Overview 

The Cyber Security Agency of Singapore (CSA) has alerted users of multiple vulnerabilities in Apache software. According to the alert, three Apache vulnerabilities have been reported, including CVE-2024-43441, CVE-2024-45387, and CVE-2024-52046. In late 2024, the Apache Software Foundation released security updates for several of its widely used products to address critical vulnerabilities.  

These vulnerabilities, identified as CVE-2024-43441, CVE-2024-45387, and CVE-2024-52046, affect Apache HugeGraph, Apache Traffic Control, and Apache MINA. Exploitation of these vulnerabilities could lead to severe security risks, including remote code execution (RCE), authentication bypasses, and SQL injection attacks. 

Details of the Apache Vulnerabilities 

Here are the vulnerabilities identified in the Apache software:  

CVE-2024-43441: Authentication Bypass in Apache HugeGraph 

The first critical vulnerability, CVE-2024-43441, impacts Apache HugeGraph-Server, a graph database server. This flaw allows an attacker to bypass existing authentication mechanisms in versions prior to 1.5.0. Apache HugeGraph, which is used for managing and querying large-scale graph data, could become an easy target for attackers if this vulnerability is exploited. 

By bypassing authentication, an attacker could gain unauthorized access to sensitive data or modify the server’s configuration, potentially disrupting the services relying on HugeGraph. Users and administrators are urged to update to version 1.5.0 or higher to mitigate the risk posed by this vulnerability. 

CVE-2024-45387: SQL Injection in Apache Traffic Control 

Another vulnerability, CVE-2024-45387, affects Apache Traffic Control, a tool used for managing content delivery networks (CDNs). This vulnerability exists in the Traffic Ops component of Apache Traffic Control, which is responsible for the management and optimization of traffic routing across CDN servers. The flaw allows attackers to perform SQL injection attacks in versions 8.0.0 to 8.0.1. 

SQL injection is one of the most well-known forms of attack, allowing attackers to manipulate database queries by inserting malicious SQL code. If successfully exploited, this vulnerability could allow an attacker to gain access to or manipulate the underlying database of an organization’s CDN, potentially compromising sensitive information or altering configurations. Users of affected versions are strongly advised to upgrade to later versions as soon as possible to patch this vulnerability. 

CVE-2024-52046: Remote Code Execution in Apache MINA 

Perhaps the most critical of the three vulnerabilities, CVE-2024-52046, affects Apache MINA, a network application framework used to build scalable and high-performance network applications. This vulnerability is particularly severe because it allows remote code execution (RCE) attacks due to improper handling of serialized data. 

Apache MINA uses Java’s native deserialization protocol to process incoming serialized data. However, due to a lack of necessary security checks, attackers can exploit this flaw by sending specially crafted malicious serialized data, leading to RCE. This flaw affects versions of MINA core prior to 2.0.27, 2.1.10, and 2.24. 

Remote code execution is one of the most dangerous types of vulnerabilities, as it allows attackers to execute arbitrary code on the affected system, potentially leading to full system compromise. For applications using Apache MINA, it is essential to upgrade to the latest versions (2.0.27, 2.1.10, or 2.24) and, in some cases, apply additional mitigation steps.  

Users must explicitly configure the system to reject all deserialization requests unless they come from a trusted source. This additional step is necessary because simply upgrading the software will not be sufficient to fully secure the system. 

Detailed Instructions for Mitigation of CVE-2024-52046 

The CVE-2024-52046 vulnerability requires users to not only upgrade to the latest version of Apache MINA but also manually configure the deserialization process to limit which classes are accepted. The update includes three methods for controlling which classes the ObjectSerializationDecoder will accept: 

1. ClassNameMatcher: Accept class names that match a specified pattern. 

2. Pattern: Accept class names that match a regular expression pattern. 

3. String Patterns: Accept class names that match a wildcard pattern. 

By default, the decoder will reject all classes unless explicitly allowed, making it critical to follow these instructions to properly secure systems that use Apache MINA. It is also important to note that certain sub-projects, such as FtpServer, SSHd, and Vysper, are not affected by this vulnerability. 

Emmanuel Lécharny, a user and contributor on the Apache MINA mailing list, noted the risk of RCE attacks associated with this issue. In his post dated December 25, 2024, he stressed the importance of upgrading to the latest versions of Apache MINA and applying the necessary security settings to protect against exploitation. 

Conclusion 

To protect their infrastructure, organizations relying on Apache products must take immediate action to address these vulnerabilities. For CVE-2024-43441, updating to Apache HugeGraph-Server version 1.5.0 or later is essential to resolve the authentication bypass issue.  

