Text4Shell (CVE-2022-42889) is a critical remote code execution vulnerability in Apache Commons Text (versions 1.5–1.9) that can be triggered by crafted input strings to run code on vulnerable hosts. The advisory covers exploitation methods, potential post-exp…
CrowdStrike tracks a new cryptojacking campaign, Kiss-a-dog, targeting vulnerable Docker and Kubernetes infrastructure with an obscured domain, container escape, and anonymous mining pools. The operation uses multiple C2 servers, user- and kernel-mode rootkits…
Unit 42 researchers analyzed a Guloader variant with an anti-analysis shellcode payload and provided a Python script to deobfuscate the sample, enabling faster malware analysis. The article details how the malware uses control flow obfuscation, a vectored exce…
The article analyzes F-Automatical (FoxAuto) as Anonymous Fox’s seventh version of an automatic C2 script that runs post-exploitation tasks on compromised web servers. It covers how the script can persist, fetch remote modules, target multiple CMS, obfuscate i…
CLDAP reflectors are rising as a multi-vector DDoS mechanism, leveraging UDP reflection to amplify traffic and complicate mitigation. Black Lotus Labs tracks open CLDAP reflectors, analyzes their behavior, and provides guidance on reducing exposure and blockin…
Brad Duncan surveys VNC-based malware activity over the years, tracing how what’s been labeled DarkVNC/HiddenVNC has evolved into broader malicious VNC use across multiple families and campaigns. The post concludes that the “Dark” label isn’t fixed, documentin…
An intrusion in early June 2022 leveraged the Follina CVE-2022-30190 vulnerability embedded in a malicious Word document to install Qbot (Qakbot/Pinksliplot) and pivot through the network toward a domain compromise. Attackers used Cobalt Strike, NetSupport Man…
Venus ransomware targets publicly exposed Remote Desktop services to encrypt Windows devices, abusing insecure RDP access to spread. Infections result in files ending with the .venus extension and a ransom note demanding payment. #VenusRansomware #RemoteDeskto…
The Lazarus threat actor exploited a watering hole to infiltrate target systems and then leveraged a vulnerability in MagicLine4NX to reach internal networks. They used BYOVD and a rootkit to disable anti-malware, then established internal access via RDP and S…
QAKBOT is observed using valid code signing certificates to sign malicious modules, enabling trusted-looking infections. The article reviews infection timelines, potential origins of abused certificates, and recommended countermeasures. #QAKBOT #Follina
Trustwave SpiderLabs details a threat campaign that uses password-protected archives with nested self-extracting RARsfx to deliver malware, predominantly via Emotet botnet spam. The payloads include CoinMiner and QuasarRAT, with adversaries employing obfuscati…
Microsoft’s analysis shows Raspberry Robin as part of a broader, interconnected malware ecosystem that enables pre-ransomware activity across thousands of devices, linking USB-driven infections to follow-on hands-on-keyboard attacks and ransomware deployments.…
AgentTesla is being distributed through malicious VBScript (VBS) attached to emails, with the VBS payload obfuscated and decoded to eventually execute PowerShell and inject AgentTesla into a legitimate process. The campaign shows evolving delivery methods—from…
360Netlab documents the return of the Fodcha DDoS botnet, detailing a renewed version with a dual OpenNIC/ICANN C2 and strong encryption to evade detection, plus large-scale DDoS operations that exceeded tens of thousands of bots and terabit traffic. The post …
FortiGuard Labs analyzed a phishing campaign that impersonates the Hungarian government to deliver the Warzone RAT through a disguised PDF-like executable. The campaign stacks multiple obfuscated .NET binaries in memory, uses MaaS-style malware, and employs ev…