Customer Awareness Advisory

12.09.24

Customer Advisory: An Attack, Leveraging Spam Email, Teams, SharePoint, and OneDrive, Potentially Linked to the Ransomware Group Sangria Tempest

Discover how the recent VEILDrive attacks utilize Microsoft Teams, SharePoint, and OneDrive to infiltrate organizations in the Finance and Insurance sectors, revealing critical gaps in detection frameworks against Java-based malware.

09.17.24

POC Released for Critical Ivanti Vulnerability CVE-2024-29847

Explore the details of the Ivanti Endpoint Manager vulnerability CVE-2024-29847, including the available patch and recommended actions. Protect your infrastructure from remote code execution risks with expert insights and guidance.

07.31.24

Customer Advisory: M365 AitM Phishing Campaign Compromises Multiple Accounts

Discover how the Deepwatch Adversary Tactics and Intelligence team is addressing a significant M365 phishing threat. Get actionable insights to protect your organization from credential harvesting and account compromise.

07.26.24

Attackers Exploit Chain of Vulnerabilities in ServiceNow to Dump User List

Deepwatch is warning customers and organizations regarding attackers exploiting a chain of three vulnerabilities in ServiceNow to dump the user list and collect associated meta-data from compromised instances.

07.20.24

Customer Awareness Advisory: CrowdStrike – Microsoft Issue Flash

Stay informed about the CrowdStrike platform update that triggered Blue Screens of Death and find out how to safely restore your Windows machines with our comprehensive guide.

07.01.24

PoCs Released for High Severity Vulnerability, CVE-2024-6387, in OpenSSH

Learn about the high-severity vulnerability CVE-2024-6387 in OpenSSH and the potential impacts on glibc-based LInux systems.

06.26.24

Active Exploitation Follows Public Release of PoC for MOVEit Transfer Vulnerability

Discover the risks and impacts of the CVE-2024-5806 vulnerabity, including the likelihood of exploitation and severe potential impacts, necessitating immediate action.

04.26.24

New Espionage Campaign Exploits Vulnerabilities in Cisco ASA Devices

Deepwatch shares details and actions to take in response to the ArcaneDoor espionage campaign impacting Cisco ASA Devices.

04.12.24

Critical Vulnerability (CVE-2024-3400) Impacting Palo Alto Networks PAN-OS Software Exploited in Limited Attacks

Deepwatch shares details on the Palo Alto Networks PAN-OS Global Protect Software exploit - what you need to know and what you need to do.

03.06.24

Threat Actor Exploits Critical TeamCity Vulnerability to Deploy Malware

Deepwatch has confirmed a threat actor exploited the TeamCity vulnerability CVE-2024-27198 to gain initial access, laterally move to other systems, and deploy malware. The vulnerabilities impact all JetBrains TeamCity server versions 2023.11.3 and earlier

01.11.24

Ivanti Connect Secure VPN Appliance Vulnerabilities (CVE-2023-46805 & CVE-2024-21887) Exploited to Deploy Webshells, Collect Credentials, and Perform Reconnaissance

Deepwatch shares full details on the Ivanti Connect Secure VPN Appliance vulnerabilities exploit- what you need to know and what you need to do.

09.15.23

Voice Phishing’s Success with Resetting Single Sign-on Portal Passwords Sees Sudden Surge

Deepwatch provides a full overview of the recent surge in voice phishing to reset users’ passwords & gain access to sensitive systems

07.19.23

NetScaler ADC and Gateway CVE-2023-3519 Actively Exploited

Exploits on NetScaler ADC & Gateway CVE-2023-3519 have been observed. Read the full report for known details, actions & recommendations

07.13.23

Customer Advisory: Awareness | Storm-0978 (RomCom): Cyber-espionage Campaign Targeting NATO Talks, Exploiting CVE-2023-36884

Get an in-depth analysis of recent cyber-espionage activities conducted by the threat group Storm-0978 (RomCom)

06.14.23

Customer Advisory: Awareness | Threat Actors Exploiting Critical Vulnerability (CVE-2023-27997) in FortiOS and FortiProxy

A FortiOS and FortiProxy vulnerability, CVE-2023-27997, has been exploited. Get historical TTP details, potential impact, and actionable mitigation strategies

04.26.23

Customer Advisory: Awareness | Deepwatch Observes Unauthenticated Remote Code Execution Vulnerability Exploitation in Avaya Aura Device Services

What you need to know about the Unauthenticated Remote Code Execution Vulnerability and recommendations for responding

03.30.23

Customer Advisory | 3CX Suffers Supply Chain Attack: Electron Windows App Drops an Unknown Infostealer

What you need to know about the 3CX Supply Chain Attack CVE-2023-29059 and recommendations for responding

03.21.23

Customer Advisory | Threat Actors Exploited Microsoft Outlook for Windows (CVE-2023-23397) as Early as April 2022

What you need to know about Threat Actors Exploited Microsoft Outlook for Windows CVE-2023-23397 as Early as April 2022

03.09.23

PoC Exploit Released for Critical Windows Word Vulnerability CVE-2023-21716

A proof of concept (POC) exploit code for Critical Windows Word Vulnerability CVE-2023-21716 has been released. Understand what you need to know

01.20.23

Customer Advisory | Threat Actors Actively Exploiting ManageEngine Vulnerability CVE-2022-47966

What you need to know about the active exploitation of ManageEngine Vulnerability CVE-2022-47966

12.14.22

Customer Advisory: Citrix ADC and Citrix Gateway Critical Vulnerability (CVE-2022-27518) Actively Exploited

Understand key details surrounding the Citrix ADC and Citrix Gateway Critical Vulnerability (CVE-2022-27518) being exploited

12.13.22

Customer Advisory: FortiOS SSL-VPN Vulnerability (CVE-2022-42475) Exploited in the Wild

Understand key details surrounding the FortiOS SSL-VPN Vulnerability (CVE-2022-42475) that has been actively exploited in the wild

10.22.22

Customer Advisory: Adversaries Are Scanning For and Exploiting Text4Shell Vulnerability (CVE-2022-42889)

The what, why, and how to respond to adversaries scanning for and exploiting Text4shell Vulnerability (CVE-2022-42889)

09.30.22

Customer Advisory | Microsoft Exchange Zero-day Vulnerabilities CVE-2022-41040 and CVE-2022-41082, Actively Exploited

08.18.22

Customer Advisory | Exploit Code Released for Critical Vulnerability, CVE-2022-27255, Affecting Thousands of Routers

Learn everything you need to know about the critical vulnerability, CVE-2022-27255, in Realtek’s SDK for eCos OS, including vulnerability details, the publicly available exploit code, and what you need to do