Organizations should also upgrade to a version of Apache Traffic Control newer than 8.0.1 to mitigate the SQL injection vulnerability in CVE-2024-45387. For CVE-2024-52046 in Apache MINA, upgrading to the latest versions (2.0.27, 2.1.10, or 2.24) and configuring the deserialization process to restrict accepted classes is critical.  

Keeping systems up-to-date with the latest security patches and updates from the Apache Software Foundation is key to defending against active exploitation of these vulnerabilities. Proactively applying these measures will significantly reduce the risk of attacks and ensure a more secure environment. 

References:  

• https://www.csa.gov.sg/alerts-advisories/alerts/2024/al-2024-146 

• https://lists.apache.org/thread/4wxktgjpggdbto15d515wdctohb0qmv8 

• https://www.cve.org/CVERecord?id=CVE-2024-52046 

• https://mina.apache.org/ 

• https://lists.apache.org/thread/4wxktgjpggdbto15d515wdctohb0qmv8 

The post Cyber Security Agency of Singapore Warns of Exploited Apache Vulnerabilities in 2024 appeared first on Cyble.

Blog – Cyble – ​Read More

Overview 

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 185 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in 2024, as the database grew to 1,238 software and hardware flaws at high risk of cyberattacks. 

The agency removed at least two vulnerabilities from the catalog in 2024, but the database has generally grown steadily since its launch in November 2021. 

We’ll look at some of the trends and vulnerabilities from 2024, along with the vendors and projects that had the most CVEs added to the list this year. 

CISA Known Exploited Vulnerabilities Growth Stabilizes 

CISA’s KEV catalog has grown at a steady rate in 2023 and 2024, with 187 vulnerabilities added in 2023 and 185 this year. That’s a pretty stable rate after KEV’s first year, when the agency added more than 300 vulnerabilities in the first two months of the program and nearly 500 more in the first six months of 2022. 

The addition of older vulnerabilities has also stabilized, as 115 of this year’s vulnerabilities were 2024 CVEs, compared to 121 CVEs from 2023 in last year’s additions. That still leaves 60 to 70 older vulnerabilities coming under active exploit each year. 

The oldest vulnerability in the catalog dates from 2002 – CVE-2002-0367, a privilege escalation vulnerability in the Windows NT and Windows 2000 smss.exe debugging subsystem that has been known to be used in ransomware attacks. 

The oldest vulnerability added to the KEV database in 2024 was CVE-2012-4792, a Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8. CISA also added four Adobe Flash Player vulnerabilities from 2013 and 2014 this year, in addition to one vulnerability each from Cisco and D-Link from 2014. 

Most Common Software Weaknesses in CISA KEV 

Five software and hardware weaknesses (common weakness enumerations, or CWEs) were particularly prominent among the 2024 KEV additions. 

• CWE-78 – Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) – was the most common weakness among vulnerabilities added to the KEV database this year, accounting for 14 of the 185 vulnerabilities. 
• CWE-502 – Deserialization of Untrusted Data – occurred in 11 of the vulnerabilities. 
• CWE-416 – Use After Free – was behind 10 of the vulnerabilities. 
• CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, or ‘Path Traversal’) and CWE-287 (Improper Authentication) occurred 9 times each. 

Vendors with the Most Vulnerabilities in CISA KEV 

Not surprisingly, Microsoft had the most additions to CISA’s KEV database again this year, as the software giant accounted for 36 of the 185 vulnerabilities added this year, up from 27 out of 2023’s 187 additions. 

Second on the list was Ivanti, which had 11 vulnerabilities across multiple products that made the list. Ivanti’s challenges this year were perhaps best exemplified by the fact that CISA itself was breached through an Ivanti vulnerability. Cyble honeypot sensor detected attacks on multiple Ivanti vulnerabilities this year, with the first detections occurring in January. 

Vendors and projects with four or more CISA KEV additions are noted below: 

Vendor/project	2024 CISA KEV additions
Microsoft	36
Ivanti	11
Google Chromium	9
Adobe	8
Apple	7
Android	6
Cisco	6
D-Link	6
Palo Alto Networks	6
Apache	5
VMware	5
Fortinet	4
Linux	4
Oracle	4

Interestingly, while Fortinet vulnerabilities attracted widespread attention this year, in part due to the large number of exposed devices, network security rival Palo Alto Networks actually had more vulnerabilities added to the KEV database this year. Palo Alto may soon get another KEV addition, as the just-announced CVE-2024-3393 vulnerability is reportedly under active attack. 

