Hackers Distribute RokRAT LNK Files Pretending as a Certificate

A new campaign distributing RokRAT malware targets South Korean and North Korean-related users. LNK files with legitimate names contain PowerShell commands, malicious PE data, and script codes. The malware acts as a backdoor, using cloud APIs to collect and send user information to attacker-controlled cloud servers hosted in pCloud, Yandex, and Dropbox. Numerous malicious activities and potential threat actor email addresses have been uncovered. Users in South Korea are advised to exercise caution, and further details are available in a report by ASEC researchers. Indicators of compromise include file detections and specific hashes.

https://hackhunting.com/2024/05/07/hackers-distribute-rokrat-lnk-files-pretending-as-a-certificate/


🎖@malwr

Formbook Malware Analysis – CyberForensics
In the ever-evolving world, the art of forging genuine connections remains timeless. Whether it’s with colleagues, clients, or partners, establishing a genuine rapport paves the way for collaborative success.

https://cyber-forensics.blog/2024/05/06/formbook-analysis/


🎖@malwr

AWS CloudQuarry: Digging for Secrets in Public AMIs – Security Café
Money, secrets and mass exploitation: This research unveils a quarry of sensitive data stored in public AMIs. Digging through each AMI we managed to collect 500 GB of credentials, private repositories, access keys and more. The present article is the detailed analysis of how we did it and what the data represents. We did a…

https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/


🎖@malwr

APT28 campaign directed against Polish government institutions

CERT Polska is observing a malicious e-mail campaign conducted by the APT28 group against Polish government institutions.

https://cert.pl/en/posts/2024/05/apt28-campaign/


🎖@malwr

Iran-Aligned Emerald Divide Influence Campaign Evolves to Exploit Israel-Hamas Conflict

Explore how Iran-aligned Emerald Divide exploits the Israel-Hamas conflict in an ongoing influence campaign to deepen divisions within Israeli society.

https://www.recordedfuture.com/iran-aligned-emerald-divide-influence-campaign-evolves-to-exploit-israel-hamas-conflict


🎖@malwr

LNK File Disguised as Certificate Distributing RokRAT Malware - ASEC BLOG
AhnLab Security Emergency response Center

https://asec.ahnlab.com/en/65076/


🎖@malwr

Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Three — Elastic Security Labs
In previous articles in this multipart series, malware researchers on the Elastic Security Labs team dove into the REMCOS execution flow. In this article, you’ll learn more about REMCOS configuration structure and its C2 commands.

https://www.elastic.co/security-labs/dissecting-remcos-rat-part-three


🎖@malwr

JavaScript Debugging with Maglev Compiler | by VXRL | Medium
Other than fuzzing for vulnerabilities of our previous blogpost, it would be good to understand how Maglev compiler works via debugging. In the following article, we are going to briefly introduce…

https://vxrl.medium.com/javascript-debugging-with-maglev-compiler-6b2a26cb1a3a


🎖@malwr

CrowdStrike Enhances Cloud Asset Visualization to Accelerate Risk Prioritization

The massive increase in cloud adoption has driven adversaries to focus their efforts on cloud environments — a shift that led to cloud intrusions increasing by 75% in 2023, emphasizing the need for stronger cloud security. Larger scale leads to larger risk. As organizations increase their quantity of cloud assets, their attack surface grows. Each...

https://www.crowdstrike.com/blog/enhanced-cloud-asset-visualization/


🎖@malwr

Russia-Linked CopyCop Uses LLMs to Weaponize Influence Content at Scale

Insikt Group shares research on CopyCop: a Russian-linked network using AI for disinformation to influence US, UK, and French politics. Dive into the details.

https://www.recordedfuture.com/russia-linked-copycop-uses-llms-to-weaponize-influence-content-at-scale


🎖@malwr

zEus Stealer Distributed via Crafted Minecraft Source Pack | FortiGuard Labs
FortiGuard Labs analysis of a zEus batch stealer distributed via a crafted Minecraft source pack.

https://www.fortinet.com/blog/threat-research/zeus-stealer-distributed-via-crafted-minecraft-source-pack


🎖@malwr

Fuel for thought: Can a driverless car get arrested?

What happens when problems caused by autonomous vehicles are not the result of errors, but the result of purposeful attacks?

https://www.welivesecurity.com/en/cybersecurity/fuel-thought-can-driverless-car-get-arrested/


🎖@malwr

Coverage guided fuzzing for native Android libraries (Frida & Radamsa) - KnifeCoat
Coverage guided fuzzing for native Android libraries (Frida & Radamsa) - KnifeCoat

https://knifecoat.com/Posts/Coverage+guided+fuzzing+for+native+Android+libraries+(Frida+%26+Radamsa)


🎖@malwr

Telekopye: Chamber of Neanderthals’ secrets

Insight into groups operating Telekopye bots that scam people in online marketplaces

https://www.welivesecurity.com/en/eset-research/telekopye-chamber-neanderthals-secrets/


🎖@malwr