Apache HTTP Server CVE-2021-42013 and CVE-2021-41773 Exploited in the Wild

Juniper Threat Labs has been seeing on-going attacks targeting Apache http servers. On October 4, the Apache Software Foundation disclosed CVE-2021-41773, a path traversal 0- day vulnerability with reports of

Share
Necro Python Botnet Goes After Vulnerable VisualTools DVR

In the last week of September 2021, Juniper Threat Labs detected a new activity from Necro Python (a.k.a N3Cr0m0rPh , Freakout, Python.IRCBot) that is actively exploiting some services, including a

Share
CVE-2021-22005: VMware vCenter Analytics Service Arbitrary File Upload Vulnerability

VMware vCenter server is a centralised management utility used for managing multiple ESXi hosts, virtual machines and all their dependent components. An arbitrary file upload vulnerability has recently been discovered in the Analytics

Share
Muhstik Botnet Targeting Confluence Servers with CVE-2021-26084

  Juniper Threat Labs is seeing an on-going attack targeting Confluence servers. On August 25, Atlassian, the company behind Confluence, disclosed the vulnerability CVE-2021-26084. A few days after that, several

Share
Aggah Malware Campaign Expands to Zendesk and GitHub to Host Its Malware

Juniper Threat Labs has detected a new development in the Aggah malware campaign. Previously, Aggah was known to be using legitimate infrastructures like BlogSpot, WordPress and Pastebin to host its

Share
Attacks Continue Against Realtek Vulnerabilities

As we predicted in last week’s post, threat actors continue to utilize new Realtek vulnerabilities disclosed by IoT Inspector Research Lab to distribute malware. Starting on August 19th, Juniper Threat

Share
RealTek CVE-2021-35394 Exploited in the Wild

Juniper Threat Labs has detected that the threat actors that we recently observed exploiting CVE-2021-20090 are now actively exploiting CVE-2021-35394, a vulnerability disclosed last week by IoT Inspector Research Lab.

Share
Freshly Disclosed Vulnerability CVE-2021-20090 Exploited in the Wild

Juniper Threat Labs continuously monitors in-the-wild network traffic for malicious activity. Today, we have discovered an active exploitation of a vulnerability that was disclosed just 2 days ago.  CVE-2021-20090 is a vulnerability that was discovered by

Share
Linux Servers Hijacked to Implant SSH Backdoor

On February 1st, Juniper Threat Labs observed an attack that attempted to inject malicious code into Secure Shell (SSH) servers on Linux. The attack begins with an exploit against the

Share
CVE-2021-21972: VMware vCenter Unauthorized Remote Code Execution

VMware vCenter Server is the centralized server management software for VMware, and is used to manage virtual machines, multiple ESXi hosts, and all dependent components from a single centralized location.

Share