One interesting thing about the 2024 CISA KEV list is that the number of web-facing exposures or vulnerabilities a vendor has or even Common Vulnerability Scoring System (CVSS) severity ratings don’t always reflect the damage a particular vulnerability can cause. 

A case in point: CVE-2024-39717, a 7.2-severity Versa Director vulnerability with just 31 web-exposed instances, may have been weaponized in supply chain attacks against ISPs and MSPs. 

Cleo had just two vulnerabilities added to the KEV catalog this year (CVE-2024-50623 and CVE-2024-55956), and yet vulnerabilities in the company’s managed file transfer (MFT) solutions have apparently been used to breach 66 organizations. 

Conclusion 

CISA’s Known Exploited Vulnerabilities catalog remains a valuable tool for helping IT security teams prioritize patching and mitigation efforts. 

CISA KEV can also alert organizations to third-party risks – although by the time a vulnerability gets added to the database it’s become an urgent problem requiring immediate attention. Third-party risk management (TPRM) solutions could provide earlier warnings about partner risk through audits and other tools. 

Finally, software and application development teams should monitor CISA KEV additions to gain awareness of common software weaknesses that threat actors routinely target. 

The post A Look at CISA Known Exploited Vulnerabilities in 2024  appeared first on Cyble.

Blog – Cyble – ​Read More

As we wrap up 2024, let’s take a moment to reflect on what an incredible year it’s been for ANY.RUN. Together, we’ve achieved so much: breaking barriers, improving tools, and working side by side with you, our amazing community of cybersecurity heroes. 

From big product launches to small tweaks that make a huge difference, everything we’ve done this year has been with one goal in mind: to make your fight against cyber threats easier, smarter, and faster. 

Let’s take a look back at some of the highlights that made this year unforgettable! 

Interactive Sandbox 

This year, we took significant strides to enhance your experience with the ANY.RUN sandbox, introducing new features and upgrades to help you combat cyber threats more effectively. 

Linux OS Support for In-Depth Malware Analysis 

For the first time, our sandbox extended its capabilities beyond Windows, making it possible for malware analysts, SOC teams, and DFIR experts to analyze Linux-based samples in a secure and interactive cloud environment. 

With real-time monitoring of suspicious activities, detailed reports featuring the MITRE ATT&CK Matrix, Process Graphs, and IOCs, you can now uncover threats on Linux systems with the same precision and speed you’ve come to expect from ANY.RUN. 

Universal Windows 10 x64 Access 

In 2024, we made Windows 10 (64-bit) VMs available to all users, including those on the Community plan! 

Everyone can analyze malware and phishing threats in a modern Windows environment, leveling the playing field for cybersecurity investigations. 

This update ensures everyone can access powerful threat analysis tools and helps improve threat detection for the entire ANY.RUN community. 

Automated Interactivity: Smarter and Faster Malware Detonation 

With Stage 2 Automated Interactivity, ANY.RUN’s Interactive Sandbox now handles even more complex malware and phishing scenarios automatically. From extracting URLs in QR codes to detonating payloads in email attachments and navigating long redirect chains, it’s all done without user input. 

Our analyst team continuously adds new attack scenarios, ensuring your sandbox stays one step ahead of evolving threats! 

A New Look at Network Threats: Redesigned Details Window 

IIn 2024, we revamped the Threat details window to give you a clearer view of malware activity. Now, you can access all key intel, like source data, IP addresses, ports, and protocols, in one streamlined view. 

And for Hunter and Enterprise users, the new Suricata rule tab opens the door to the signatures behind the detections. 

PowerShell Support in Script Tracer 

This year, we supercharged our Script Tracer by adding PowerShell support to its arsenal, alongside JScript, VB Script, VBA, and Macro 4.0. 

Now, you can follow PowerShell scripts step by step, making it easier to analyze and counter malware leveraging persistence, lateral movement, or payload execution. 

Your Private AI Assistant: Smarter, Safer, and Always There to Help 

This year, we introduced a private AI model inside ANY.RUN’s sandbox, replacing ChatGPT.  

Now, you can get fast, AI-powered explanations in both public and private sessions, without worrying about data leaving your hands. 

Phishing Detection with Rspamd 

In 2024, we leveled up our phishing detection game with the integration of Rspamd, an open-source email filtering system, into ANY.RUN’s Static Discovering module.

With features like Score, Content, and Header Descriptions, you can dive deep into email analysis. 

STIX Reports 

We added the ability to export threat data in the STIX format, a standardized language for sharing cyber threat intelligence. The report contains the link to the sandbox session, hashes, network traffic details, file system modifications, TTPs, and more. 

