The 8220 Gang, a Chinese-based threat actor, targeted cloud-based infrastructure across Windows and Linux in a May 2023–February 2024 campaign, exploiting known vulnerabilities CVE-2021-44228 and CVE-2022-26134. They employed multi-stage cryptomining operation…
10. can I speak to your manager? hacking root EPP servers to take control of zones In tenth place, we have a beautiful insight into some overlooked and incredibly valuable attack-surface. In can I speak to your manager? hacking root EPP servers to take control of zones, Sam Curry, Brett Buerhau…
APIs (Application Programming Interfaces) have become integral components of modern software systems, facilitating communication and interaction between various applications and services. However, they also represent a significant attack surface, susceptible to a variety of malicious activities. Thi…
iPurpleTeam, has developed the following framework considering various components that are required to safeguard that rules will be developed in an threat aligned and reliable manner. https://github.com/netbiosX/iPurpleTeam/blob/main/Detection-Engineering/Detection-Rules-Development-Framework.md Rul…
This is a series that explores methods attackers might use to maintain persistent access to a compromised linux system. To do this, Pberba will take an “offense informs defense” approach by going through techniques listed in the MITRE ATT&CK Matrix for Linux. Pberba will try to: Give examples of…
Australian telecommunications provider Tangerine disclosed a data breach that impacted roughly 230,000 individuals. Tangerine suffered a data breach that exposed the personal information of roughly 230,000 individuals. The security breach occurred on Sunday 18 February 2024, but Tangerine management became aware of the incident on Tuesday 20 February 2024. The telco notified the Australian Cyber Security […]
Researchers describe a KONNI variant delivered through a backdoored Russian-language installer for a MID consular tool called Statistika KZU, highlighting DPRK-linked activity targeting the Russian Ministry of Foreign Affairs. The backdoored installer contains…
Malware masquerading as legitimate security installers was observed on a domestic construction association’s login portal, where users are prompted to install security software and may inadvertently download malicious payloads. The delivered malware includes T…
Multiple attacks exploit vulnerabilities in an IT remote access tool to deliver a variety of different payloads into business environments
Darktrace observed opportunistic use of the open-source Quasar remote administration tool in late 2023, where attackers used DLL sideloading, encrypted SSL C2 on non-standard ports, and shared infrastructure to evade traditional detections. Anomaly-based detec…
We are connected to the digital world that provides us with numerous utilities and entertainment, but sometimes it presents us with undesirable encounters. Online frauds and scams are examples of such encounters. Online scams are not simply at the level of disrupting individuals’ daily lives like mass-marketed commercial spam emails. Scamming…
Dynamic-link library (DLL) hijacking remains a popular technique to run malware. We address its evolution using examples from the realm of cybercrime and more.
The post Intruders in the Library: Exploring DLL Hijacking appeared first on Unit 42….
Malware samples increasingly use anti-sandbox checks to determine whether they run on a real machine, such as querying hardware with WMI for a connected mouse. If the check fails, the sample downloads a minimal Python environment and a second-stage InfoStealer…
An in-depth look at a PyRation-family malware variant analyzed by StratosphereIPS, focusing on a Windows Python-based client–bot architecture and capabilities such as screen capture, keylogging, AV detection, anonymous browsing, and remote command execution. T…
SonicWall Capture Labs Threat Research Team became aware of the ClamAV VirusEvent command injection vulnerability (CVE-2024-20328), assessed its impact, and developed mitigation measures for the vulnerability. ClamAV is a notable, open-source anti-virus engine, widely recognized […]