Operation FlightNight: Indian Government Entities and Energy Sector Targeted by Cyber Espionage Campaign
EclecticIQ analysts identified a threat actor that utilized information stealer HackBrowserData to target Indian government entities and energy sector.

https://blog.eclecticiq.com/operation-flightnight-indian-government-entities-and-energy-sector-targeted-by-cyber-espionage-campaign


🎖@malwr

Analysis of DinodasRAT Linux implant | Securelist
In this article, we share our analysis of a recent version of the DinodasRAT implant for Linux, which may have been active since 2022.

https://securelist.com/dinodasrat-linux-implant/112284/


🎖@malwr

Introducing SharpConflux - LRQA Nettitude Labs
SharpConflux, a .NET application built to facilitate Confluence exploitation during Red Team and Penetration Testing engagements.

https://labs.nettitude.com/blog/introducing-sharpconflux/


🎖@malwr

✅✅✅ Forward posts to the other groups ✅✅✅

Interesting Multi-Stage StopCrypt Ransomware Variant Propagating in the Wild

Overview The SonicWall Capture Labs threat research team recently observed an interesting variant of StopCrypt ransomware. The ransomware executes its malicious activities by utilizing multi-stage shellcodes before launching a final payload that contains the file

https://blog.sonicwall.com/en-us/2024/03/new-multi-stage-stopcrypt-ransomware/


🎖@malwr

Malware Development Essentials Part 1 | by Smukx | Mar, 2024 | Medium
For Malware development and security professionals, understanding the inner workings of Windows is crucial. Windows internals, the hidden world beneath the user interface, can harbor vulnerabilities…

https://smukx.medium.com/malware-development-essentials-part-1-5f4626652ed9


🎖@malwr

Windows Memory Forensics
How to hunt for anomalies in a Windows Memory Dump

https://blog.cyber5w.com/anomalies-hunting-in-windows-memory-dump


🎖@malwr

VMware ESXi Forensic with Velociraptor
Introduction During our investigations, we have come across more and more VMware ESXi hypervisors.

https://www.synacktiv.com/en/publications/vmware-esxi-forensic-with-velociraptor.html


🎖@malwr

New DinodasRAT Used as Linux Implants Worldwide: First Known Variant Still remains a Mystery

DinodasRAT is a C++ backdoor that was initially used to attack government organizations in Guyana. A new Linux variant targeting Red Hat and Ubuntu Linux has been discovered. The malware establishes persistence using Systemd and SystemV, communicates with C2 servers via TCP or UDP, and uses encryption. Its infrastructure has been linked to specific IP addresses and domains, affecting several countries.

https://hackhunting.com/2024/03/29/new-dinodasrat-used-as-linux-implants-worldwide-first-known-variant-still-remains-a-mystery/


🎖@malwr

New Malicious PyPI Packages used by Lazarus

JPCERT/CC has confirmed that Lazarus has released malicious Python packages to PyPI, the official Python package repository...

https://blogs.jpcert.or.jp/en/2024/02/lazarus_pypi.html


🎖@malwr

Quick Forensics Analysis of Apache logs - SANS Internet Storm Center
Quick Forensics Analysis of Apache logs, Author: Xavier Mertens

https://isc.sans.edu/diary/30792


🎖@malwr

In-the-Wild Windows LPE 0-days: Insights & Detection Strategies — Elastic Security Labs
This article will evaluate detection methods for Windows local privilege escalation techniques based on dynamic behaviors analysis using Elastic Defend features.

https://www.elastic.co/security-labs/itw-windows-lpe-0days-insights-and-detection-strategies


🎖@malwr

Advanced CyberChef Techniques for Configuration Extraction - Detailed Walkthrough and Examples
Advanced CyberChef techniques using Registers, Regex and Flow Control

https://embee-research.ghost.io/advanced-cyberchef-operations-netsupport/


🎖@malwr

Android Malware Vultur Expands Its Wingspan – Fox-IT International blog
Authored by Joshua Kamp Executive summary The authors behind Android banking malware Vultur have been spotted adding new technical features, which allow the malware operator to further remotely interact with the victim's mobile device. Vultur has also started masquerading more of its malicious activity by encrypting its C2 communication, using multiple encrypted payloads that are…

https://blog.fox-it.com/2024/03/28/android-malware-vultur-expands-its-wingspan/


🎖@malwr

[Nullcon Berlin 2024] The complexity of reversing Flutter applications

Flutter is a cross-platform application development platform. With the same codebase, developers write and compile native applications for Android,...

https://filestore.fortinet.com/fortiguard/research/nullcon.pdf

🎖@malwr