article thumbnail

Researchers disclose critical sandbox escape bug in vm2 sandbox library

Security Affairs

.” Wi also published two proof-of-concept (PoC) exploits for this vulnerability that can be used to escape the sandbox to create an empty file named “flag” on the host. In October 2022, VM2 maintainers addressed another critical sandbox escape vulnerability tracked as CVE-2022-36067.

article thumbnail

Hackers are actively exploiting a flaw in the Elementor Pro WordPress plugin

Security Affairs

The experts are also seeing files being uploaded with the following file names: wp-resortpack.zip wp-rate.php lll.zip The researchers also reported that the attackers are changing site URL to away[dot]trackersline[dot]com. 193.169.195.64 194.135.30.6 or later ( the latest available is 3.12.0 ) immediately.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

New Linux Ransomware BlackSuit is similar to Royal ransomware

Security Affairs

According to government experts, the Royal ransomware attacks targeted numerous critical infrastructure sectors including, manufacturing, communications, healthcare and public healthcare (HPH), and education. ReadMe file name: README.BlackSuit.txt. New #ransomware #BlackSuit targets Windows, #Linux. Extension: blacksuit.

article thumbnail

Vice Society ransomware gang is using a custom locker

Security Affairs

This group focuses on public school districts and other educational institutions, like other ransomware gangs it implements a double extortion model and publishes data stolen from the victims on a data leak site. The malware dropped ransom notes with the file name “AllYFilesAE” in each encrypted directory.

article thumbnail

Iran-linked MERCURY APT behind destructive attacks on hybrid environments

Security Affairs

The ransomware employed in the attacks changes the file name extension to DARKBIT and drop ransom notes. Once bypassed the security defenses, the attackers deployed the ransomware payload in the NETLOGON shares on several domain controllers. Then the attackers maintain persistence by registering a scheduled task using GPO.

article thumbnail

ToxicEye RAT exploits Telegram communications to steal data from victims

Security Affairs

“The bot is embedded into the ToxicEye RAT configuration file and compiled into an executable file (an example of a file name we found was ‘paypal checker by saint.exe’). Experts also noticed that the RAT implements Ransomware features such as the ability to encrypt and decrypt victim’s files.

article thumbnail

Shade Ransomware gang shut down operations and releases 750K decryption keys

Security Affairs

Moth of the victims belongs to high-tech, wholesale and education sectors. The ransomware also drops on the Desktop 10 text files, named README1.txt txt, The README.txt files include instructions to contact the crooks via an email address in order to receive information on how to make the payments. txt through README10.txt,