Tag
DarkSword iOS Exploit Used in Infostealer Attack
2 rules 3 TTPsA new exploit dubbed 'DarkSword' is being actively exploited in infostealer campaigns targeting iPhones, potentially leading to unauthorized data access and device compromise.
DarkSword iOS Exploit Chain Proliferation
1 rule 2 TTPsThe DarkSword exploit chain targets iOS versions 18 and under by exploiting a WebKit vulnerability, and is being adopted by multiple threat actors for initial access and execution.
Fortigate VPN CVE-2023-27997 Exploitation Attempt
2 rules 1 TTP 1 IOCIDS alerts indicate a potential exploitation attempt against a Fortigate VPN server using CVE-2023-27997, characterized by repeated GET requests to the /remote/logincheck endpoint originating from a specific IPv6 address.
Fortigate VPN Exploit Attempt via CVE-2023-27997 and Suspicious User-Agent
3 rules 2 TTPs 3 IOCsMultiple IDS alerts indicate potential exploitation attempts against Fortigate VPN servers using CVE-2023-27997, alongside traffic from a suspicious user agent, possibly indicating reconnaissance or exploit activity.