Raj Samani

We’re happy to announce that Metasploit Framework had a big week, landing seven new modules alongside various bug fixes and enhancements

https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-04-17-2026/

#metasploit #vulnerability

Our latest Rapid7 analysis details observed Exploitation of Cisco ASA SSL VPNs, further details including IoCs located here: https://www.rapid7.com/blog/post/2023/08/29/under-siege-rapid7-observed-exploitation-of-cisco-asa-ssl-vpns/

We are hiring! Great opportunity to join the vulnerability and exploit research team. More details here: https://careers.rapid7.com/jobs/lead-security-researcher-united-states #infosec #infosecjobs

We are seeing multiple instances of WS_FTP exploitation in the wild. Further details of this and the vulnerabilities in the advisory, two of which are critical (CVE-2023-40044 and CVE-2023-42657) available in our
Rapid7 advisory: https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/

Our latest analysis details CVE-2023-35082, a new vulnerability that allows unauthenticated attackers to access the API in older unsupported versions of MobileIron Core (11.2 and below). https://www.rapid7.com/blog/post/2023/08/02/cve-2023-35082-mobileiron-core-unauthenticated-api-access-vulnerability/ #infosec #cybersecurity

New Velociraptor artifact now available that "enables scoping EventLogs from Progress Software’s MoveIT File Transfer. It is designed to assist in identifying exfiltration resulting from the exploitation of CVE-2023-34362" https://docs.velociraptor.app/exchange/artifacts/pages/moveitevtx/ #DFIR #Infosec #cybersecurity

Our latest @rapid7@ioc.exchange analysis details Critical CVEs in Outdated Versions of Atlassian Confluence and VMware vCenter Server https://www.rapid7.com/blog/post/2024/01/19/etr-critical-cves-in-outdated-versions-of-atlassian-confluence-and-vmware-vcenter-server/

Our latest Rapid7 Labs publication details an assessment of the hashtag#ransomware landscape detailing the most common threat groups and the common patterns and methodologies observed in the majority of ransomware attacks.: https://www.rapid7.com/blog/post/2024/01/12/2023-ransomware-stats-a-look-back-to-plan-ahead/ #infosec #cybersecurity H/T @ChristiaanB@infosec.exchange

@theomegabit@infosec.exchange nice to meet you. We have a lot of the team here who are posting and also @metasploit@infosec.exchange posts much of our content.

We have now posted our @rapid7@ioc.exchange analysis into CVE-2023-40044, a .NET deserialization vulnerability affecting the Ad Hoc Transfer module of WS_FTP Server. Now available on @AttackerKb https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044/rapid7-analysis

Our latest research analyses a dozen medical infusion pumps available for purchase on the secondary market, and how these were not properly decommissioned before being sold: https://www.rapid7.com/blog/post/2023/08/02/security-implications-improper-deacquisition-medical-infusion-pumps/ #infosec

Further details on CVE-2023-2868: Total Compromise of Physical Barracuda ESG Appliances - note we have identified malicious activity that took place as far back as November 2022: https://www.rapid7.com/blog/post/2023/06/08/etr-cve-2023-2868-total-compromise-of-physical-barracuda-esg-appliances/ #cybersecurity #înfosec

More on the Cisco SD-WAN 0day on the latest Hacktics and Telemetry podcast with @fulmetalpackets@infosec.exchange https://www.youtube.com/watch?v=tg4TkzDIrKw

#infosec #vulnerability

Our latest @rapid7analysis details CVE-2023-47426, a zero-day path traversal vulnerability affecting on-premise SysAid servers. Including IoCs and @velocidex
artifact: https://www.rapid7.com/blog/post/2023/11/09/etr-cve-2023-47246-sysaid-zero-day-vulnerability-exploited-by-lace-tempest/ #infosec

Our latest @rapid7@ioc.exchange advisory details CVE-2023-20198: Active Exploitation of Cisco IOS XE Zero-Day Vulnerability - IoCs and observed attacker behaviour included; https://www.rapid7.com/blog/post/2023/10/17/etr-cve-2023-20198-active-exploitation-of-cisco-ios-xe-zero-day-vulnerability/

Our latest @rapid7@ioc.exchange advisory details CVE-2023-42793: Critical Authentication Bypass in JetBrains TeamCity CI/CD Servers. More details here https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/

Our latest @rapid7@ioc.exchange analysis details a new loader to execute infostealers on compromised systems including StealC and Lumma. More details including IoCs available here https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/?utm_campaign=sm-EA&utm_source=linkedin&utm_medium=organic-social #infosec #malware

Our @metasploit@infosec.exchange weekly wrap up details two new exploit modules leveraging CVE-2023-34960 Chamilo versions 1.11.18 and below and CVE-2023-26469 in Jorani 1.0.0 - more details here: https://www.rapid7.com/blog/post/2023/08/25/metasploit-weekly-wrap-up-24/ #infosec

ICYMI We recently released @velocidex Artifact that "enables scoping EventLogs from Progress Software’s MoveIT File Transfer. It is designed to assist in identifying exfiltration resulting from the exploitation of CVE-2023-34362" https://docs.velociraptor.app/exchange/artifacts/pages/moveitevtx/