Customer Awareness Advisory
Deepwatch Threat Intel Teams' open-source analysis provides our assessment, mitigation, and recommendations for the latest critical threats and vulnerabilities.
03.30.23
Customer Advisory | 3CX Suffers Supply Chain Attack: Electron Windows App Drops an Unknown Infostealer
03.21.23
Customer Advisory | Threat Actors Exploited Microsoft Outlook for Windows (CVE-2023-23397) as Early as April 2022
03.09.23
PoC Exploit Released for Critical Windows Word Vulnerability CVE-2023-21716
01.20.23
Customer Advisory | Threat Actors Actively Exploiting ManageEngine Vulnerability CVE-2022-47966
12.14.22
Customer Advisory: Citrix ADC and Citrix Gateway Critical Vulnerability (CVE-2022-27518) Actively Exploited
12.13.22
Customer Advisory: FortiOS SSL-VPN Vulnerability (CVE-2022-42475) Exploited in the Wild
10.22.22
Customer Advisory: Adversaries Are Scanning For and Exploiting Text4Shell Vulnerability (CVE-2022-42889)
09.30.22
Customer Advisory | Microsoft Exchange Zero-day Vulnerabilities CVE-2022-41040 and CVE-2022-41082, Actively Exploited
08.18.22
Customer Advisory | Exploit Code Released for Critical Vulnerability, CVE-2022-27255, Affecting Thousands of Routers
08.10.22
Customer Advisory | Microsoft’s Support Diagnostic Tool Vulnerability, AKA DogWalk, Actively Exploited
07.26.22
Customer Advisory | Brace for Exploitation; Hardcoded Password for Questions for Confluence App Leaked
06.22.22
Customer Advisory | Splunk Critical Vulnerability
06.03.22
Customer Advisory | Critical RCE Vulnerability in Atlassian’s Confluence Server and Data Center Actively Exploited
05.31.22
Customer Advisory | Microsoft Office Used to Exploit “Follina” (CVE-2022-30190) an RCE Vulnerability in Microsoft’s Support Diagnostic Tool
05.16.22
Customer Advisory | Critical Vulnerability in Zyxel Firewalls and VPNs Actively Exploited
05.10.22
Customer Advisory | Exploit Code Released for Critical RCE Vulnerability in F5s BIG-IP
04.25.22
Customer Advisory | Threat Actors Exploiting Critical WSO2 Vulnerability
04.15.22
Customer Advisory | Threat Actors Exploiting Critical VMWare Vulnerability
03.31.22
Customer Advisory | Spring4Shell: What You Need to Know
03.23.22
Customer Advisory | President Warns of Russian Government Exploring Options for Cyber Attacks
03.09.22
Customer Advisory | Linux Vulnerability: Dirty Pipe Has Exploit Code Released
03.02.22
Customer Advisory | NVIDIA Confirms Data Was Stolen as Lapsus$ Takes Credit
02.22.22
Customer Advisory | Cyber Attacks in Ukraine: What You Need to Know
02.17.22
Customer Advisory | Exploit Code Released for Critical Cisco Vulnerability: CVE-2022-20699
02.15.22
Customer Advisory | Critical 0-Day Vulnerability in Adobe Commerce and Magento Open Source Platforms Under Active Exploitation
02.02.22
Customer Advisory | Exploit Code Released for Windows 10 Vulnerability: CVE-2022-21882
01.27.22
Customer Advisory | PwnKit: Exploit Released for Polkit’s pkexec Component
01.20.22
Customer Advisory | Exploit Code Released for CVE-2022-21907: Critical Windows HTTP Vulnerability
12.08.21
Customer Advisory for Awareness | Grafana Issues a Security Patch After an Exploit for CVE-2021-43798 is Made Public
12.03.21
Customer Advisory for Awareness | With an Active Campaign Against ServiceDesk Plus, APT Expands Attack on ManageEngine
11.15.21
Customer Advisory for Awareness | Zero-Day Disclosed in Palo Alto Networks GlobalProtect VPN (CVE-2021-3064)
10.05.21
Customer Advisory for Awareness | Apache HTTP Server Actively Exploited, Patch is Available, Patch Now!
