GreyKeep Security
Expert security for an evolving digital age
This is the GreyKeep Security Malware Roundup for August 11, 2023. Here’s a summary of what’s in this week’s edition:
Organizations
| Microsoft Apple Intel Salesforce Citrix | Barracuda CloudFlare TETRA CODESYS Zyxel |
Targets
| Intel AMD Linux MacOS Windows Windows Defender Microsoft 365 | .NET Visual Studio Power Platform Kubernetes Redis Rust PaperCut |
Your daily dose of relevant cybersecurity advisories, industry news, and product updates for Wednesday, August 9, 2023.
Security researchers at Mitiga have discovered a technique for using AWS Systems Manager (SSM) Agent as a remote access trojan (RAT). The technique allows for persistent command and control of a compromised host by an attacker from within another AWS account.
SSM Agent is software that allows administrators to configure, manage, and update AWS resources through the Systems Manager service. It can be installed on a various systems, including Amazon Elastic Compute Cloud (EC2) instances, edge devices, on-premises servers, and virtual machines.
[Read more…] about Security Researchers Repurpose Amazon SSM Agent as a Remote Access TrojanYour dose of relevant cybersecurity advisories, industry news, and product updates for Thursday, August 3, 2023.
Attackers are actively exploiting a code injection vulnerability in Citrix Netscaler ADC and Gateway servers to gain remote access and exfiltrate data. The remote code execution (RCE) vulnerability is being tracked under CVE-2023-3519.
Security researchers from the non-profit Shadowserver Foundation estimate attackers have used the vulnerability to deploy web shells on at least 640 Citrix servers, with thousands of unpatched servers potentially impacted.
[Read more…] about Over 640 Citrix Servers Compromised Using RCE Vulnerability