Publications & Analyses
Argus Flow releases, platform announcements, press updates, and cybersecurity analyses.
Iran-Linked Hackers Disrupt US Critical Infrastructure via PLCs
Iran-linked hacker groups have reportedly targeted Internet-exposed Programmable Logic Controllers (PLCs) to disrupt critical infrastructure in the United States. This attack primarily caused operational disturbances within the affected systems, focusing on control system integrity rather than data exfiltration.
Russian Hackers Exploit Routers to Steal Microsoft Office Tokens
Hackers linked to Russian military intelligence exploited known vulnerabilities in older internet routers to steal authentication tokens from many Microsoft Office users. This spying campaign allowed state-backed actors to quietly siphon sensitive login data.
GrafanaGhost: New Attack Method Leaks Enterprise Data via Grafana
A recently identified attack method, dubbed GrafanaGhost, enables attackers to exploit Grafana instances to leak sensitive enterprise data. This vulnerability poses a significant risk to organizations using Grafana for monitoring and analytics, potentially exposing critical internal information.
Over 1,000 ComfyUI Instances Hit by Cryptomining Botnet
More than 1,000 exposed ComfyUI instances have been targeted by a cryptomining botnet campaign. Attackers are exploiting these systems to mine cryptocurrency, leading to resource degradation and increased operational costs for affected users.
German Police Unmask REvil Ransomware Leader
German law enforcement has announced the successful identification of the individual believed to be the leader of the notorious REvil ransomware group. This significant development marks a major blow to the organized cybercrime syndicate, known for high-profile attacks globally. The unmasking is expected to disrupt future operations and aid in broader efforts against ransomware threats.
GPUBreach: Root Shell Access Achieved via GPU Rowhammer Attack
Researchers have demonstrated a new GPU Rowhammer attack technique named GPUBreach, successfully gaining root shell access on systems. This attack exploits vulnerabilities in graphics processing unit memory, enabling unauthorized access to critical systems. Consequently, exploiting such a flaw could lead to data compromise or complete loss of system control.
Medusa Ransomware Rapidly Exploits Vulnerabilities to Breach Systems
Medusa ransomware group is noted for its speed in exploiting system vulnerabilities to infiltrate networks. While specific breach details are not provided, their operations typically involve data exfiltration and encryption, affecting various organizational data types. Organizations are urged to enhance their defensive measures against this pervasive threat.
GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips
A new security vulnerability named GPUBreach allows attackers to achieve full CPU privilege escalation. This is accomplished through bit-flips in GDDR6 memory, enabling bypass of system security measures and potential full control over affected systems. No specific hacking incidents or number of affected records have been reported yet, but the risk potential is high.
China-Linked Storm-1175 Deploys Medusa Ransomware Using Zero-Days
A threat actor identified as China-Linked Storm-1175 has been observed exploiting zero-day vulnerabilities to rapidly deploy Medusa ransomware. While specific victim details and the extent of data exfiltration remain undisclosed, this attack highlights a severe and sophisticated cyber threat. Organizations are urged to enhance their defenses against such advanced persistent threats.
Flowise AI Agent Builder Faces Critical RCE Exploitation, Over 12,000 Instances Exposed
Flowise AI Agent Builder is reportedly under active exploitation for a critical Remote Code Execution (RCE) vulnerability with a CVSS score of 10.0. This ongoing threat potentially affects over 12,000 instances globally, putting various sensitive data at risk. Organizations using Flowise AI are urged to take immediate protective measures.
Multi-OS Cyberattacks: SOCs Closing Critical Risks
This analysis discusses the increasing threat of cyberattacks targeting multiple operating systems simultaneously. It outlines how Security Operations Centers (SOCs) are adopting strategic approaches to effectively identify, respond to, and mitigate these complex threats across diverse IT environments, thereby closing critical security risks.
Qilin and Warlock Ransomware Bypass EDR Tools via Vulnerable Drivers
Ransomware groups Qilin and Warlock are exploiting vulnerable drivers to disable over 300 EDR tools. This tactic weakens organizations' cyber defenses, increasing the risk of data breaches. This new method highlights the need to re-evaluate cybersecurity strategies.