FortiGuard Labs recently captured an MS Office Word document in the wild that was spreading a variant of QBot. Learn more about this.…

In part two of the analysis of a recently discovered QBot campaign, discover how the core module collects data from a victim’s device, how it extracts submodules, how it injects its injection-modul…

A new macOS ransomware threat uses a custom file encryption routine not based on public key encryption. Jason Reaves shows how we broke it.

In my last article on Chinoxy backdoor, this version has its configuration in a resource called NNKK and it is deciphered. The purpose of…

M00nD3V is a multifunctional information-stealing trojan that has gained popularity on hacker forums.

BazarBackdoor is a module of the dreaded TrickBot Trojan. It is mostly used to gain a foothold in compromised enterprise networks.

We discovered a new Mirai variant that exploits nine vulnerabilities, most notable of which is CVE-2020-10173 in Comtrend VR-3033 routers which we have not observed exploited by past Mirai variants.

Moobot is a mirai based botnet. Spread through weak telnet passwords and some nday and 0day  vulnerabilities.

Overview


On June 17, 2020, 360Netlab Threat Detecting System flagged an interesting ELF sample (dd7c9d99d8f7b9975c29c803abdf1c33), further analysis shows that this is a DDos Bot program that propagates through the CVE-2020-8515 vulnerability which targets…

ESET research gives a detailed picture of the operations of Evilnum and its toolkit used in attacks against carefully chosen targets in the fintech sector.

Impacket is a collection of Python scripts that can be used by an attacker to target Windows network protocols. This tool can be used to enumerate users, capture hashes, move laterally and escalate privileges. Impacket has also been used by APT groups, in…

This is a list of security tools that I have used or recommend. Welcome any contributions! - tina1998612/Awesome-Security-Tool-List

Shared with Dropbox

In June, LIFARS team worked on engagement related to FIN6 threat actor. FIN6 group was also detected and described in April and May, by various other forensics firms, including SentinelOne and FireEye Managed Defense (Mandiant), which described intrusion…

<p>Summary In the last 3 months, we have noticed increased activity from APT36, a Pakistan-linked Cyber Threat actor. The target this time are personnel belonging to defence organizations & other Government organizations in India. In the recent wave of attacks…

Dont rely on AntiVirus (AV) as your security conrnerstone. Bypassing AV (Windows Defender) is still as trivial as ever ... Part II.

This is the final part or our in-depth malware reverse engineering series analyzing an IRC worm from 2010. In this part we perform a final high level analysis of the malware then then use our analysis to build a sinkhole for the botnet!

-----
OALABS DISCORD…

Files created on external storage, such as SD Cards, are globally readable and writable. Because external storage can be removed by the user and also modified by any application, you should not store sensitive information using external storage.
As with data…

I indexed all Windows files which appear in Windows update packages, and created a website which allows to quickly view information about the files and download some of them from Microsoft servers. The files that can be downloaded are executable files (currently…