I recently observed some malware (uploaded to my honeypot) that targets Hive OS's wallet configuration -- to redirect mined coins to the attacker.

Conti's rapid encryption speed is matched only by its rapid evolution. SentinelLabs' deep dive explores its development in unprecedented detail.

DNSStager will create a malicious DNS server that handles DNS requests to your domain and return your payload as a response to specific record requests

CVE-2021-34527, or PrintNightmare, is a vulnerability in the Windows Print Spooler that allows for a low priv user to escalate to administrator on a local box or on a remote server. This is especially bad because it is not uncommon for Domain Controllers…

In this part of the series, we will understand how the process can be enumerated within memory. Just as a refresher in part 1 of this series we had a look

What happens inside the WiFi Driver on RISC-V BL602... And how we found the incomplete source code for the driver

Introduction Old dog, old tricks When enterprise software gets old, should we consider it tried-and-true, or decrepit and a threat, like t...

A team of CyLab researchers have designed a new tool that automatically checks for memory bugs—the types of bugs that can lead to buffer overflow exploits, a commonly deployed cyberattack.

It looks like authentication, but is it really?

Practical Bypasses for MFA with Poor Implementations

Preface
(日本語版も公開されています。)
Cloudflare, which runs cdnjs, is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform vulnerability assessments.
This article describes vulnerabilities reported through this program and published…

This blog introduces a new information stealer, written in Rust and interestingly named FickerStealer. In this blog post, we provide an in-depth analysis of this new threat and its obfuscation...

CNT hit by RansomEXX ransomware. Customer and corporate data compromised and hosted on the breached website. 190 GB of data supposedly stolen...

This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

Learn about the pre-auth remote code execution exploit against Kaseya VSA Server that was used in the mass Revil ransomware attack on July 2, 2021.