APT Archives

Threat Intelligence

Ivanti Connect Secure VPN Exploitation: New Observations

January 18, 2024

Matthew Meltzer, Sean Koessel, and Steven Adair

On January 15, 2024, Volexity detailed widespread exploitation of Ivanti Connect Secure VPN vulnerabilities CVE-2024-21887 and CVE-2023-46805. In that blog post, Volexity detailed broader scanning and exploitation by threat actors […]

Threat Intelligence

Ivanti Connect Secure VPN Exploitation Goes Global

January 15, 2024

Cem Gurkok, Paul Rascagneres, Sean Koessel, Steven Adair, and Tom Lancaster

Important: If your organization uses Ivanti Connect Secure VPN and you have not applied the mitigation, then please do that immediately! Organizations should immediately review the results of the built-in […]

Threat Intelligence

Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN

January 10, 2024

Matthew Meltzer, Robert Jan Mora, Sean Koessel, Steven Adair, and Tom Lancaster

Volexity has uncovered active in-the-wild exploitation of two vulnerabilities allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. An official security advisory and knowledge base article have been […]

Threat Intelligence

EvilBamboo Targets Mobile Devices in Multi-year Campaign

September 22, 2023

Callum Roxan, Paul Rascagneres, and Tom Lancaster

Volexity has identified several long-running and currently active campaigns undertaken by the threat actor Volexity tracks as EvilBamboo (formerly named Evil Eye) targeting Tibetan, Uyghur, and Taiwanese individuals and organizations. […]

Threat Intelligence

Charming Kitten Updates POWERSTAR with an InterPlanetary Twist

June 28, 2023

Ankur Saini and Charlie Gardner

Volexity works with many individuals and organizations often subjected to sophisticated and highly targeted spear-phishing campaigns from a variety of nation-state-level threat actors. In the last few years, Volexity has […]

Threat Intelligence

3CX Supply Chain Compromise Leads to ICONIC Incident

March 30, 2023

Ankur Saini, Callum Roxan, Charlie Gardner, Paul Rascagneres, Steven Adair, and Tom Lancaster

[Update: Following additional analysis of shellcode used in ICONIC, in conjunction with other observations from the wider security community, Volexity now attributes the activity described in this post to the […]

Threat Intelligence

₿uyer ₿eware: Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware

December 1, 2022

Callum Roxan, Paul Rascagneres, and Robert Jan Mora

Over the last few months, Volexity has observed new activity tied to a North Korean threat actor it tracks that is widely referred to as the Lazarus Group. This activity […]

Threat Intelligence

SharpTongue Deploys Clever Mail-Stealing Browser Extension “SHARPEXT”

July 28, 2022

Paul Rascagneres, Tom Lancaster, and Volexity Threat Research

Volexity tracks a variety of threat actors to provide unique insights and actionable information to its Threat Intelligence customers. One frequently encountered—that often results in forensics investigations on compromised systems—is […]

Threat Intelligence

DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach

June 15, 2022

Steven Adair, Tom Lancaster, and Volexity Threat Research

Volexity frequently works with individuals and organizations heavily targeted by sophisticated, motivated, and well-equipped threat actors from around the world. Some of these individuals or organizations are attacked infrequently or […]

Threat Intelligence

Zero-Day Exploitation of Atlassian Confluence

June 2, 2022

Andrew Case, Sean Koessel, Steven Adair, Tom Lancaster, and Volexity Threat Research

UPDATE: On June 3, 2022, Atlassian updated its security advisory with new information regarding a fix for Confluence Server and Data Center to address CVE-2022-26134. Users are encouraged to update immediately to […]