🇸🇦 Saudi Cyber Daily Digest

Cisco SD-WAN Path Traversal Vulnerability — Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow …

Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability — Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, …

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.  T…

Exposing the Undercurrent: Disrupting the GRIDTIDE Global Cyber Espionage Campaign Google Threat Intelligence Group and Mandiant disrupted a global espionage campaign by UNC2814, a suspected Chinese threat actor, targeting telecommunications and government organ…

Advanced persistent threat group targeting Saudi financial institutions with custom banking malware through spear-phishing campaigns impersonating SAMA communications.

Active exploitation of zero-day vulnerability in government web application frameworks. Remote code execution with no authentication required. Patches pending from vendor.

New ransomware variant targeting Saudi oil & gas sector with double extortion techniques, encrypting OT systems and threatening data exposure on dark web leak sites.

Malicious npm packages detected targeting Saudi developers with credential-stealing capabilities embedded in popular dependency names through typosquatting.

Large-scale credential stuffing attacks targeting Saudi e-commerce platforms and loyalty programs using leaked credentials from international breaches.

Multiple exposed S3 buckets and Azure storage accounts found across Saudi organizations, revealing PII, financial records, and internal documents to the public internet.

DNS hijacking attacks redirecting Saudi government and education domains to phishing infrastructure hosted in Eastern Europe.

New IoT botnet variant scanning Saudi smart city infrastructure for default credentials on surveillance cameras and building management systems.