New STRRAT RAT Phishing Campaign
FortiGuard Labs discovered a phishing email used to deliver a variant of the STRRAT malware as an attachment. This blog deconstructs the phishing email and its malicious payload.
Fortinet
COVID Omicron Variant Lure Used to Distribute RedLine Stealer
Threat actors continue to maximize pandemic related social engineering lures. Read about a COVID Omicron variant related lure FortiGuard Labs discovered used to distribute RedLine Stealer malware.
From User to Domain Admin in (less than) 60 seconds: CVE-2021-42278/CVE-2021-42287
FortiGuard Labs analyzes vulnerabilities in Microsoft Active-Directory (CVE-2021-42278 and CVE-2021-42287). Analysis shows that by combining them, it is possible for a regular user to easily impersonate a domain admin. Learn more about the exploitation of these vulnerabilities.
Critical Apache Log4j Vulnerability Updates
FortiGuard Labs provides important updates about the Apache Log4j vulnerabilities, including details, campaigns associated with Log4j, and an alleged “wormable” Mirai malware variant. Read to learn more.
Critical Apache Log4j (Log4Shell) Vulnerability Updates: What You Need to Know
FortiGuard Labs provides important updates about the Apache Log4j vulnerabilities, including details, campaigns associated with Log4j, and an alleged “wormable” Mirai malware variant. Read to learn more.
Phishing Campaign Targeting Korean to Deliver Agent Tesla New Variant
A phishing campaign was recently caught in the wild by Fortinet’s FortiGuard Labs, that delivers a malicious Microsoft PowerPoint file. Learn more.
MANGA aka Dark Mirai-based Campaign Targets New TP-Link Router RCE Vulnerability
FortiGuard Labs encountered a malware sample that’s currently being distributed in the wild targeting TP-link wireless routers. Learn more on MANGA aka Dark Mirai-based Campaign.
Mirai-based Botnet – Moobot Targets Hikvision Vulnerability
FortiGuard Labs analyzes how an attacker can leverage CVE-2021-36260 to create targets for Moobot which is a DDoS botnet based on Mirai. In this blog we explain how an attacker delivers this payload along with details of the botnet.