TLDR INFORMATION SECURITY 2024-11-27

HACKERS ABUSE AVAST ANTI-ROOTKIT DRIVER TO DISABLE DEFENSES

Trellix researchers have discovered a malware campaign that utilizes an old and vulnerable Avast anti-rootkit driver to evade detection. The malware drops the vulnerable driver in the default Windows user folder, then creates a service using sc.exe and registers the driver. The driver then leverages the DeviceIOControl API to terminate processes from a hardcoded list of 142 processes associated with various security solutions.

ROMCOM EXPLOITS 0-DAY FIREFOX AND WINDOWS FLAWS IN SOPHISTICATED CYBERATTACK

Researchers are warning of a new campaign from the Russia-linked RomCom APT that exploits a use-after-free 0-day in Firefox and a privilege escalation vulnerability in Windows Task Scheduler. The attackers are using a fake website that redirects users to a secondary website which hosts the malicious payload. The payload executes shell code using the Firefox exploit which runs an embedded library to break out of the browser's sandboxed environment via the Task Scheduler exploit to install the RomCom RAT.

SOFTWARE FIRM BLUE YONDER PROVIDING SERVICES TO US AND UK STORES, INCLUDING STARBUCKS, HIT BY RANSOMWARE ATTACK

Blue Yonder, a software provider for stores like Starbucks, was hit by a ransomware attack that caused disruptions to operations. Starbucks had to switch to manual mode for employee scheduling after the attack. The company is working with cybersecurity firms to recover and investigate the breach, with no timeline for full restoration yet.

EXCEPTION JUNCTION - WHERE ALL VECTORS MEET THEIR HANDLER

Vectored Exception Handler (VEH) is a global exception handler mechanism in Windows that has fewer limitations than Structured Exception Handling. This post provides code that dynamically locates the offset to register a custom VEH and discusses the complexities that arise in the process. It also provides a YARA rule to detect the registered pattern.

UNMASKING PHISHING: STRATEGIES FOR IDENTIFYING 0KTAPUS DOMAINS AND BEYOND

This blog discusses strategies for identifying phishing campaigns, particularly those associated with the threat actor 0ktapus, which uses various social engineering techniques to trick victims into giving up their credentials. Researchers can uncover and detect phishing domains linked to 0ktapus and other threat actors by analyzing phishing infrastructure and using techniques like monitoring newly registered domains. Employing these techniques can help in spotting and preventing future phishing campaigns before attackers succeed in their goals.

ANALYSIS OF ELPACO: A MIMIC VARIANT

Researchers analyzed a Mimic ransomware variant named Elpaco using the Everything library for file searching and customization. Elpaco includes a GUI for attackers to customize ransomware operations, encrypt user data, demand ransom payments, and exhibit sophisticated features. The ransomware variant manipulates files, uses a ChaCha20 stream cipher, and evades detection by securely erasing its executable files.

EMULATOR

A high-performance Windows User Space emulator that operates at the syscall level.

DEFENDERYARA

This repository includes YARA rules extracted from Defender mpavbase.vdm and mpasbase.vdm files. The mpavbase.vdm file contains the antivirus base definition module and the mpasbase.vdm file contains the antispyware base definition module.

BRAINSTORM TOOL RELEASE: OPTIMIZING WEB FUZZING WITH LOCAL LLMS

Brainstorm is a web fuzzing tool that combines AI with traditional techniques to find hidden web application endpoints more efficiently. It uses local LLM models and ffuf to automate path generation and discover more endpoints with fewer requests. The tool is available on GitHub. It offers a more effective approach compared to traditional wordlists for web fuzzing tasks.

MICROSOFT ROLLS OUT RECALL TO WINDOWS INSIDERS WITH COPILOT+ PCS

After multiple delays due to privacy concerns, Microsoft announced that users in the dev Windows Insider channel with Snapdragon PCs will only be able to enable Recall if they have Windows Hello, BitLocker, and Secure Boot enabled. Recall will automatically filter sensitive content and include anti-malware protections such as anti-hammering and rate-limiting. It will be removed by default from enterprise devices, but IT admins will have the option to enable it.

THE BLACK TEAM OPS HONEYPOT

A SpacialSec team member posted a satirical review of a fictitious Black Team Ops certification and course that gained traction and was receiving legitimate inquiries. SpacialSec took this as an opportunity to set up a registration page for the fictitious course and use it as a honeypot to capture registration details for those who would be interested in a course that included criminal topics like SIM swapping. SpacialSec then replaced the domain with a fake FBI seizure notification and sent a fictitious message to registrants that they were subject to FBI investigation. This post includes excerpts from “support” conversations with registrants, statistics, and some funny logs.

NEW NACHOVPN ATTACK USES ROGUE VPN SERVERS TO INSTALL MALICIOUS UPDATES

"NachoVPN" vulnerabilities allow malicious VPN servers to install harmful updates on unpatched Palo Alto and SonicWall SSL-VPN clients. Attackers can trick users into connecting to rogue VPN servers through social engineering or phishing, potentially leading to credential theft and code execution. SonicWall and Palo Alto Networks have released patches to address the vulnerabilities. AmberWolf has provided additional details and an open-source tool.

HACKER IN SNOWFLAKE EXTORTIONS MAY BE A U.S. SOLDIER

Although two men were arrested for extorting companies using Snowflake, hacker Kiberphant0m, believed to be a US Army soldier stationed in South Korea, remains at large.

CLOUDFLARE INCIDENT ON NOVEMBER 14, 2024, RESULTING IN LOST LOGS

Cloudflare had an incident on November 14 that resulted in the loss of about 55% of logs sent to customers.

THE SOURCE CODE OF BANSHEE STEALER LEAKED ONLINE