Security Affairs Malware Newsletter Round 120: GhostAction, ArgonWiper, LiteLLM, OVHcloud CLI and Lazarus Operation FlashHole
This weekly Security Affairs newsletter lists recent malware research and reporting. It contains headlines only, with no technical detail. Topics include the GhostAction attack escalating against GitHub users, Plex vulnerabilities exploited in the wild to drop a cryptominer, and a backdoor in Rank Math SEO PRO plugin 3.0.123 for WordPress. It also covers the ROMULUS multi-payload ClickFix delivery platform, five hijacked OVHcloud CLI releases distributing secret-stealing malware, and Pegasus and mercenary spyware attacks on Serbian pro-democracy figures. Further items are an analysis of the ArgonWiper encryption workflow, a supply chain compromise of LiteLLM delivering a credential stealer and backdoor, and Lazarus's Operation FlashHole. The remaining entries are academic papers on malware detection and generation.
Detalhes técnicos
- Software supply chain compromises are a recurring theme: LiteLLM, the OVHcloud CLI releases and GhostAction against GitHub users.
- ROMULUS is described as a multi-payload ClickFix delivery platform.
- ArgonWiper is a wiper whose encryption workflow leaves backups behind.
- The article gives no IOCs, CVEs or version details beyond Rank Math SEO PRO 3.0.123.
Linha do tempo
-
Security Affairs Malware Newsletter Round 120: GhostAction, ArgonWiper, LiteLLM, OVHcloud CLI and Lazarus Operation FlashHole
ler a análise desta fonte ocultar
This weekly Security Affairs newsletter lists recent malware research and reporting. It contains headlines only, with no technical detail. Topics include the GhostAction attack escalating against GitHub users, Plex vulnerabilities exploited in the wild to drop a cryptominer, and a backdoor in Rank Math SEO PRO plugin 3.0.123 for WordPress. It also covers the ROMULUS multi-payload ClickFix delivery platform, five hijacked OVHcloud CLI releases distributing secret-stealing malware, and Pegasus and mercenary spyware attacks on Serbian pro-democracy figures. Further items are an analysis of the ArgonWiper encryption workflow, a supply chain compromise of LiteLLM delivering a credential stealer and backdoor, and Lazarus's Operation FlashHole. The remaining entries are academic papers on malware detection and generation.
Technical Details
- Software supply chain compromises are a recurring theme: LiteLLM, the OVHcloud CLI releases and GhostAction against GitHub users.
- ROMULUS is described as a multi-payload ClickFix delivery platform.
- ArgonWiper is a wiper whose encryption workflow leaves backups behind.
- The article gives no IOCs, CVEs or version details beyond Rank Math SEO PRO 3.0.123.