If you’ve ever “understood” DLL hijacking, only to return to your lab and fail to get it working properly, this post is for you.

This is a detective story about how a car was stolen - and how it uncovered an epidemic of high-tech car theft. It begins with a tweet. In April 2022, my friend Ian Tabor tweeted that vandals had been at his car, pulling apart the headlight and unplugging…

Research by: Jiri  Vinopal, Dennis Yarizadeh and Gil Gekker Key Findings: Introduction While responding to a ransomware case against a US-based company, the CPIRT recently came across a unique ransomware strain deployed using a signed component of a commercial…

IcedID continues to deliver malspam emails to facilitate a compromise. This case covers the activity from a campaign in late September of 2022. Post exploitation activities detail some familiar and some new techniques and tooling, which led to  domain wide…

I’m excited to announce that I will be returning this year to the Black Hat USA 2023 conference in Las Vegas. As with previous years’…

Analyzing UpdateAgent, the 2nd-stage macOS payload of the 3CX supply chain attack

Threat actors exploit WinRAR self-extracting (SFX) archives containing decoy files by adding malicious functionality to install backdoors in target

2easy is a Russian-and English-language illicit shop that sells logs as well as user information collected from browsers via stealer malware.

A guide to assess whether users have been targeted or compromised by threat actors exploiting CVE-2022-21894 via BlackLotus UEFI bootkit.

IntroductionOn the latest Patch Tuesday, Microsoft released 83 security fixes, one of which is the "CVE-2023-23397" vulnerability that affects all versions of the Outlook desktop app on Windows systems. However, this vulnerability does not impact the Outlook…

Security Frameworks sind für die Verwaltung der IT-Sicherheitslage unerlässlich. CIS-CSC V8 hat sich zu einem sehr wertvollen Instrument für den Beginn des Sicherheitsmanagements kleiner und mittlerer Unternehmen entwickelt.

In this post, I’ll look at a security-related change in version r40p0 of the Arm Mali driver that was AWOL in the January update of the Pixel bulletin, where other patches from r40p0 was applied, and how these two lines of changes can be exploited to gain…

Type confusion in the Chrome renderer reachable from a malicious website.

In 1999, a far-fetched movie about a dystopia run by intelligent machines captured our imaginations (and to this day, remains my favorite film). Twenty-four years later, the line between fact and...

Our DevOps threat matrix is a comprehensive knowledgebase defenders can use to track and build defenses against relevant attack techniques.

By Michele Campa Overview We describe a method to exploit a Windows Nday vulnerability to escape the Adobe sandbox. This vulnerability is assigned CVE-2021-31199 and it is present in multiple Windows 10 versions. The vulnerability is an out-of-bounds write…

Keep calm and grab a shell

Obfu[DE]scate is a de-obfuscation tool for Android APKs that uses fuzzy comparison logic to identify similarities between functions, even if they have been renamed as part of obfuscation. It compar...