Threat Intelligence Report - July 29 - August 4, 2019

Trends

• The top attacker country was China with 1185 unique attackers (23%).
• The top Exploit event was SSH Attack Tool with 99% of occurrences.
• The top Trojan C&C server detected was TrickBot with 50 instances detected.

Top Attacker by Country

Threat Geo-location

Top Attacking Hosts

Top Network Attackers

Top Event NIDS and Exploits

Top Alarms

Comparison from last week 
 

Remote Access Trojan C&C Servers Found

Common Malware

CVE

This is a list of recent vulnerabilities for which exploits are available.

ID: CVE-2019-9848
Title: LibreOffice Remote Code Execution and Unauthorized Access Vulnerabilities
Description: LibreOffice is exposed to a remote code execution vulnerability and unauthorized access vulnerability. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application and gain unauthorized access and perform malicious actions. LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler.
Vendor: LibreOffice
Publish Date: 2019-17-07 Last Update Date: 2019-29-07
CVSS Score    7.5
 
ID: CVE-2019-7839
Title: Adobe ColdFusion Arbitrary Command Injection Vulnerability
Description: ColdFusion vulnerable versions have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Digital Editions is exposed to an unspecified arbitrary command injection vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the application. An attacker could exploit this vulnerability to compromise Confidentiality, Integrity and/or Availability.
Vendor: Adobe
Publish Date: 2019-12-06    Last Update Date: 2019-26-06
CVSS Score    10.0

ID: CVE-2019-1010241
Title: Jenkins Credentials Binding Plugin Information Disclosure Vulnerability
Description: Jenkins Credentials Binding plugin is exposed to an information disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. Jenkins Credentials Binding Plugin is affected for storing passwords in a recoverable format. Authenticated users can recover credentials. 
Vendor: Jenkins
Publish Date: 2019-19-07    Last Update Date: 2019-26-07
CVSS Score    7.2

ID: CVE-2019-1010155
Title: D-Link DSL-2750U Multiple Authentication Bypass Vulnerabilities
Description: D-Link DSL-2750U is exposed to multiple authentication bypass vulnerabilities. An attacker can exploit these issues to bypass authentication mechanism and perform unauthorized actions.
Vendor: Oracle
Publish Date: 2019-23-07    Last Update Date: 2019-24-07
CVSS Score    6.4