Threat Intelligence Archives

Threat Intelligence

Vulnerable Private Networks: Corporate VPNs Exploited in the Wild

September 11, 2019

Sean Koessel and Steven Adair

The details of multiple, critical Pulse Secure SSL VPN vulnerabilities are well known; they were disclosed in detail by two security researchers as part of a talk at Black Hat […]

Threat Intelligence

Digital Crackdown: Large-Scale Surveillance and Exploitation of Uyghurs

September 2, 2019

Andrew Case, Matthew Meltzer, and Steven Adair

Over the last several years, numerous reports have emerged regarding the shocking treatment of Uyghurs, a Muslim minority ethnic group that makes up a large part of the Xinjiang Uyghur […]

Threat Intelligence

Sophisticated Phishing Campaign Targets Corporate Credentials

June 26, 2019

Volexity Threat Research

Volexity has been tracking a series of phishing campaigns focused on harvesting Microsoft Office 365 account credentials. While many commodity phishing kits are available to purchase containing Office 365 themes, […]

Threat Intelligence

Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)

November 8, 2018

Volexity Threat Research

If your organization is running an Internet-facing version of ColdFusion, you may want to take a close look at your server. Volexity recently observed active exploitation of a newly patched […]

Threat Intelligence

Magecart Strikes Again: Newegg in the Crosshairs

September 19, 2018

Volexity Threat Research

Volexity has conducted the following research in collaboration with RiskIQ. We will discuss the same incident from different perspectives. RiskIQ’s report of this activity can be seen here. In another […]

Threat Intelligence

Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner

August 27, 2018

Matthew Meltzer, Sean Koessel, and Steven Adair

On Wednesday, August 22, 2018, the Apache Foundation released a security bulletin for a critical vulnerability in the Apache Struts framework. This bulletin stated that the vulnerability, assigned CVE-2018-11776, could […]

Threat Intelligence

JS Sniffer: E-commerce Data Theft Made Easy

July 19, 2018

Volexity Threat Research

In late 2017, Volexity began tracking a new e-commerce financial data theft framework named JS Sniffer. The framework gives attackers a quick and efficient way to steal data from compromised […]

Threat Intelligence

Patchwork APT Group Targets US Think Tanks

June 7, 2018

Matthew Meltzer, Sean Koessel, and Steven Adair

In March and April 2018, Volexity identified multiple spear phishing campaigns attributed to Patchwork, an Indian APT group also known as Dropping Elephant. This increase in threat activity was consistent […]

Threat Intelligence

Drupalgeddon 2: Profiting from Mass Exploitation

April 16, 2018

Matthew Meltzer and Steven Adair

On March 28, 2018, a patch for a highly critical vulnerability, which facilitates remote code execution against the Drupal content management system was released. The vulnerability was identified by Jasper […]

Threat Intelligence

OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society

November 6, 2017

Dave Lassalle, Sean Koessel, and Steven Adair

In May 2017, Volexity identified and started tracking a very sophisticated and extremely widespread mass digital surveillance and attack campaign targeting several Asian nations, the ASEAN organization, and hundreds of […]