09.23.21
Customer Advisory for Awareness | CISA, FBI, and NSA Issue Joint Advisory Regarding Increased Conti Ransomware Attacks
09.08.21
Customer Advisory for Awareness | Microsoft Warns of New RCE Zero-Day Exploited in Targeted Office Attacks
09.01.21
Customer Advisory for Awareness | Confluence Enterprise Server & Data Center are Being Actively Exploited
08.27.21
Customer Advisory for Awareness | Azure Cosmos DB Flaw Could Allow for Complete Database Compromise
08.16.21
Customer Awareness: Windows Print Spooler RCE Vulnerability CVE-2021-36958
07.26.21
PetitPotam NTLM Relay Attack
07.21.21
CVE-2021-33909 & CVE-2021-33910 – Long Path Name in Mountpoint Flaws in the Kernel and Systemd
07.19.21
U.S. Federal Cybersecurity Advisory: TTPs of Chinese State-Sponsored Cyber Operations
07.02.21
Kaseya VSA Compromise – REvil Ransomware Attack
07.01.21
CVE-2021-1675 – PrintNightmare Vulnerability
06.22.21
CVE-2021-3044 Vulnerability: Cortex XSOAR
05.26.21
CVE-2021-21985 – Vulnerability Found in VMware vCenter Servers and Cloud Foundation
04.22.21
CVE-2021-22893 – Pulse Secure VPN Zero-Day & Active Exploits
03.03.21
Microsoft Exchange Server Zero-Days
02.26.21
Chasing Silver Sparrow: Keeping an Eye on the Mysterious macOS Malware
02.25.21
CVE-2021-21972 – Vulnerability Found in VMware vCenter Servers and Cloud Foundation
02.22.21
Windows Event 4688 – Part I – Eh to Excellent
02.18.21
SolarWinds Attack – Part II – Is MITRE ATT&CK Falken’s Maze?
01.27.21
Sudo Vulnerability
12.29.20
SolarWinds Attack – Part I – From Infrastructure to Endpoint
12.18.20
Summary of Deepwatch’s Actions in Response to Sunburst IOC
11.04.20
Oracle WebLogic Vulnerability
10.19.20
ZeroLogon Threat Review
10.14.20
Bad Neighbor Vulnerability
09.14.20
Zerologon Vulnerability
07.29.20
BootHole Vulnerability SPOT Report
07.14.20
SAP RECON Vulnerability
07.06.20
F5 Networks BIG-IP Vulnerabilities
06.30.20
SPOT Report – Palo Alto Networks Authentication Bypass
05.15.20
Palo Alto Networks & Cisco Kerberos Authentication Bypass
04.03.20
SPOT Report – Zoom Zero-Day
03.05.20
SPOT Report – Apache Tomcat – GhostCat
02.06.20
SPOT Report – Cisco – CDPwn Vulnerabilities
01.15.20
SPOT Report – Microsoft Crypt32 Certificate Validation flaw
12.24.19
SPOT Report – Citrix ADC & Gateway Vulnerability
08.28.19
SPOT Report – Imperva Security Breach
08.16.19
Seven Monkeys Vulnerability – SPOT Report – August 2019 Patch Tuesday
06.20.19
SPOT Report – WebLogic Remote Code Execution
06.20.19
SPOT Report – SACK Vulnerabilities
05.15.19
SPOT Report – ZombieLoad
05.15.19
SPOT Report – Patch Tuesday Vulnerabilities
05.15.19
SPOT Report – Cisco – Thrangrycat
05.01.19
SPOT Report – Oracle WebLogic Remote Code Execution CVE-2019-2725
04.25.19
1-day Vulnerabilities: The Limits of Following the Patch Tuesday Cycle
03.07.19
Google Chrome FileReader Vulnerability
02.11.19
Runc Docker Vulnerability
01.25.19
MS Exchange Privilege Escalation Attack
01.10.19
DNS Infrastructure Hijacking Campaign
12.21.18
IE – Scripting Engine Memory Corruption Vulnerability CVE-2018-8653
12.02.18