A Fresh Look for Faster Analysis: Sandbox Home Screen Redesign 

We gave the ANY.RUN Sandbox home screen a sleek makeover to make navigation easier and faster. 

New shortcut buttons let you launch analysis sessions in just a click 

Tag It Your Way: Custom Tags via API 

Now you can set custom tags to sandbox sessions directly through the API, adding to the flexibility of the web interface. Organize and categorize your analyses your way, with more control than ever before! 

Teamwork Upgrades 

This year, we made significant upgrades to the Teamwork functionality of the ANY.RUN sandbox. Some of the key changes include: 

• Single Sign-On (SSO): We’ve tackled key issues like fixing the logout process and resolving setup problems. Plus, you now can log in not just through our authorization window but also using third-party services. 

• Exporting team history: Enterprise users can now export structured lists of their team’s sandbox sessions in JSON format.  

• Mutli-admin support: Team owners can now appoint multiple admins to manage their teams more effectively. Admins have the ability to enable and disable SSO, invite or remove team members, and manage licenses, including Threat Intelligence (TI) licenses. 

Threat Intelligence Lookup 

In 2024, we introduced Threat Intelligence Lookup, a tool designed to give you access to a centralized repository of millions of Indicators of Compromise (IOCs), Indicators of Attack (IOAs), and Indicators of Behavior (IOBs).

This powerful service allows you to build precise queries, use them to search across threat data from public sandbox sessions, and enrich your threat intelligence with additional context, connecting isolated IOCs to broader malware campaigns, all in one place. 

But we didn’t stop there! 

Throughout the year, we worked hard to refine TI Lookup, adding new features and capabilities to make it even better for security teams and professionals.  

Here’s how we’ve enhanced it: 

YARA Search: Your Custom Threat-Hunting Tool 

This year, we expanded our Threat Intelligence suite with YARA Search, giving users the power to scan ANY.RUN’s extensive database using custom YARA rules. 

With a built-in editor, you can easily write, edit, test, and manage your rules. Once matching malicious files are identified, dive deeper by analyzing their behavior directly in the sandbox. 

Mutex Search: Precision Meets Speed in TI Lookup 

We’ve enhanced Threat Intelligence Lookup with a powerful Mutex Search feature, designed to make your investigations faster and more precise. 

Using queries like SyncObjectName:”[name of the malware]”, you can quickly locate relevant sandbox analysis sessions tied to specific mutexes. 

Suricata Search: Deeper Dive into Network Threats 

The Threat Intelligence Lookup now includes Suricata search fields, making it easier to pinpoint specific network threats. 

Search using fields like SuricataClass, SuricataMessage, SuricataThreatLevel, and SuricataID to uncover detailed information about network activity.  

Malware Config Insights: Unlocking Hidden IOCs 

We’ve expanded Threat Intelligence Lookup to include IOCs from malware configurations, manually extracted from reverse-engineered samples. 

Currently covering 79 malware families, these config-based IOCs are tagged with “malconf” for easy identification. This feature gives you a clearer understanding of malware behavior and helps you uncover actionable insights faster than ever. 

Notifications 

Threat Intelligence Lookup has also been upgraded with the new Notifications feature. 

Subscribe to specific search queries and receive alerts on new IOCs, IOAs, and IOBs directly in your dashboard. New results are clearly highlighted, making it easier to stay on top of emerging threats and act quickly. 

Redesigned Home Screen with Interactive MITRE ATT&CK Matrix 

In 2024, we took the time to give the Threat Intelligence home screen a thoughtful upgrade, making it more user-friendly and packed with valuable features. 

The new design offers a clearer, more intuitive view of the threat landscape. We’ve added a MITRE ATT&CK matrix with refined techniques and tactics, along with real-world examples of malware and phishing threats analyzed in the ANY.RUN sandbox. 

TI Feeds 

Our Threat Intelligence Feeds provide actionable data on malicious IPs, URLs, and domains, collected from analysis sessions created by over 500,000 researchers in the ANY.RUN sandbox. 

This year, we further improved TI Feeds by introducing STIX and MISP formats.

We also introduced demo samples of our feeds that any user can try for free via API. 

Safebrowsing 

In 2024, we brought you Safebrowsing, a new tool designed for faster and simpler threat analysis. 

With Safebrowsing, you can safely analyze suspicious URLs in a fully interactive, isolated browser environment. It’s a quick and secure way to explore websites, verify malicious content, and protect your local system from risk. 

Browser Extension 

We made malware analysis even easier with the launch of the ANY.RUN Browser Extension for Chromium-based browsers. 

