Found 581 bookmarks
Custom sorting
Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild
Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild
Introduction Rootkits are dangerous pieces of malware. Once in place, they are usually really hard to detect. Their code is typically more challenging to write than other malware, so developers resort to code reuse from open source projects. As rootkits are very interesting to analyze, we are always looking out for these kinds of samples […]
#avast#EN#2022#Rootkit#Linux#Syslogk#malware#Adore-Ng
·decoded.avast.io·
Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild
Raccoon Stealer: “Trash panda” abuses Telegram
Raccoon Stealer: “Trash panda” abuses Telegram
We recently came across a stealer, called Raccoon Stealer, a name given to it by its author. Raccoon Stealer uses the Telegram infrastructure to store and update actual C&C addresses.  Raccoon Stealer is a password stealer capable of stealing not just passwords, but various types of data, including: Cookies, saved logins and forms data from […]
#avast#stealer#EN#2022#RaccoonStealer#Telegram#research#malware#passwordstealer
·decoded.avast.io·
Raccoon Stealer: “Trash panda” abuses Telegram
Malware now using stolen NVIDIA code signing certificates
Malware now using stolen NVIDIA code signing certificates
Threat actors are using stolen NVIDIA code signing certificates to sign malware to appear trustworthy and allow malicious drivers to be loaded in Windows. This week, NVIDIA confirmed that they suffered a cyberattack that allowed threat actors to steal employee credentials and proprietary data.
#bleepingcomputer#Nvidia#certificates#malware#EN#2022#code#signing
·bleepingcomputer.com·
Malware now using stolen NVIDIA code signing certificates
Destructive Malware Targeting Organizations in Ukraine
Destructive Malware Targeting Organizations in Ukraine
Actions to Take Today: • Set antivirus and antimalware programs to conduct regular scans. • Enable strong spam filters to prevent phishing emails from reaching end users. • Filter network traffic. • Update software. • Require multifactor authentication. Leading up to Russia’s unprovoked attack against Ukraine, threat actors deployed destructive malware against organizations in Ukraine to destroy computer systems and render them inoperable. 
#uscert#csirt#cert#CISA#EN#2022#alert#WhisperGate#HermeticWiper#malware
·cisa.gov·
Destructive Malware Targeting Organizations in Ukraine
DarkGate malware delivered via Microsoft Teams - detection and response
DarkGate malware delivered via Microsoft Teams - detection and response
While most end users are well-acquainted with the dangers of traditional phishing attacks, such as those delivered via email or other media, a large proportion are likely unaware that Microsoft Teams chats could be a phishing vector. Most Teams activity is intra-organizational, but Microsoft enables External Access by default, which allows members of one organization to add users outside the organization to their Teams chats. Perhaps predictably, this feature has provided malicious actors a new avenue by which to exploit untrained or unaware users.
#cybersecurity.att.com#EN#2024#Microsoft#Teams#phishing#malware
·cybersecurity.att.com·
DarkGate malware delivered via Microsoft Teams - detection and response
Malicious PyPI Packages Slip WhiteSnake InfoStealer Malware onto Windows Machines
Malicious PyPI Packages Slip WhiteSnake InfoStealer Malware onto Windows Machines
Malicious code hiding in seemingly innocent PyPI packages steals your passwords, crypto & more #attacks #breach #computer #cyber #data #hack #hacker #hacking #how #information #malware #network #news #ransomware #security #software #the #to #today #updates #vulnerability
#hacking#attacks#information#network#data#to#updates#malware#cyber#today#news#ransomware#breach#security#software#hack#the#hacker#how#computer#vulnerability
·thehackernews.com·
Malicious PyPI Packages Slip WhiteSnake InfoStealer Malware onto Windows Machines
iShutdown scripts can help detect iOS spyware on your iPhone
iShutdown scripts can help detect iOS spyware on your iPhone
Security researchers found that infections with high-profile spyware Pegasus, Reign, and Predator could be discovered on compromised Apple mobile devices by checking Shutdown.log, a system log file that stores reboot events. #Apple #Computer #InfoSec #Logging #Malware #Pegasus #Security #Spyware #iOS #iPhone
#Spyware#iPhone#Malware#Security#Apple#iOS#Pegasus#InfoSec#Logging#Computer
·bleepingcomputer.com·
iShutdown scripts can help detect iOS spyware on your iPhone
Analyzing DPRK's SpectralBlur
Analyzing DPRK's SpectralBlur
In both his twitter (err, X) thread and in a subsequent posting he provided a comprehensive background and triage of the malware dubbed SpectralBlur. In terms of its capabilities he noted: SpectralBlur is a moderately capable backdoor, that can upload/download files, run a shell, update its configuration, delete files, hibernate or sleep, based on commands issued from the C2. -Greg He also pointed out similarities to/overlaps with the DPRK malware known as KandyKorn (that we covered in our “Mac Malware of 2024” report), while also pointing out there was differences, leading him to conclude: We can see some similarities ... to the KandyKorn. But these feel like families developed by different folks with the same sort of requirements. -Greg
#objective-see#EN#2024#Analysis#macOS#backdoor#SpectralBlur#malware
·objective-see.org·
Analyzing DPRK's SpectralBlur