Decryption Digest

CVE Analysis & Threat Intelligence Briefings

In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.

Free daily briefing

Every article here lands in subscribers' inboxes the morning it drops.

Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.

Free. No spam. Unsubscribe anytime.

Category:

2 results tagged LockBit

CVE-2024-1709 Explained: ConnectWise ScreenConnect Authentication Bypass (CVSS 10.0)

CVE REFERENCEFebruary 19, 202411 min

CVE-2024-1709 SlashAndGrab: ScreenConnect Auth Bypass

CVE-2024-1709 is a CVSS 10.0 authentication bypass in ConnectWise ScreenConnect (< 23.9.8). An extra trailing slash in the URL path bypasses authentication middleware, allowing an unauthenticated attacker to execute the setup wizard and create a new administrator account. Exploited by LockBit, Black Basta, and multiple ransomware groups within 48 hours of disclosure. Affects all ScreenConnect on-premises deployments below version 23.9.8.

Eric Bang

Founder & Cybersecurity Evangelist

Read

CVE-2023-4966: Citrix Bleed NetScaler Session Hijacking Explained and Fix

CVE REFERENCEOctober 10, 202310 min

CVE-2023-4966 (Citrix Bleed) Explained: Session Token Theft

CVE-2023-4966, named Citrix Bleed, is a buffer over-read vulnerability in Citrix NetScaler ADC and Gateway that leaks memory contents, including active user session tokens, via unauthenticated HTTP requests. Stolen tokens bypass MFA because they represent already-authenticated sessions. Exploited as a zero-day by LockBit ransomware against Boeing, Comcast Xfinity, and others.