With this extension, you can start analysis sessions directly from your browser and view results instantly, either in the extension or in the sandbox for deeper investigation. It’s fast, simple, and designed to save you valuable time. 

Integrations 

At ANY.RUN, we know how important integrations are for streamlining your threat analysis workflows.  

That’s why in 2024 we focused on expanding our connectivity with industry-leading platforms to make your investigations faster and more efficient. 

Integration with OpenCTI 

We integrated with OpenCTI, allowing users to enrich their threat intelligence with data from ANY.RUN. Malware labels, malicious scores, TTPs, file hashes, and IP addresses are now transferred into OpenCTI, eliminating manual work and centralizing your analysis. 

Integration with Splunk 

We also launched an integration with Splunk, bringing our Interactive Sandbox and Threat Intelligence Lookup directly into the Splunk SOAR environment. 

It lets you analyze malicious files and URLs, and enrich your investigations with comprehensive threat intelligence, all without leaving your familiar Splunk environment.

Security Training Lab 

In 2024, we launched Security Training Lab, addressing a critical gap in cybersecurity education—bridging theory with hands-on practice. 

Universities often struggle to keep pace with evolving cyber threats. Our program empowers educators and students with tools like ANY.RUN’s sandbox, real-world threat simulations, and a practical curriculum designed to prepare future professionals for real challenges. 

Highlights of Security Training Lab 

• 30+ hours of content: Comprehensive academic resources, tasks, and tests. 
• Hands-on experience: Analyze real malware samples in a secure environment. 
• Easy management: Track progress with our user-friendly platform. 
• Community support: A private Discord group for students. 

With Security Training Lab, we’re shaping confident, skilled cybersecurity professionals ready to take on the future. 

Cyber Threat Research from ANY.RUN Team

In 2024, ANY.RUN’s team of malware analysts continued to share their research on new and emerging threats, helping the cybersecurity community stay informed. Take a look at some of the article published by our team throughout the year:

• Zero-day Attack Uses Corrupted Files to Bypass Detection: Technical Analysis
• PSLoramyra: Technical Analysis of Fileless Malware Loader
• New PhantomLoader Malware Distributes SSLoad: Technical Analysis
• Brief Overview of the DeerStealer Distribution Campaign

Make sure to subscribe to us on X and other social media to get quick rundowns on active malware and phishing campaigns.

ANY.RUN’s Top Awards in 2024 

In 2024, ANY.RUN’s commitment to innovation and excellence in cybersecurity was recognized with prestigious industry awards. They reflect the hard work of our team and the impact of our tools on the global cybersecurity community: 

• Cybersecurity excellence awards– Winner in the Threat Hunting category, highlighting our impact and commitment to excellence. 
• Best security solution– Our platform was named the Best Threat Intelligence & Interactive Malware Analysis Platform, praised for its innovation and user-friendly design. 
• Top 150 cybersecurity vendors– ANY.RUN earned a spot on IT-Harvest’s Top 150 Vendors, a global benchmark in the cybersecurity field. 
• Best in behavior analytics– The CyberSecurity Breakthrough Awards recognized our behavior analytics and the advanced Automated Interactivity feature. 

We’re proud of these achievements and look forward to raising the bar even higher in 2025! 

Stronger Together: Collaboration with the ANY.RUN Community 

We were closer than ever with the incredible ANY.RUN community. Together, we uncovered new threats, presented cutting-edge technical analyses, and pushed the boundaries of what’s possible in malware research. 

Your active engagement has been at the heart of our success. We can’t thank you enough for your support and collaboration throughout the year. 

As we look ahead to 2025, we’re excited to bring even more opportunities for mutual collaboration.  

Let’s continue to grow, learn, and tackle cyber threats together! 

More to Come in 2025 

As we celebrate these milestones, we’re already looking ahead to 2025. With exciting projects on the horizon, new features in development, and your continued support, we’re confident that the best is yet to come. 

To every researcher, analyst, and team who trusted ANY.RUN this year: thank you. You are the reason we do what we do. Here’s to another year of fighting cybercrime—together. 

Happy New Year, 
The ANY.RUN Team

About ANY.RUN  

ANY.RUN helps more than 500,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, YARA Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.  

Get a 14-day free trial of ANY.RUN’s Interactive Sandbox →

The post 2024 Wrapped: A Year of Growth, Innovation, and Community at ANY.RUN  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

As we wrap up 2024, we’re excited to share the final release notes of the year, and they’re packed with updates you’re going to love! 

This December, we’ve shared some great news with our ANY.RUN community. From new wildcards and search operators in TI Lookup to the launch of our MISP instance and an upgraded Teamwork feature, we’ve been working to make your workflows smoother and more collaborative.  

