![case study thumbnail](https://a-us.storyblok.com/f/1004411/4368x2448/0e270ed517/breachforums-bounces-back.jpeg)
Lead Article
According to Cybersixgill’s data, 583 ransomware results were detected on our Investigative Platform in May, in comparison with 252 results in April. The ransomware gang LockBit were responsible for the highest number of ransomware attacks this month. The top targeted industries were Manufacturing, Professional Scientific Services, IT and Health Care. The United States, Canada, UK and Germany were the top targeted countries.
1.
The current DVE score is 10. Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code.
CVSS: 10
DVE: 10
2.
The current DVE score is 10. A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
CVSS: 10
DVE: 10
3.
The DVE score is 9.97. An out-ofbounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests.
CVSS: 9.8
DVE: 9.97
The most mentioned malware for May 2024
In May, Redline stealer malware had the highest number of mentions on the underground according to the Cybersixgill Investigative Portal.
This malware harvests information from browsers such as saved credentials and credit card information. More recent versions of the malware added the ability to steal cryptocurrency.
RedLine Stealer is a Malware-as-a-Service (MaaS), so threat actors can purchase it, then sell the stolen data on dark web forums.