Enigma info-stealing malware targets the cryptocurrency industry https://securityaffairs.com/142187/cyber-crime/enigma-info-stealer-cryptocurrency-industry.html
Security Affairs
Enigma info-stealing malware targets the cryptocurrency industry
Alleged Russian threat actors have been targeting cryptocurrency users in Eastern Europe with info-stealing malware.
Chaos Malware Quietly Evolves Persistence and Evasion Techniques https://sysdig.com/blog/chaos-malware-persistence-evasion-techniques/
Sysdig
Chaos Malware Quietly Evolves Persistence and Evasion Techniques | Sysdig
We will go through the analysis of chaos malware based on our captured attacks with an emphasis on persistence techniques.
Linux Rootkits Part 1: Introduction and Workflow https://xcellerator.github.io/posts/linux_rootkits_01/
Linux Rootkits Part 1: Introduction and Workflow
Linux Rootkits Part 1: Introduction and Workflow :: TheXcellerator
Learning about Linux rootkits is a great way to learn more about how the kernel works. What’s great about it is that, unless you really understand what the kernel is doing, your rootkit is unlikely to work, so it serves as a fantasic verifier.
In the FreeBSD…
In the FreeBSD…
👍1🔥1
Our second post on the history of malware is now available. We continue the timeline by reviewing the 1980s, where the first malware proofs of concept began to emerge. You can read more at https://reversea.me/index.php/a-brief-history-of-malware-part-2/, enjoy!
❤2🔥1
CVE-Vulnerability-Information-Downloader - Downloads Information From NIST (CVSS), First.Org (EPSS), And CISA (Exploited Vulnerabilities) And Combines Them Into One List https://www.kitploit.com/2023/02/cve-vulnerability-information.html
KitPloit - PenTest & Hacking Tools
CVE-Vulnerability-Information-Downloader - Downloads Information From NIST (CVSS), First.Org (EPSS), And CISA (Exploited Vulnerabilities)…
Linux Rootkits Part 2: Ftrace and Function Hooking https://xcellerator.github.io/posts/linux_rootkits_02/
Linux Rootkits Part 2: Ftrace and Function Hooking
Linux Rootkits Part 2: Ftrace and Function Hooking :: TheXcellerator
Okay, so you’ve built your first kernel module, but now you want to make it do something cool - something like altering the behaviour of the running kernel. The way we do this is by function hooking, but the question is - how do we know which functions to…
👍1
Gitpod remote code execution 0-day vulnerability via WebSockets https://snyk.io/blog/gitpod-remote-code-execution-vulnerability-websockets/
Snyk Labs
Gitpod remote code execution 0-day vulnerability via WebSockets | Snyk Labs
Using compilation units for binary diffing https://github.com/joxeankoret/diaphora/blob/master/doc/articles/compilation_units.md
GitHub
diaphora/doc/articles/compilation_units.md at master · joxeankoret/diaphora
Diaphora, the most advanced Free and Open Source program diffing tool. - joxeankoret/diaphora
Persistence Techniques That Persist https://www.cyberark.com/resources/threat-research-blog/persistence-techniques-that-persist
Cyberark
Persistence Techniques That Persist
Abstract Once threat actors gain a foothold on a system, they must implement techniques to maintain that access, even in the event of restarts, updates in credentials or any other type of change...
Linux Rootkits Part 3: A Backdoor to Root https://xcellerator.github.io/posts/linux_rootkits_03/
Linux Rootkits Part 3: A Backdoor to Root
Linux Rootkits Part 3: A Backdoor to Root :: TheXcellerator
Now that you know how to make a Linux kernel module that can hook any exposed function in kernel memory (Part 1 and Part 2), let’s get down to writing a hook that does something interesting!
In this first example, we’re going to make a rootkit that intercepts…
In this first example, we’re going to make a rootkit that intercepts…
Lord Of The Ring0 - Part 4 | The call back home https://idov31.github.io/2023/02/24/lord-of-the-ring0-p4.html
Understanding the Context of Cyber Threats: Lessons from the Kimsuky Group Attack https://sp4rk.medium.com/understanding-the-context-of-cyber-threats-lessons-from-the-kimsuky-group-attack-3d026c5629bc
Medium
Understanding the Context of Cyber Threats: Lessons from the Kimsuky Group Attack
Kimsuky is the most active cyber threat actor who consistently targets North Korean-related institutions, companies, media, academia, and…
Acronis gets embarrassed by 'bored' hacker https://www.hackwatcher.com/p/acronis-gets-embarrassed-by-bored-hacker
Root Cause Analysis of the in the wild JIT bug (CVE-2022-42856) https://voidistaff.github.io/safari/2023/02/20/CVE-2022-42856.html
A New Vector For “Dirty” Arbitrary File Write to RCE https://blog.doyensec.com//2023/02/28/new-vector-for-dirty-arbitrary-file-write-2-rce.html
Doyensec
A New Vector For “Dirty” Arbitrary File Write to RCE
Arbitrary file write (AFW) vulnerabilities in web application uploads can be a powerful tool for an attacker, potentially allowing them to escalate their privileges and even achieve remote code execution (RCE) on the server. However, the specific tactics…
🔥1
DNSMonitor: Leveraging Apple's Network Extension Framework, this utility monitors DNS requests and responses https://objective-see.org/products/utilities.html#DNSMonitor
objective-see.org
Commandline Utilities
CLI utilities to facilate system monitoring and malware analysis.
👍1
Smart Contracts Security: Exploring Common Bugs https://playground.zero-defense.com/blog/smart-contracts-security/
Decoding BlazorPack https://sensepost.com/blog/2023/decoding-blazorpack/