And of course, we’ve expanded our threat coverage to ensure you’re ready to tackle whatever comes next.  

Let’s dive in! 

New Wildcards and Search Operators in ANY.RUN’s TI Lookup 

Searching through massive amounts of cyber threat data isn’t exactly fun. It can be frustrating when small variations in domain names or IP addresses make it hard to connect the dots. That’s why we’ve updated Threat Intelligence Lookup (TI Lookup) with new wildcards and search operators to give you more control and flexibility when crafting queries. 

Before this update, TI Lookup allowed you to use the basic operators AND along the wildcard *, which work great for flexible searches.  

In December, we’ve expanded this functionality by adding new wildcards and operators to make threat intelligence even more versatile. 

What’s new? 

• OR: The OR operator broadens your search by including results where at least one of the specified conditions is met.  

• NOT: The NOT operator excludes results matching specific conditions, narrowing your search to focus on relevant entries. 
• Parentheses (): They group conditions to ensure your query processes operators in the correct order, enabling precise, complex searches. 
• Question mark (?): Acts as a placeholder for a single character or none, making it perfect for handling variable strings. 
• Dollar sign ($): Ensures your search term appears at the end of a string, useful for pinpointing entries with specific endings. 
• Caret (^): Makes sure your search term appears at the beginning of a string, ideal for narrowing searches to items starting with specific patterns. 

For more details, check out the guide to using wildcards and operators. 

MISP Integration: A New Option for Threat Intelligence Sharing 

We’re excited to share that in December, we introduced our own MISP instance, providing access to Indicators of Compromise (IOCs) from ANY.RUN’s Threat Intelligence Feeds. This new feature brings even greater collaboration and efficiency to threat intelligence sharing. 

MISP (Malware Information Sharing Platform) is a free, open-source tool that streamlines the sharing of threat intelligence, enabling organizations to exchange data, identify compromises, and automate correlations. 

With ANY.RUN’s MISP instance, you can: 

• Access TI Feeds: Get real-time streams of malicious IPs, URLs, domains, ports, file names, and hashes from ANY.RUN’s Interactive Sandbox. The IOCs are pulled from different sources, including network activities and malware configurations. 
• Integrate with security tools: Connect ANY.RUN’s MISP instance to your SIEM, XDR, or other tools via API. 
• Improve threat detection: Enrich your IOCs with ANY.RUN’s data for a clearer understanding of threats. 
• Generate IDS rules: Export attributes in NIDS-compatible formats for use in IDS/IPS or NGFW systems. 

You can test ANY.RUN’s MISP and STIX feeds by getting a free demo sample or contacting us. 

New Teamwork Feature: Multiple Admin Support  

We’re excited to announce a powerful December update to ANY.RUN’s Teamwork feature, designed to simplify team management and improve collaboration for organizations of all sizes. 

Team owners can now assign admin roles to team members, with no limits on the number of admins.  

Admins have the following capabilities: 

• Enable or disable Single Sign-On (SSO) for the team. 
• Invite or remove team members as needed. 
• Manage licenses for team members, including access to features like TI Lookup. 

Besides, admins can assign or revoke admin rights, ensuring flexible and efficient management. 

This update was driven by feedback from our customers, who needed a way to share responsibilities within their teams. Here’s how it can help: 

• Delegation: If a team owner is unavailable (e.g., on vacation), responsibilities can easily be handed over to admins. 
• Time zone flexibility: Large teams operating in different time zones can now have admins based in various regions, improving responsiveness and workflow efficiency. 

How to start using this feature  

Team owners can assign admin roles in the Teamwork section under Licenses. Once set up, admins can immediately start managing the team and sharing responsibilities. 

Threat Coverage Updates

In December, we expanded our detection capabilities, adding 58 new malware signatures, introducing advanced YARA rules, and further improving our machine learning (ML) models to keep up with evolving threats. 

Signatures 

We’ve introduced 58 new signatures targeting a diverse range of malware families. Here are some of them: 

• Omani  
• Kunwoo  
• Ludbaruma  
• Trik  
• Sainbox  
• Expiro  
• Trickbot 
• Vidar 
• Lumma 
• Sonic 
• Pinegrove 
• Dusttrap 

APT Detection Updates 

We’ve enhanced our detection capabilities for several known APT attacks: 

• SimpleHelp, BugSleep, and PortStarter are now comprehensively monitored. 

New YARA Rules 

5 new YARA rules were added this month for more precise detection: 

• Fog Ransom  
• ArechClient2  
• Dusttrap  
• CVE-2024-38213 
• Umbral 

Suricata Rule Updates 

This month, we’ve significantly expanded our Suricata rule collection by adding 5,159 new rules, enhancing our detection accuracy across a variety of threats.  

