Malware

Updated DreamBus malware targets RocketMQ vulnerability BleepingComputer reports that ongoing attacks involving a new DreamBus botnet malware version have been targeting RocketMQ servers vulnerable to the critical remote code execution flaw, tracked as CVE-2023-33246, since June.

Eighty percent of all cyberattacks against networks and computers during the first seven months of 2023 have been brought upon by the QBot, SocGholish, and Raspberry Robin malware loaders, according to The Register.

Internet of things devices have been subjected to attacks with a new version of the KmsdBot botnet malware, which has been enhanced with Telnet scanning and more extensive CPU architecture support, reports The Hacker News.

SecurityWeek reports that Rust package registry Crates.io has been targeted by an attempted malware attack involving typosquatted packages that has been averted with the immediate identification and removal of the malicious packages.

BleepingComputer reports that attacks with the Smoke Loader botnet have been observed to deploy the novel Whiffy Recon malware, which leverages Wi-Fi scanning and Google's geolocation API to determine where compromised devices are located.

Overall cyberattack median dwell times have declined from 10 days in 2022 to eight days in the first half of 2023, BleepingComputer reports.

Cisco Talos reports that the Lazarus Group leverages the ManageEngine ServiceDesk vulnerability to target a midsized internet backbone provider in the UK and multiple health care entities in the United States.