRsvpmakerTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-05-10
2022-05-10 20:15Z
MED

CVE-2022-1476 — Servmask All-in-one_wp_migration: The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1476

The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploited by administrative users, and users who have access to the site's secret key. CVSSv3.1 6.6 (MEDIUM) · EPSS 97th percentile

CWECWE 22VNDServmaskVNDOneTYPVulnerability
6.6
CVSS v3.1
94
Edit Score
2022-05-10
2022-05-10 20:15Z
CRIT

CVE-2022-1453 — Carrcommunications Rsvpmaker: The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1453

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile

CWECWE 89VNDCarrcommunicationsVNDRsvpmakerTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-05-10
2022-05-10 20:15Z
HIGH

CVE-2022-1442 — Wpmet Metform_elementor_contact_form_builder: The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-1442

The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile

CWECWE 862VNDWpmetVNDMetformTYPVulnerability
7.5
CVSS v3.1
100
Edit Score
2022-05-09
2022-05-09 08:15Z
HIGH

CVE-2022-30333 — Rarlab Unrar: before 6.12 on Linux and UNIX allows directory traversal to write to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-30333in the wild

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected. CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile

CWECWE 22CWECWE 59VNDRarlabTYPVulnerabilitySTAitw exploited
7.5
CVSS v3.1
100
Edit Score
2022-05-04
2022-05-04 20:15Z
CRIT

CVE-2022-29155 — Openldap Openldap: In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-29155

In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile

CWECWE 89VNDOpenldapTYPVulnerability
9.8
CVSS v3.1
100
Edit Score