Malware News

Introduction to offensive security (guide by @0xTriboulet)

https://steve-s.gitbook.io/0xtriboulet/

#offensivesecurity
🗣0xor0ne

🎖@malwr

479 views17:14

Malware News

This is an absolutely dope mindmap for attacking AD.

https://orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2023_02.svg

Source: https://github.com/Orange-Cyberdefense/ocd-mindmaps
🗣Jhaddix

🎖@malwr

👍2

518 views17:15

Malware News

A Journey of Finding #Vulnerabilities in #Drivers by @omertsarfati of @CyberArk

https://www.cyberark.com/resources/threat-research-blog/inglourious-drivers-a-journey-of-finding-vulnerabilities-in-drivers
🗣SinSinology

🎖@malwr

529 views19:30

Malware News

Frida 16.0.14 is out! 🎉 This one is all about stability improvements on Linux/Android, and brand new ARMv8 BTI interoperability:
https://frida.re/news/2023/04/18/frida-16-0-14-released/
🗣fridadotre

🎖@malwr

Frida • A world-class dynamic instrumentation toolkit

Frida 16.0.14 Released

Observe and reprogram running programs on Windows, macOS, GNU/Linux, iOS, watchOS, tvOS, Android, FreeBSD, and QNX

446 views11:43

Malware News

Here is a ETW based POC to monitor for (some) direct and indirect syscalls. Should find multiple open source implementations trying to avoid userlandhooks.

https://github.com/thefLink/Hunt-Weird-Syscalls
🗣thefLinkk

🎖@malwr

GitHub

GitHub - thefLink/Hunt-Weird-Syscalls: ETW based POC to identify direct and indirect syscalls

ETW based POC to identify direct and indirect syscalls - thefLink/Hunt-Weird-Syscalls

👍1

457 views18:58

Malware News

Hey, FIRSTies! After much dedicated work, the #EthicsSIG has published their #CaseStudies to the FIRST website! Check out the encompassing document here: http://ow.ly/rG2S50NNbJt
🗣FIRSTdotOrg

🎖@malwr

FIRST — Forum of Incident Response and Security Teams

Ethics for Incident Response and Security Teams - Case Studies

427 views19:01

Malware News

c2detect: Search for c2 servers by listener outside https://github.com/michael2to3/c2-search-netlas
🗣_r_netsec

🎖@malwr

535 views19:03

Malware News

ESET researchers have discovered a new Lazarus #OperationDreamJob campaign targeting Linux users. As far as we know, this is the first public mention of this major threat actor using Linux malware as part of this operation. 🐧
https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack/?utm_source=twitter&utm_medium=cpc&utm_campaign=wls&utm_term=lazarus-linux-malware

#ESETresearch #ProgressProtected #Cybersecurity
🗣ESET

🎖@malwr

Welivesecurity

Linux malware strengthens links between Lazarus and the 3CX supply-chain attack

444 viewsedited 11:45

Malware News

I've your interested in the #TradingTechnologies compromise & detections, then follow this thread 🧵

You won't find these IOCs/rules anywhere else

Hashes
https://github.com/Neo23x0/signature-base/blob/977ebf90ef01476f8586fbfd7e433cb93189bfa1/iocs/hash-iocs.txt#L10819

Filenames
https://github.com/Neo23x0/signature-base/blob/977ebf90ef01476f8586fbfd7e433cb93189bfa1/iocs/filename-iocs.txt#L4265

YARA
https://github.com/Neo23x0/signature-base/blob/master/yara/apt_nk_tradingtech_apr23.yar
🗣cyb3rops

🎖@malwr

GitHub

signature-base/iocs/hash-iocs.txt at 977ebf90ef01476f8586fbfd7e433cb93189bfa1 · Neo23x0/signature-base

YARA signature and IOC database for my scanners and tools - Neo23x0/signature-base

👍1

414 views16:22

Malware News

Exploiting System Mechanic Driver https://voidsec.com/exploiting-system-mechanic-driver/ #Pentesting #Exploit #CyberSecurity #Infosec
🗣ptracesecurity

🎖@malwr

456 views16:23

Malware News

dnstop – Monitor and display DNS server traffic on your network https://www.cyberciti.biz/faq/dnstop-monitor-bind-dns-server-dns-network-traffic-from-a-shell-prompt/ #Linux #Unix #FreeBSD
🗣nixcraft

🎖@malwr

391 views10:16

Malware News

EclecticIQ researchers have identified a spear phishing campaign targeting Ukrainian government entities including the Foreign Intelligence Service of Ukraine (SZRU) and Security Service of Ukraine (SSU), likely conducted by APT group Gamaredon. https://blog.eclecticiq.com/exposed-web-panel-reveals-gamaredon-groups-automated-spear-phishing-campaigns
🗣virusbtn

🎖@malwr

379 views11:10

Malware News

VirusTotal's trompi summarises the latest activity of the APT43 group based on the telemetry of its malware toolset, including geographical distribution, lookups, submissions, file types, detection ratios & efficacy of crowd-sourced YARA rules. https://blog.virustotal.com/2023/04/apt43-investigation-into-north-korean.html
🗣virusbtn

🎖@malwr

409 viewsedited 11:11

Malware News

I have finished my write-up on reversing the Cobalt Strike implementations of indirect syscalls. With thanks to @0xDISREL for suggesting I look at it and supplying a beacon and to @DuchyRE for tips about unpacking and structures.

https://github.com/dodo-sec/Malware-Analysis/blob/main/Cobalt%20Strike/Indirect%20Syscalls.md
🗣dodo_sec

🎖@malwr

GitHub

Malware-Analysis/Cobalt Strike/Indirect Syscalls.md at main · dodo-sec/Malware-Analysis

Contribute to dodo-sec/Malware-Analysis development by creating an account on GitHub.

522 views13:24

Malware News

#VMware released a security update to address a vulnerability in Tools. A remote attacker could likely exploit the vulnerability to take control of an affected system. More at http://cisa.gov/news-events/alerts/2023/04/21/vmware-releases-security-update-aria-operations-logs. #Cybersecurity #InfoSec
🗣CISACyber

🎖@malwr

430 views18:44

Malware News