Threat Intelligence Archives

Threat Intelligence

Sophisticated Phishing Campaign Targets Corporate Credentials

June 26, 2019

Volexity Threat Research

Volexity has been tracking a series of phishing campaigns focused on harvesting Microsoft Office 365 account credentials. While many commodity phishing kits are available to purchase containing Office 365 themes, […]

Threat Intelligence

Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)

November 8, 2018

Volexity Threat Research

If your organization is running an Internet-facing version of ColdFusion, you may want to take a close look at your server. Volexity recently observed active exploitation of a newly patched […]

Threat Intelligence

Magecart Strikes Again: Newegg in the Crosshairs

September 19, 2018

Volexity Threat Research

Volexity has conducted the following research in collaboration with RiskIQ. We will discuss the same incident from different perspectives. RiskIQ’s report of this activity can be seen here. In another […]

Threat Intelligence

Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner

August 27, 2018

Matthew Meltzer, Sean Koessel, and Steven Adair

On Wednesday, August 22, 2018, the Apache Foundation released a security bulletin for a critical vulnerability in the Apache Struts framework. This bulletin stated that the vulnerability, assigned CVE-2018-11776, could […]

Threat Intelligence

JS Sniffer: E-commerce Data Theft Made Easy

July 19, 2018

Volexity Threat Research

In late 2017, Volexity began tracking a new e-commerce financial data theft framework named JS Sniffer. The framework gives attackers a quick and efficient way to steal data from compromised […]

Threat Intelligence

Patchwork APT Group Targets US Think Tanks

June 7, 2018

Matthew Meltzer, Sean Koessel, and Steven Adair

In March and April 2018, Volexity identified multiple spear phishing campaigns attributed to Patchwork, an Indian APT group also known as Dropping Elephant. This increase in threat activity was consistent […]

Threat Intelligence

Drupalgeddon 2: Profiting from Mass Exploitation

April 16, 2018

Matthew Meltzer and Steven Adair

On March 28, 2018, a patch for a highly critical vulnerability, which facilitates remote code execution against the Drupal content management system was released. The vulnerability was identified by Jasper […]

Threat Intelligence

OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society

November 6, 2017

Dave Lassalle, Sean Koessel, and Steven Adair

In May 2017, Volexity identified and started tracking a very sophisticated and extremely widespread mass digital surveillance and attack campaign targeting several Asian nations, the ASEAN organization, and hundreds of […]

Threat Intelligence

Real News, Fake Flash: Mac OS X Users Targeted

July 24, 2017

Volexity

Volexity recently identified a breach to the website of a well regarded media outlet in the country of Georgia. As part of this breach, the media organization’s website was being […]

Threat Intelligence

Have you been haunted by the Gh0st RAT today?

March 23, 2017

Volexity

If you run certain network monitoring and security appliances, you may have had a few small heart attacks today. Organizations all around the world are receiving alerts that they may […]