Critical Alerts: Recent Attacks and Vulnerabilities

This week's security bulletin records threats in critical-level Malware categories, as well as Vulnerabilities that compromise key systems..

From the rise of XenoRAT in the gaming community to the serious data breach at Prudential Financial, the situation demands a quick response and robust security measures. Here are the most relevant details:

XenoRAT, a remote access malware available on GitHub, distributed through .gg domains and GitHub repositories that appear to be tools for Roblox, XenoRAT is used to steal sensitive information from players. In other news, the ransomware group Ransomhouse has attacked Gestores Administrativos Reunidos, encrypting sensitive data and demanding a ransom.

Serious Massive compromise through Polyfill after attack on the supply chain that used the Polyfill[.]io service. with more than 100,000 websites affected. Prudential Financial has reported that a data breach in February 2024 compromised the personal information of more than 2.5 million people. The incident was detected one day after the unauthorized access, affecting administrative, user, employee and contractor data.

Akira ransomware has attacked mining companies Explotmin and Alimac in Peru. This malware is distributed through infected emails and vulnerabilities in VPN terminals, using various techniques to hide its presence and encrypt files, demanding a ransom to not disclose the stolen data.

Among the most important vulnerabilities of the week, the Apache Software Foundation has revealed multiple vulnerabilities in its HTTP server, identified as CVE-2024-36387 to CVE-2024-3957. A vulnerability in the CLI of Cisco NX-OS Software, identified as CVE-2024-20399, could allow an authenticated, local attacker to execute arbitrary commands as root on an affected device.

For more details of the weekly newsletter: Click here