The VB Conference is a great place to share your research with the security community. Submit your proposals for papers by 5 April for a chance to be part of one of the longest running security conferences in the world. #'vb2023 https://www.virusbulletin.com/conference/vb2023/call-papers/
🗣virusbtn


🎖@malwr

BlackBerry has posted a report on a new APT-C-36 (also known as Blind Eagle) campaign, where the threat actor impersonated a Colombian government tax agency to target key industries in Colombia. https://blogs.blackberry.com/en/2023/02/blind-eagle-apt-c-36-targets-colombia
🗣virusbtn


🎖@malwr

RIG Exploit Kit (In-Depth Analysis) : https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf (pdf)
🗣binitamshah


🎖@malwr

QiAnXin researchers write about the Kaiji botnet and its connection with the Ares group, which owns multiple botnets and provides rental services for DDoS attacks. https://ti.qianxin.com/blog/articles/Kaiji-Botnet-Resurfaces-Unmasking-Ares-Hacking-Group-EN/
🗣virusbtn


🎖@malwr

Let's create Malware in Python : https://www.youtube.com/watch?v=UtMMjXOlRQc

Ref :

1) https://papers.vx-underground.org/papers/Other/VXUG%20Zines/2022-12-04%20-%20About%20malware%20writing%20and%20how%20to%20start.html

2) Writing a simple wiper malware : https://0x00sec.org/t/python-and-malware-writing-a-simple-wiper-malware/31652
🗣binitamshah


🎖@malwr

Learning Assembly : https://www.youtube.com/playlist?list=PLHJns8WZXCdvESvdr1BRjo4RHiR1Ylhw9 credits @jstrosch (18 video's)
🗣binitamshah


🎖@malwr

Make your iOS kernel exploration on @HexRaysSA's IDA easier using PPLorer
a plugin to resolve PPL calls to the underlying function.
https://github.com/cellebrite-labs/PPLorer
🗣omerporze


🎖@malwr

Frebniis : New Malware Abuses Microsoft IIS Feature to Establish Backdoor : https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/frebniis-malware-iis
🗣binitamshah


🎖@malwr

🐜 CVE-2022-24942 Heap-based buffer overflow in Silicon Labs Gecko SDK (found via automated binary analysis🖥️)
🗣attilaszia

Skimming the discovery section I saw a mention of a taint tracking module, curious about what other high-level concepts the zero-day analysis tool uses (if it's possible for you to share, I get that you have IP to protect).

Are there any e.g. whitepapers about how the system as a whole works? I'm somewhat knowledgeable about fuzzing and various approaches to that (basic coverage-guided mutation stuff, search-based, grammar-based, etc), curious if that general theory is what the dynamic analysis is based on or if there are other types of dynamic analysis I should go read up on.
👤captain_zavec

PRIS looks interesting however I wouldn't be comfortable uploading firmware blobs to the cloud for analysis by PRIS
👤WindyDaysAreWindy

Just read your article about log4j incident really cool. Keep the good work!
👤waitwatidonteven


🎖@malwr