Time Travel Debugging IDA plugin, ttddbg, 1.1.0 is out with new tracing feature ! Based on #IDA database, arguments and return value are pretty-printed !

Enjoy ✈️🛰️🚁

https://github.com/airbus-cert/ttddbg
🗣citronneur


🎖@malwr

Bypassing PowerShell Strong Obfuscation https://i5c.us/d29692
🗣sans_isc


🎖@malwr

📣 Exciting news for all JADX users! 🚀

I've just released an official video guide on how to use my new latest Dynamic Scripting Plugin, JADXecute!

#ReverseEngineering #AndroidDev

https://www.youtube.com/watch?v=g0r3C1iEeBg
🗣lauriewired


🎖@malwr

I made a writeup on #Magniber #ransomware (from 2022) demonstrating the capabilities of the latest #TinyTracer: https://hshrzd.wordpress.com/2023/03/30/magniber-ransomware-analysis/
🗣hasherezade


🎖@malwr

Walk through an incident where initial access was obtained through exploitation of CVE-2023-0669 (Go AnyWhere MFT) a day after the release of the vuln and 4 days before a patch was released. Also, I have some thoughts on vuln adoption by criminals.

https://securityintelligence.com/posts/x-force-prevents-zero-day-from-going-anywhere/
🗣TactiKoolSec


🎖@malwr

Supply chain attack in 3CX Windows Electron DesktopApp
🗣qwerty0x41

It should also be noted that the MacOS version was also trojaned. If you have installed 3CXDesktopApp-18.12.416.dmg (SHA1 3DC840D32CE86CEBF657B17CEF62814646BA8E98), you have a trojaned version.

Since it had only one C2 domain hard coded and that is offline, the malware is dormant.

Still, burn it with fire.
👤CrimsonNorseman

Some IOCs posted by a user on the 3CX forum: ~~https://www.3cx.com/community/threads/3cx-icos.119967/#post-559156~~

EDIT: thread was removed, refer to https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/#heading-5 for what seems to be up to date IOCs
👤qwerty0x41

Supply chain? So what dependency was compromised/exploited? Electron itself or a node.js library?
👤iliark


🎖@malwr

Bypassing DEP with gap restrictions
🗣CarelessOne7933

Like it is a new technique... It's basically what everyone is doing since ever to prevent shellcode corruption
👤Void_Sec


🎖@malwr

Our team from @Unit42_Intel released a blog related to 3CXDesktopApp supply chain attack. Enjoy!

https://unit42.paloaltonetworks.com/3cxdesktopapp-supply-chain-attack/

#dfir #supplychainattack #Unit42
🗣r3nzsec


🎖@malwr

#sslpinning #frida #mitm #android
New video up on YouTube showcasing the concepts of SSL pinning and how to bypass different types of SSL pinning in android.
@fridadotre @mobilesecurity_

https://youtu.be/iooYH0S2Y3o
🗣SecFatal


🎖@malwr

https://github.com/ggerganov/kbd-audio

this tool lets you extract text from an audio recording of keyboard strokes, right now, for free

i am not making this shit up, you can potentially steal a password from an audio recording in an office
🗣f4micom


🎖@malwr

🔍If you are looking for a comprehensive overview of the current #3CX supply chain attack, I created a diagram that shows the attack flow!💥I'll update as soon as the analysis progresses. Stay tuned for the MacOS edition! #cybersecurity #infosec #supplychainattack #3CXpocalypse
🗣fr0gger_


🎖@malwr

Proofpoint researchers have observed recent espionage-related activity by TA473 (Winter Vivern). TA473 has continuously leveraged an unpatched Zimbra vulnerability to target webmail portals of NATO-aligned governments in Europe. https://www.proofpoint.com/us/blog/threat-insight/exploitation-dish-best-served-cold-winter-vivern-uses-known-zimbra-vulnerability
🗣virusbtn


🎖@malwr

Fortinet researchers have observed several attack bursts targeting Cacti & Realtek vulnerabilities, spreading ShellBot & Moobot malware. In an article they examine the payloads of these two attacks and the resulting malware behaviour. https://www.fortinet.com/blog/threat-research/moobot-strikes-again-targeting-cacti-and-realtek-vulnerabilities
🗣virusbtn


🎖@malwr

Multiple security vendors have released articles sharing information about an ongoing campaign that trojanizes the #3CX DesktopApp in a supply chain attack:
https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
https://www.trendmicro.com/en_us/research/23/c/information-on-attacks-involving-3cx-desktop-app.html
https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/
🗣virusbtn

Continue...👇

🎖@malwr