These updates include focused detections for phishing kits, such as: 

• Gabagool  
• WikiKit  
• LogoKit  

Automated Interactivity Enhancements 

We’ve fine-tuned our automated interactivity clicker, making it smarter. These updates mean it’s now even better at interacting with malware samples, accurately simulating how real users might behave. 

With these improvements, detecting complex threats just got easier. We made sure you get even more reliable results for your investigations. 

About ANY.RUN  

ANY.RUN is a leading provider of a cloud-based malware analysis sandbox for effective threat hunting. Our service lets users safely and quickly analyze malware without the need for on-premises infrastructure. ANY.RUN is used by organizations of all sizes, including Fortune 500 companies, government agencies, and educational institutions.

With ANY.RUN you can: 

• Detect malware in seconds
• Interact with samples in real time
• Save time and money on sandbox setup and maintenance
• Record and study all aspects of malware behavior
• Collaborate with your team 
• Scale as you need

Get a 14-day free trial of ANY.RUN’s Interactive Sandbox →

The post Release Notes: New Search Operators in TI Lookup, MISP Integration, Multi-admin Support  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Overview

Cyberattacks on a country’s critical infrastructure have become a growing malicious trend globally. The surge in cybercrime threats and its growing impact on national security, businesses, and individuals has led experts to closely examine which regions face the most cyberattacks.  

A recent study from the World Cybercrime Index (WCI) compiled by an international team of researchers, shed light on the most targeted countries, ranking them based on the severity of cyberattacks, the skill of the perpetrators, and the professionalism of the cybercriminals involved. 

As of 2024, these countries face the highest levels of cybercrime threats, driven by a complex mix of geopolitical factors, technological infrastructure, and economic conditions. This blog explores the top 10 countries that are most impacted by cyberattacks and why they are at the forefront of the global cybersecurity challenge. 

10. India: A Victim of Cybercrime Amid Rapid Digitalization 

India ranks tenth in the global cybercrime index, experiencing an uptick in cyberattacks due to its rapid digital transformation. The country’s massive online population and growing e-commerce sector make it an appealing target for cybercriminals. Phishing scams, financial fraud, and ransomware attacks are common in India, with both individuals and organizations being affected. The Indian government has been working to bolster cybersecurity, but the increasing maliciousness of cybercriminals presents an ongoing challenge for the country. 

Read also: https://cyble.com/resources/research-reports/india-threat-landscape-report-2024/ 

9. Brazil: A Growing Cybercrime Hotspot in Latin America 

Brazil, the largest economy in Latin America, has witnessed a surge in cyberattacks, particularly those targeting its financial sector and government institutions. Brazil’s growing digital economy has made it an attractive target for cybercriminals involved in fraud, data breaches, and ransomware. The WCI places Brazil ninth, citing its vulnerability to cybercrime despite efforts to improve cybersecurity regulations. Cybercriminal groups operating in Brazil often specialize in online fraud, identity theft, and other forms of financial cybercrime. 

Read also: https://cyble.com/blog/goatrat-android-banking-trojan-variant-targeting-brazilian-banks/ 

8. United Kingdom: A Rising Cyberattack Target 

The United Kingdom faces major cybersecurity threats, ranking eighth on the WCI. As a major financial and technological hub, the UK is often targeted by both cybercriminals and state-sponsored actors. Ransomware attacks and data breaches have been particularly impactful, with high-profile incidents affecting public and private sector organizations. The UK government has increased its efforts to combat cybercrime, but the country remains a target due to its global standing and the increasing digitization of its economy. 

7. North Korea: Cyber Warfare and Financial Theft 

North Korea’s cybercriminal activities are well-documented, with the country’s state-sponsored hackers playing a prominent role in cyberwarfare and financial cybercrime. The regime has been linked to several high-profile cyberattacks, including the infamous WannaCry ransomware attack and attacks on South Korean entities.  

North Korea’s cyber units, such as Lazarus Group, are involved in stealing funds through cybercrime to finance the country’s regime. Their targets are often financial institutions, cryptocurrency exchanges, and government agencies, making North Korea a critical player in the global cybercrime arena. 

6. Romania: A Hotbed for Cybercrime Groups 

Romania is a big player in the global cybercrime ecosystem, ranking sixth on the WCI. The country is home to several notorious cybercriminal groups involved in ransomware attacks, data theft, and financial fraud.  

