Vulnerabilities in CDeX software

CERT Poland has received a report about three vulnerabilities (from CVE-2024-2463 to CVE-2024-2465) found in CDeX software.

https://cert.pl/en/posts/2024/03/CVE-2024-2463/


🎖@malwr

Rescoms rides waves of AceCryptor spam

Insight into ESET telemetry statistics about AceCryptor in H2 2023 with a focus on Rescoms campaigns in European countries

https://www.welivesecurity.com/en/eset-research/rescoms-rides-waves-acecryptor-spam/


🎖@malwr

Agenda Ransomware Propagates to vCenters and ESXi via Custom PowerShell Script

This blog entry discusses the Agenda ransomware group's use of its latest Rust variant to propagate to VMWare vCenter and ESXi servers.

https://www.trendmicro.com/en_us/research/24/c/agenda-ransomware-propagates-to-vcenters-and-esxi-via-custom-pow.html


🎖@malwr

Borrower beware: Common loan scams and how to avoid them

Personal loan scams prey on your financial vulnerability and might even trap you in a vicious circle of debt. Here’s how to avoid being scammed when considering a loan.

https://www.welivesecurity.com/en/scams/borrower-beware-common-loan-scams/


🎖@malwr

Violent Extremists Dox Executives, Enabling Physical Threats

Domestic violent extremists are increasingly doxing senior U.S. leaders — publishing their personally identifiable information without their consent and with malicious intent.

https://www.recordedfuture.com/violent-extremists-dox-executives-enabling-physical-threats


🎖@malwr

Shielder - Hunting for Unauthenticated n-days in Asus Routers

Notes on patch diffing, reverse engineering and exploiting CVE-2023-39238, CVE-2023-39239, and CVE-2023-39240.

https://www.shielder.com/blog/2024/01/hunting-for-~~un~~authenticated-n-days-in-asus-routers/


🎖@malwr

Agent Tesla [Part 1: Unpacking] | Ryan Weil
Introduction

https://ryan-weil.github.io/posts/AGENT-TESLA-1/


🎖@malwr

Agent Tesla [Part 2: Deobfuscation] | Ryan Weil
Introduction

https://ryan-weil.github.io/posts/AGENT-TESLA-2/


🎖@malwr

“CVE-2024-21388”- Microsoft Edge’s Marketing API Exploited for Covert Extension Installation | by Guardio | Mar, 2024 | Medium

At Guardio, making browsing safer is what we do best, with one of our key products being a browser extension that boosts users’ security on desktop browsers. Our expertise in this area led us to…

https://labs.guard.io/cve-2024-21388-microsoft-edges-marketing-api-exploited-for-covert-extension-installation-879fe5ad35ca


🎖@malwr

Uncovering Malicious Infrastructure with DNS Pivoting
Demonstrating DNS pivoting and analysis techniques for uncovering Malicious infrastructure

https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/


🎖@malwr

Reverse Engineering Snake Keylogger: Full .NET Malware Analysis
Discover an in-depth analysis of the Snake Keylogger malware, exposing its config, infostealing features, and anti-analysis techniques.

https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/


🎖@malwr

Lazarus and the FudModule Rootkit: Beyond BYOVD with an Admin-to-Kernel Zero-Day - Avast Threat Labs

The Lazarus Group is back with an upgraded variant of their FudModule rootkit, this time enabled by a zero-day admin-to-kernel vulnerability for CVE-2024-21338. Read this blog for a detailed analysis of this rootkit variant and learn more about several new techniques, including a handle table entry manipulation technique that directly targets Microsoft Defender, CrowdStrike Falcon, and HitmanPro.

https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/


🎖@malwr