Decryption Digest

CVE Analysis & Threat Intelligence Briefings

In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.

Free daily briefing

Every article here lands in subscribers' inboxes the morning it drops.

Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.

Free. No spam. Unsubscribe anytime.

Category:

4 results tagged nation-state

CVE-2024-20353 & CVE-2024-20359: ArcaneDoor, State-Sponsored Cisco ASA Zero-Days

CVE REFERENCEApril 24, 202412 min

CVE-2024-20353 ArcaneDoor Explained: Cisco ASA Zero-Days

CVE-2024-20353 and CVE-2024-20359 are two Cisco ASA and FTD zero-day vulnerabilities exploited in the ArcaneDoor espionage campaign by a suspected Chinese state-sponsored actor. The flaws enabled persistent backdoor implants (Line Dancer and Line Runner) on perimeter VPN devices protecting government and critical infrastructure networks across multiple countries. First exploitation observed in November 2023, five months before public disclosure.

Eric Bang

Founder & Cybersecurity Evangelist

Read

CVE-2023-22515: Atlassian Confluence Broken Access Control Zero-Day Explained and Fixed

CVE REFERENCEOctober 4, 202310 min

CVE-2023-22515 Confluence BAC: Nation-State Zero-Day

CVE-2023-22515 is a maximum-severity broken access control vulnerability in Atlassian Confluence Data Center and Server. An unauthenticated external attacker can reach Confluence's setup endpoint on a fully configured instance and create a new administrator account, gaining complete control without credentials. Microsoft attributed active exploitation to Storm-0062 (a Chinese state-sponsored threat actor) beginning September 14, 2023, three weeks before Atlassian's advisory.

Eric Bang

Founder & Cybersecurity Evangelist

Read

CVE-2023-36884: Windows Search RCE Used in NATO Summit Attacks

CVE REFERENCEJuly 11, 202311 min

CVE-2023-36884 Explained: Windows Search RCE in NATO Summit

CVE-2023-36884 is a remote code execution vulnerability in Windows Search and Microsoft Office exploited as a zero-day by Russian-nexus group Storm-0978 (RomCom) during the July 2023 NATO summit. Malicious Office documents triggered the flaw without macros or Protected View bypass, targeting NATO member governments. Microsoft disclosed it without a same-day patch, the fix arrived a month later.

Eric Bang

Founder & Cybersecurity Evangelist

Read

CVE-2022-47966 Explained: Zoho ManageEngine Unauthenticated RCE via SAML (CVSS 9.8)

CVE REFERENCEJanuary 10, 202311 min

CVE-2022-47966 Explained: ManageEngine SAML RCE, 24 Products

CVE-2022-47966 is a CVSS 9.8 unauthenticated RCE vulnerability affecting up to 24 Zoho ManageEngine products. It exploits a vulnerable Apache Santuario (XML Security for Java) component in the SAML SSO implementation, allowing an attacker to execute arbitrary code on any ManageEngine server where SAML-based single sign-on is or was enabled. Exploited by APT41 and other nation-state actors within weeks of the January 2023 disclosure. Affects products widely deployed in enterprise IT management: ServiceDesk Plus, Desktop Central, OpManager, and more.