Romanian hackers are known for their technical expertise and ability to deploy malware across multiple sectors. The Romanian government has made efforts to crack down on cybercrime, but the country remains a hotbed for cyberattacks on countries worldwide, particularly targeting financial institutions and online businesses. 

Read also: https://cyble.com/blog/romania-urges-energy-sector-of-proactive-scanning-amid-lynx-ransomware-threat/ 

5. Nigeria: A Leading Hub for Cybercrime in Africa 

Nigeria has earned a place on the list of the top cyberattack countries due to its increasing involvement in online fraud, scams, and cybercrimes. Known for its widespread involvement in “419” fraud (advance-fee fraud) and cyber scams targeting both individuals and corporations globally, Nigeria’s cybercriminal activities are a growing concern. The country is also home to highly organized cybercrime groups, some of which use cybersecurity tools to launch phishing campaigns and steal sensitive data. The lack of sufficient cybersecurity infrastructure and regulatory enforcement contributes to the persistent cybercrime problem in Nigeria. 

4. United States: A Prime Target and Source of Cyberattacks 

The United States is not only a major source of cyberattacks but also one of the most heavily targeted nations globally. As the world’s largest economy and a hub for technological innovation, the U.S. faces an array of cyberthreats, from cybercriminals seeking financial gain to nation-state actors pursuing espionage objectives. 

The U.S. has witnessed high-profile cyberattacks, including those targeting critical infrastructure, government agencies, and multinational corporations. Ransomware attacks, data breaches, and election interference campaigns are just a few examples of the cybercrimes affecting the U.S., positioning it as one of the countries most impacted by cyberattacks. 

Read also: https://cyble.com/resources/research-reports/us-threat-landscape-report-a-time-of-growing-peril/ 

3. China: A Major Player in Cyber Espionage 

China ranks third in the global cybercrime rankings, largely due to its involvement in large-scale cyber espionage operations. The country has been accused of conducting numerous cyberattacks aimed at stealing intellectual property and accessing sensitive government and corporate data across the globe. 

Chinese cybercriminals are notorious for their high level of technical skill and have been linked to various attack methods, including Advanced Persistent Threats (APT). China’s rapid technological growth and its economic prominence have made it both a source and a victim of cyberattacks, making it one of the top cyberattack countries. 

2. Ukraine: A Geopolitical Hotspot for Cyberattacks 

Ukraine is another country that faces immense cybercrime threats. Since the 2014 annexation of Crimea, Ukraine has been subject to numerous state-sponsored cyberattacks, primarily from Russia. The country has been the target of ransomware attacks and power grid disruptions, making it a prominent example of cyberwarfare in the 21st century. 

The WCI ranks Ukraine second due to its vulnerability to cyberattacks, especially amid ongoing political tensions and military conflicts with Russia. Ukrainian government agencies, critical infrastructure, and businesses have been the focus of cyber attackers.  

Read also: Hackers Target Ukrainian Army with Fake Military Apps to Siphon Authentication and GPS Data 

1. Russia: The Epicenter of Cybercrime 

Russia remains the undisputed leader in terms of cybercriminal activity. Ranked number one on the World Cybercrime Index, Russia has been a hub for various cybercrime types, including state-sponsored attacks, ransomware campaigns, and hacking for espionage purposes.  

The country’s role in cyberattacks on countries globally, particularly targeting political opponents, is well-documented.  

Read also: Russian State Hackers Biggest Cyber Threat to US, UK and EU Elections 

The troubling nature of cybercriminal operations in Russia, coupled with their expertise in developing malware, makes the nation a constant threat to others. 

Conclusion: The Global Fight Against Cybercrime 

As we move into 2025, cyberattacks on countries are increasingly impacting vital sectors like government, finance, and healthcare. Countries such as Russia, Ukraine, China, and the United States are at the forefront of this growing global issue. To combat these threats, governments, organizations, and cybersecurity experts must collaborate to strengthen defenses and proactively monitor cybercriminal activities.  

Cyble, a leader in AI-powered cybersecurity, is playing an important role in this effort. Cyble offers multiple threat intelligence platforms that offer real-time monitoring, which processes vast amounts of dark web data and provides actionable insights. By leveraging AI-driven platforms like Cyble, organizations and government sectors can protect their infrastructure and respond to cyberattacks more effectively, helping to ensure a more secure future. 

References 

• https://www.ox.ac.uk/news/2024-04-10-world-first-cybercrime-index-ranks-countries-cybercrime-threat-level 

• https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0297312 

The post Russia, Ukraine, China, and More: The Nations at the Center of the Cybercrime Epidemic  appeared first on Cyble.

Blog – Cyble – ​Read More