Found 19 bookmarks
Custom sorting
Malvertising Used as Entry Vector for BlackCat Actors Also Leverage SpyBoy Terminator
Malvertising Used as Entry Vector for BlackCat Actors Also Leverage SpyBoy Terminator
We found that malicious actors used malvertising to distribute malware via cloned webpages of legitimate organizations. The distribution involved a webpage of the well-known application WinSCP, an open-source Windows application for file transfer. We were able to identify that this activity led to a BlackCat (aka ALPHV) infection, and actors also used SpyBoy, a terminator that tampers with protection provided by agents.
#trendmicro#EN#2023#malware#endpoints#BlackCat#WinSCP#report#SpyBoy#GoogleAds
·trendmicro.com·
Malvertising Used as Entry Vector for BlackCat Actors Also Leverage SpyBoy Terminator
MAR-10400779-1.v1 – Zimbra 1
MAR-10400779-1.v1 – Zimbra 1
CISA received seven files for analysis. Six Java Server Pages (JSP) webshells and a Bourne Again SHell (bash) file. Five JSP webshell files are designed to parse inbound requests for commands for execution, download files, and upload files. One JSP webshell file contains a form with input fields that prompts the attacker to enter the command in the input box and click "run" to execute. The command output will be displayed in a JSP page. The bash file is designed to perform ldapsearch queries and store the output into a newly created directory.
#uscert#csirt#cert#EN#2022#Malware#Analysis#Report#AR22-270A#Zimbra
·cisa.gov·
MAR-10400779-1.v1 – Zimbra 1
SysJoker analyzing the first (macOS) malware of 2022!
SysJoker analyzing the first (macOS) malware of 2022!
Earlier today (January 11th), Researchers at Intezer published an report titled, “New SysJoker Backdoor Targets Windows, Linux, and macOS.” In this report, they detailed a new cross-platform backdoor they named SysJoker. Though initially discovered on Linux, the Intezer researchers shortly thereafter also found both Windows and Mac versions: "SysJoker was first discovered during an active attack on a Linux-based web server of a leading educational institution. After further investigation, we found that SysJoker also has Mach-O and Windows PE versions." -Intezer
#SysJoker#macos#malware#EN#objectivesee#report#analysis
·objective-see.com·
SysJoker analyzing the first (macOS) malware of 2022!
MAR-10400779-1.v1 – Zimbra 1
MAR-10400779-1.v1 – Zimbra 1
CISA received seven files for analysis. Six Java Server Pages (JSP) webshells and a Bourne Again SHell (bash) file. Five JSP webshell files are designed to parse inbound requests for commands for execution, download files, and upload files. One JSP webshell file contains a form with input fields that prompts the attacker to enter the command in the input box and click "run" to execute. The command output will be displayed in a JSP page. The bash file is designed to perform ldapsearch queries and store the output into a newly created directory.
#uscert#csirt#cert#EN#2022#Malware#Analysis#Report#AR22-270A#Zimbra
·cisa.gov·
MAR-10400779-1.v1 – Zimbra 1
SysJoker analyzing the first (macOS) malware of 2022!
SysJoker analyzing the first (macOS) malware of 2022!
Earlier today (January 11th), Researchers at Intezer published an report titled, “New SysJoker Backdoor Targets Windows, Linux, and macOS.” In this report, they detailed a new cross-platform backdoor they named SysJoker. Though initially discovered on Linux, the Intezer researchers shortly thereafter also found both Windows and Mac versions: *"SysJoker was first discovered during an active attack on a Linux-based web server of a leading educational institution. After further investigation, we found that SysJoker also has Mach-O and Windows PE versions." -Intezer*
#SysJoker#macos#malware#EN#objectivesee#report#analysis
·objective-see.com·
SysJoker analyzing the first (macOS) malware of 2022!
SysJoker analyzing the first (macOS) malware of 2022!
SysJoker analyzing the first (macOS) malware of 2022!
Earlier today (January 11th), Researchers at Intezer published an report titled, “New SysJoker Backdoor Targets Windows, Linux, and macOS.” In this report, they detailed a new cross-platform backdoor they named SysJoker. Though initially discovered on Linux, the Intezer researchers shortly thereafter also found both Windows and Mac versions: *"SysJoker was first discovered during an active attack on a Linux-based web server of a leading educational institution. After further investigation, we found that SysJoker also has Mach-O and Windows PE versions." -Intezer*
#SysJoker#macos#malware#EN#objectivesee#report#analysis
·objective-see.com·
SysJoker analyzing the first (macOS) malware of 2022!