Achieve execution using a custom keyboard layout. Contribute to NtQuerySystemInformation/CustomKeyboardLayoutPersistence development by creating an account on GitHub.

背景


自从Log4J漏洞被曝光后，正所谓"忽如一夜漏洞来，大黑小灰笑开怀”。无数黑产团伙摩拳擦掌加入了这个“狂欢派对”，其中既有许多业界非常熟悉的恶意软件家族，同时也有一些新兴势力想趁着这股东风在黑灰产上分一杯羹。360Netlab作为专注于蜜罐和Botnet检测跟踪的团队，我们自该漏洞被公开后就一直关注它会被哪些僵尸网络利用，期间我们看到了Elknot，Gafgyt，Mirai等老朋友的从不缺席，也见证了一些新朋友的粉墨登场。


2022年2月9日，360Netlab的蜜罐系统捕获了一个未知的E…

Cyble Research Lab's analyzes Pandora Ransomware and the possibility that it may be a re-brand of Rook Ransomware.

Background


Since the Log4J vulnerability was exposed, we see more and more malware jumped on the wagon, Elknot, Gafgyt, Mirai are all too familiar, on February 9, 2022, 360Netlab's honeypot system captured an unknown ELF file propagating through the Log4J…

Learn how CrowdStrike discovered a new vulnerability in the CRI-O Container Engine (CVE-2022-0811), and what organizations can do to remediate this vulnerability.

New malicious activity targets organizations with fake Ukrainian translation software to drop GrimPlant and GraphSteel malware.

Gh0stCringe RAT Being Distributed to Vulnerable Database Servers ASEC

DirtyMoe's Rapid Worming Expansion

The Microsoft Defender for IoT research team has recently discovered the exact method through which MikroTik devices are used in Trickbot’s C2 infrastructure. In this blog, we share the analysis of this method and provide insights on how attackers gain access…

The ASEC analysis team has discovered a word document that is in the same category as the document introduced in the post <Word File Disguised as a Design Modification Request for Information Theft>, uploaded in December last year. The title of the document…

Threat Analysis Group (TAG) observed a financially motivated threat actor we refer to as EXOTIC LILY, exploiting a 0day in Microsoft MSHTML (CVE-2021-40444). Investigating this group's activity, we determined they are an Initial Access Broker (IAB) who appear…

Cyble Research Labs recently came across a ransomware sample allegedly targeting Russia and sending out a message to stop the war.

The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from March 7th, 2022 (Monday) to March 13th, 2022 (Sunday). For the main category, info-stealer…

Introduction to MikroTik Vulnerabilities

As war in Ukraine rages, new destructive malware continues to be discovered. In this short blog post, we will review IsaacWiper and CaddyWiper, two new wipers that do not have much in common based on…

In December 2021, we observed an adversary exploiting the Microsoft Exchange ProxyShell vulnerabilities to gain initial access and execute code via multiple web shells. The overlap of activities an…

BitRAT Disguised as Windows Product Key Verification Tool Being Distributed ASEC

Key Findings Proofpoint identified a targeted attack leveraging an open-source package installer Chocolatey to deliver a backdoor. The attack targeted French entities in the construction,

FlawedGrace is a RAT that recognizes incoming commands from a C2 server sent via a binary protocol through port 443.

* BlackCat is a recent and growing ransomware-as-a-service (RaaS) group that targeted several organizations worldwide over the past few months.
* There are rumors of a relationship between BlackCat and the BlackMatter/DarkSide ransomware groups, infamous…