Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
7-Zip patched a high-severity vulnerability (CVE-2025-0411) that allowed attackers to bypass Windows Mark of the Web (MotW) security warnings, enabling code execution by improperly handling nested archives. Users must update to version 24.09 to mitigate this risk, as many may still use vulnerable versions without auto-update.
Extreme TLDR: Murdoc Botnet, a new Mirai variant, exploits AVTECH Cameras and Huawei HG532 routers, utilizing ELF files and shell scripts for deployment. Launched in July 2024, it features over 1300 active IPs and 100+ command-and-control servers. Affected primarily are Malaysia, Thailand, Mexico, and Indonesia. Recommendations include monitoring for suspicious activities and keeping systems updated.
Rsync has six vulnerabilities (CVE-2024-12084 to CVE-2024-12747) affecting versions 3.3.0 and earlier, enabling heap-buffer overflow, information leak, file leak, directory write bypass, and privilege escalation. These flaws pose risks like arbitrary code execution, file access, and data extraction. Users should apply patches promptly.
CVE-2024-44243, found by Microsoft Threat Intelligence, is a serious macOS vulnerability that allows attackers to bypass System Integrity Protection (SIP) by loading unauthorized kernel extensions. This compromise could lead to the installation of rootkits and other malicious activities by enhancing the attack surface. Microsoft collaborated with Apple for a fix included in December 2024 security updates. The importance of monitoring specially entitled processes is emphasized due to their potential in bypassing security measures. The research underlines the necessity of proactive monitoring and cooperative efforts in enhancing cybersecurity across platforms.
