Parse notes
Researchers at VMware Carbon Black have discovered that 34 Windows Driver Model (WDM) and Windows Driver Frameworks (WDF) drivers are vulnerable to exploitation by non-privileged actors who could gain full control of the devices and execute arbitrary code. The technique has been employed by various adversaries, including the North Korea-linked Lazarus Group.
Atlassian has issued a warning about a critical security vulnerability affecting all versions of Confluence Data Center and Server, which could lead to significant data loss if exploited by an unauthenticated attacker. The vulnerability is an improper authorization issue. Atlassian is not aware of any attacks exploiting this vulnerability but urges customers to take immediate action to protect their installs.
Phylum's automated risk detection platform alerted them to a campaign involving at least 48 different publications on npm. These packages, published by the npm user "hktalent" with a package called rshNpm, contained obfuscated JavaScript designed to initiate a reverse shell on package install. The attack chain is triggered by package installation via an install hook in the package.json.
Malwarebytes detected an incident in which attackers utilized a hacked website to generate dynamic search ads that advertised software containing a Trojan. Dynamic search ads are a feature of Google ads that allows for generating ads based on the content of a webpage. Malwarebytes speculates that the attackers may not have even known that they were creating these malvertising ads.
The Cyber Security Agency of Singapore has released an advisory detailing common misconfigurations in networks. The 13 item list includes common misconfigurations such as weak authentication, unnecessary open ports, and unencrypted data.
This article provides an overview of Blister, a malware loader that loads a payload embedded within it. The authors analyze past payloads dropped by Blister loaders based on 137 unpacked samples from the past year and a half and explore recent developments. The analysis shows that Blister is mostly used in a targeted manner with Mythic agents as its payload of choice. The article provides YARA rules and scripts to help analyze the Mythic agent and the packer observed with it.
age is an encryption tool, format, and go library. It features small, explicit keys, no config options, and UNIX-style composability. age supports many common encryption tool features such as passphrases, recipients, and SSH keys.
A gag tool showcasing that Ghidra will automatically detect and render image and audio files embedded in a binary.
AWS has announced a new independent sovereign cloud in Europe. The sovereign cloud is designed for public sector organizations in highly regulated industries that require a distinct cloud that is located solely in the EU. AWS has committed to maintaining the same level of service as the main cloud and providing high availability capabilities through distinct and geographically distant regions and availability zones in the European Sovereign Cloud.
Researchers at Infoblox have been tracking a three year old link shortening service that caters to threat actors. Prior to May 2023, the shortening service primarily used .info domains, but it has now migrated to primarily using .US domains. The .US top-level domain (TLD) is meant to be managed and verified by the National Telecommunications and Information Administration, but researchers have speculated that this management has been outsourced, leading to the TLD hosting many phishing websites.
North Korean state-sponsored hackers have targeted blockchain engineers of an unnamed crypto exchange platform via Discord using macOS malware named KANDYKORN. Security researchers have linked the activity, which began in April 2023, to the Lazarus Group. The attackers lured victims by impersonating blockchain engineers on a public Discord server. The malware is a full-featured memory resident RAT with built-in capabilities to enumerate files, run additional malware, exfiltrate data, terminate processes, and run arbitrary commands.
A security researcher experienced a series of pop-up windows that made it nearly impossible to use his iPhone while traveling by train in the Netherlands. The culprit, it turned out, was using a Flipper Zero device to send Bluetooth pairing requests to all iPhones within radio range. This slim, lightweight device has been available since 2020, but in recent months, it has become much more visible.
InfoSecMap is a searchable database of different events and meetups related to information security.
Aerospace company Boeing has confirmed that it is investigating a cyberattack that affected its parts and distribution business. This comes after LockBit ransomware claimed that it had breached the company's network and stolen data. Boeing has stated that the incident did not affect flight safety, and it is collaborating with law enforcement and regulatory agencies.
An alliance of 40 countries will sign a pledge to stop paying ransoms demanded by cybercriminal groups during the third annual International Counter-Ransomware Initiative summit in Washington, D.C. The initiative is in response to record ransomware risks worldwide, with the U.S. being the target of approximately 46% of these incidents. The summit will also focus on strategies to block the funds used by ransomware groups to finance their operations.