admin

admin

  • Joined: September 10, 2024
  • Articles: 6534

Winter Vivern APT Exploits Zimbra Vulnerability to Target European Government Entities

Mar 31, 2023
Cyber Espionage / APT

The advanced persistent threat (APT) group known as Winter Vivern is currently focusing its cyber espionage efforts on officials in Europe and the U.S. According to a recent report by Proofpoint, this group, also referred to as TA473, has been exploiting an unpatched Zimbra vulnerability in publicly accessible webmail portals since at least February 2023. This vulnerability allows them to access the email accounts of government bodies across Europe.

Proofpoint has identified the group’s activities as closely aligned with the geopolitical objectives of Russia and Belarus. While Winter Vivern may not be the most sophisticated actor, its persistence is notable. Recently, the group has been linked to cyber attacks on state authorities in Ukraine and Poland, as well as government officials in India, Lithuania, Slovakia, and the Vatican. The ongoing wave of intrusions related to NATO involves exploitation of CVE…

Winter Vivern APT Exploits Zimbra Vulnerability to Target European Government Entities March 31, 2023 – A new report from Proofpoint reveals that the advanced persistent threat (APT) group known as Winter Vivern is actively engaged in a cyber espionage campaign…

AI and the Evolving Landscape of Observability

Artificial Intelligence & Machine Learning, Cloud Security, Governance & Risk Management Leonard Bertelli from FPT Discusses the Shift from Reactive Monitoring to Proactive Insights Yamini Kalra • August 29, 2025 Leonard Bertelli, Senior Vice President, Enterprise and AI Solutions, FPT…

Microsoft Resolves 78 Vulnerabilities, Including 5 Actively Exploited Zero-Days; CVSS 10 Flaw Affects Azure DevOps Server

May 14, 2025
Endpoint Security / Vulnerability

Microsoft has released updates addressing 78 security vulnerabilities across its software, including five zero-days currently being exploited in the wild. Among these flaws, 11 are classified as Critical, 66 as Important, and one as Low in severity. The patches include 28 vulnerabilities that enable remote code execution, 21 related to privilege escalation, and 16 classified as information disclosure issues. This release also coincides with fixes for eight security flaws found in the Chromium-based Edge browser since last month’s Patch Tuesday. The details of the actively exploited vulnerabilities are as follows:

  • CVE-2025-30397 (CVSS score: 7.5) – Scripting Engine Memory Corruption Vulnerability
  • CVE-2025-30400 (CVSS score: 7.8) – Microsoft Desktop Window Manager (DWM) Core Library Elevation of Privilege Vulnerability
  • CVE-2025-3270…

Microsoft Addresses 78 Security Flaws, Including Five Active Exploits; Azure DevOps Server Affected On May 14, 2025, Microsoft released critical updates aimed at remedying a total of 78 security vulnerabilities discovered across its software portfolio. Notably, among these vulnerabilities are…

Cryptocurrency Firms Targeted in Advanced 3CX Supply Chain Attack

April 4, 2023
Cryptocurrency / Cyber Attack

A sophisticated supply chain attack on 3CX has led to a second-stage implant specifically targeting a select number of cryptocurrency firms. Kaspersky, a Russian cybersecurity company, has been monitoring this adaptable backdoor, known as Gopuram, since 2020. They noted a surge in infections coinciding with the March 2023 3CX breach. Gopuram’s main purpose is to connect to a command-and-control (C2) server, enabling attackers to interact with the victim’s file system, initiate processes, and execute up to eight in-memory modules. The malware has ties to North Korea, as it has been found on victim machines alongside AppleJeus, another backdoor linked to the Korean-speaking Lazarus group, which previously targeted a cryptocurrency company in Southeast Asia in 2020. This recent focus on cryptocurrency firms underscores a troubling trend.

Cryptocurrency Firms Targeted in Advanced 3CX Supply Chain Attack On April 4, 2023, cybersecurity reports emerged detailing a sophisticated supply chain attack targeting the 3CX communication software, with a specific focus on a select group of cryptocurrency companies. The cyber…

Initial Access Brokers Adapt Strategies, Offering More for Less

April 11, 2025
Cybercrime / Security Breach

Understanding IABs: Initial Access Brokers (IABs) focus on breaching computer systems and networks and then selling that access to other criminals. This specialization allows them to dedicate their efforts to exploiting vulnerabilities, using techniques like social engineering and brute-force attacks. By selling access rather than carrying out ransomware attacks themselves, IABs significantly lower their risks. They leverage their skills in infiltrating networks, simplifying the attack process for their buyers.

This business model not only helps IABs maintain a lower profile and reduce risks but also allows them to profit from their technical expertise. Primarily operating on dark web forums and in underground markets, IABs may work independently or as part of larger operations, such as Ransomware-as-a-Service (RaaS) groups. They serve as a vital component of the cybercrime ecosystem, connecting various players in this illicit landscape.

Initial Access Brokers Adjust Strategies, Offering Increased Access at Reduced Rates April 11, 2025 — Cybercrime / Security Breach Recent developments in the cybercrime landscape reveal a shift in tactics employed by Initial Access Brokers (IABs). These individuals or groups…