RESOURCES

‘Hunters International’ runs a Ransomware-as-a-Service (RaaS) organization, with a focus on exfiltrating data over ransom extortion. ‘Hunters International’ (HI) know that most organizations do not pay ransoms and instead focus...

A backdoor specific to Windows devices has been discovered, delivered via recruitment-themed phishing campaigns. Elastic Security Labs has dubbed the backdoor ‘WARMCOOKIE’ due to data transfer across the HTTP cookie parameter...

MFA Bypass remains a popular and effective technique used in credential access and compromise of user accounts. Cisco Talos reports exploitation of MFA weaknesses involved in roughly 50% of engagements...

MuddyWater, the Iranian cyber espionage group associated with Iran’s Ministry of Intelligence (MOIS) has leaked part of their new backdoor tool, dubbed ‘BugSleep’. This advanced persistent group (APT) is known for...

RansomHub is a threat actor group offering a Ransomware-as-a-Service (RaaS) business model to affiliates for quick entry into, or expansion in, cybercrime. Regardless of the possibility of RansomHub being a re-branded operation...

After Microsoft finally disabled macros by default for files which bear the ‘Mark of the Web’ (MotW) flag, threat actors adapted by changing their initial infection vector. After initially switching to ISO and ZIP files, to MSI and LNK files...

In a constantly evolving digital landscape, adversaries are continuously devising new tactics and techniques to bypass security measures and compromise victim networks. A known documented method threat actors have been observed leveraging is...

Black Basta was at it again with a ransomware attack against Ascension healthcare system in the United States. Check out our latest report for detailed analysis (Tactics, Techniques and Procedures) and mitigation strategies...

Dive into our latest report on QakBot malware for a comprehensive technical analysis. Discover its evolution, attack methods, and effective defense strategies to protect your organization...

Zloader malware is back in action! This in-depth technical analysis unveils its latest attack methods, explores its evolution, and provides crucial detection helping organizations minimize security risks...

Three new exploited vulnerabilities found within Cisco’s ASA and FTD software labeled CVE-2024-20353 (CVSS score 8.6), CVE-2024-20359 (CVSS score 6.0), and CVE-2024-20358 (CVSS score 6.0). CISA strongly recommends affected Cisco customers apply the patches as quickly as their patch policy allows...

The UltraViolet Security Operations Center (SOC) monitors security events and detections 24 hours a day, 7 days a week. During our security operations, we can analyze various stages of Cyber-attacks using ingested logs, tools, threat intelligence and human intelligence...

A recent vulnerability labeled CVE-2024-3094 has been detected within the XZ Utils package. It affected the versions of xz/liblzma 5.6.0 and 5.6.1 before being quickly discovered by the OSS community...

The ‘Loop DoS’ attack generally follows this pattern: a threat actor identifies two DNS resolvers with a configuration which causes the servers to respond to messages with an error message of their own.

ZeroLogon is a Windows Netlogon vulnerability first detected in 2020. CVE-2020-1472 was assigned for this vulnerability. While Microsoft has released appropriate patching for this vulnerability following its discovery with several updates...

A proof-of-concept RCE (Remote Code Execution) exploit was co-discovered by researchers against Fortinet's FortiClient Enterprise Management Server (EMS); FortiClient EMS 7.2 (Versions 7.2.0 through 7.2.2) and FortiClient EMS 7.0 (7.0.1 through 7.0.10)...

RCE flaws found in ScreenConnect came into light recently. Identified vulnerabilities were CVE-2024-1709 and CVE-2024-1708. Exploiting this flaw, attackers could upload malicious files, bypass authentication and potentially gain control user account...

Learn how a sophisticated phishing campaign exploited a leading email service, intricating tactics like hiding malicious links in plain sight, replicating 2FA forms...

Tor Webtunnel, a sophisticated technology designed to mimic encrypted web traffic, to assist users in heavily censored regions, enabling bad actors to hide in plain sight with layered protection...

ThievingFox a collection of post-exploitation tools was developed initially for the purpose of legal and ethical penetration testing, the code and functionality may be altered to allow threat actors to employ ThievingFox for a variety of malicious intentions...

ResumeLooters represent a cybercriminal group, utilize a combination of SQL Injection and Cross-Site Scripting (XSS) attacks to compromise websites. These methods allow them to bypass security measures and access databases containing sensitive user information...

The past 30 days have not been great for Ivanti services. Four vulnerabilities related to Connect Secure have been disclosed throughout the course of the...

As technology progresses, defensive as well as offensive measures for security constantly evolve. Security researchers consistently find new ways to exploit...

LockBit 3.0 is the latest iteration of a longstanding, very effective, ransomware as a service (RaaS) group. This strain of malware operates by...

XWorm, ironically, behaves like a Remote Access Trojan (RAT) and includes multiple defensive measures against inspection by security researchers

Akira Ransomware Threat Actors Observed Targeting Cisco ASA SSL VPNs with Credential Stuffing Attacks

UltraViolet Cyber: Tear down the walls between red and blue teams & address risk exposure when it’s discovered—not weeks later.

Eliminate the risks of separate red and blue-teams by creating continuously optimized cybersecurity for the modern, constant-threat landscape.

Stay ahead of risk with automated penetration testing and remediation.

Simply generating alerts is not enough to thwart your adversaries. For true protection, shift to focusing on outcomes... at machine-speed!

There’s a Better Operator in You! Create Superior Red Team Operations by Outstripping Countermeasures & Cross-Platform Deep Pivoting

How prepared is your organization for a cybersecurity attack, like ransomware?

UVC is dedicated to partnering with our Federal customers to secure our Nations IT Services.

Eliminate the risks of separate red and blue-teams by creating continuously optimized cybersecurity for the modern, constant-threat landscape.