ISC StormCast for Monday, January 29th, 2024 | Daily 5 min cyber security news summary. News, patches, vulnerabilities and trends in information and network security. Batch Comments; .box TLD abuse; Jenkins CVE-2024-23897 PoC; Malicious Chinese Google AdsA Batch File With Multiple Payloads https://isc.sans.edu/diary/A%20Batch%20File%20With%20Multiple%20Payloads/30592 fritz.box domain used to advertise NFTs https://www.heise.de/news/Verwirrend-Internet-Domain-fritz-box-zeigt-NFT-Galerie-statt-Router-Verwaltung-9610149.html Jenkins CVE-2024-23897 PoC https://github.com/gquere/pwn_jenkins/blob/master/README.md#jenkins-cli-arbitrary-read-cve-2024-23897-applies-to-versions-below-2442-and-lts-24263 Malicious Google Ads Target

Weekly Intelligence Report – 05 March 2026 - cyfirma | News Content: Published On : 2026-03-05 Ransomware of the week CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – that could be relevant to your organization. Type: Ransomware Target Technologies: Windows Target Industries: Real Estate and Retail Target Countries: Mexico, Egypt Introduction CYFIRMA Research and Advisory Team has observed Payload Ransomware while monitoring various underground forums as part of our Threat Discovery Process. Payload Ransomware Payload is a file-encrypting ransomware that appends

Potentielle Remote Code Execution in Jenkins - Patch verfügbar | Mit der neuesten Version der CI/CD-Plattform Jenkins haben die Entwickler:innen neun Sicherheitslücken behoben - darunter befindet sich auch eine kritische Schwachstelle, CVE-2024-23897. Dabei handelt es sich um ein Problem mit dem integrierten Kommandozeilen-Interface:   Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has

New GNU/Linux Rootkit LinkPro Discovered in AWS Infrastructure | An investigation into a compromised AWS-hosted infrastructure revealed a new GNU/Linux rootkit called LinkPro. The attackers exploited a vulnerable Jenkins server (CVE-2024-23897) to deploy a malicious Docker image on Kubernetes clusters. The rootkit, written in Golang, features eBPF modules for concealment and remote activation, allowing attackers to gain persistence and execute commands. The sophisticated malware supports multiple communication protocols and uses a 'magic packet' for activation. The threat actors are suspected to be financially motivated. Sources<

LinkPro Rootkit Attacking GNU/Linux Systems Using eBPF Module to Hide Malicious Activities | A sophisticated rootkit targeting GNU/Linux systems has emerged, leveraging advanced eBPF (extended Berkeley Packet Filter) technology to conceal malicious activities and evade traditional monitoring tools. The threat, known as LinkPro, was discovered during a digital forensic investigation of a compromised AWS-hosted infrastructure, where it functioned as a stealthy backdoor with capabilities ranging from process hiding [&#8230;] The post LinkPro Rootkit Attacking GNU/Linux Systems Using eBPF Module to Hide Malicious Activities<

LinkPro: An eBPF-Based Rootkit Hiding Malicious Activity on GNU/Linux | Security researchers from Synacktiv CSIRT have uncovered a sophisticated Linux rootkit dubbed LinkPro that leverages eBPF (extended Berkeley Packet Filter) technology to establish persistent backdoor access while remaining virtually invisible to traditional monitoring tools. The infection chain originated from a vulnerable Jenkins server exposed to the internet, exploited through CVE-2024-23897. Threat actors leveraged this initial [&#8230;] The post LinkPro: An eBPF-Based Rootkit Hiding Malicious Activity on GNU/Linux appeared

GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs - GreyNoise | News Content: Key Takeaways GreyNoise has detected active exploitation of 23 of the 62 CVEs mentioned in Black Basta’s leaked chat logs, including vulnerabilities affecting enterprise software, security appliances, and widely used web applications. CVE-2023-6875 is being exploited despite not being listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, reinforcing the need for real-time intelligence beyond static lists. Some of these CVEs have been actively exploited in just the past 24 hours, including critical flaws in Palo Alto PAN-OS, JetBrains TeamCity, Microsoft