InfoSecBulletin Cybersecurity for mankind
A new version of JSOutProx has been detected by Resecurity. This version is targeting financial services and organizations in the APAC and MENA regions. JSOutProx is a sophisticated attack framework that uses both JavaScript and .NET to carry out its attacks.
The malware allows for the loading of various plugins that carry out additional malicious activities once executed. This malware was first identified in 2019 and was linked to SOLAR SPIDER’s phishing campaigns, distributing the JSOutProx RAT to financial institutions in Africa, the Middle East, South Asia, and Southeast Asia.
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
On February 8, 2024, a system integration company based in Saudi Arabia reported an incident where customers of a major bank in the region were targeted. Resecurity helped victims by obtaining the malicious code and recovering the payload. On April 2, 2024, there was another attack, where banking customers were tricked with fake notifications and malicious code.
The new version of JSOutProx, along with the use of platforms like GitHub and GitLab, shows that malicious actors are working hard and smart. JSOutProx has been a threat for five years and continues to evolve, especially for financial institutions’ customers. This year, the threat has expanded to the MENA region, increasing their cybercriminal activity. Resecurity is committed to tracking JSOutProx and protecting financial institutions and their customers worldwide from these harmful activities. To read out the full report click here.
