The ValleyRAT malware uses a multi-stage process involving DLL sideloading, process injection, and shellcode execution to establish connections with a command-and-control server for downloading further malicious payloads. The malware utilizes encryption, decryption, and hashing algorithms to dynamically load and execute embedded DLLs, collect system information, and carry out specific actions based on the victim host's configuration. ValleyRAT conducts device fingerprinting to gather detailed information about the infected system, such as IP address, system uptime, hardware details, and user privileges, aiding in its malicious activities.
Sponsored
Watch ThreatLocker® initiate a legit ransomware attack and provide a full breakdown of how it operates, followed by a demonstration of
Ratify is a verification engine that enables verification of artifact security metadata and admits for deployment only those that comply with defined policies.
This Python Notebook demonstrates searching for YouTube videos, takes 5 results, "listens" to their audio tracks, summarizes them, and then assembles a report from those summaries. It could be helpful for catching up on conference talks, extracting summaries, and understanding TTPs for researchers.
This repository contains a guide to build a phishing engagement infrastructure setup using EvilNginx or GoPhish. The guide covers various parts of the lifecycle, from domain registration to securing the Nginx instances, and contains videos for further learning.
Mandiant, which is working with Snowflake on incident response, has identified that 165 customers' data has been breached. It stated that the attackers are using the Snowflake access to deploy an info-stealer malware dubbed FROSTBITE. Mandiant had previously denied responsibility and stated that the breaches were caused by a lack of MFA by customers.
The City of Cleveland's IT systems have been shut down due to a cyberattack that forced essential services offline. Investigations are ongoing with third-party experts. Key services like emergency response and utilities remain unaffected. Authorities are working to provide updates as the situation unfolds.
ACE is an anti-cheat software made by Tencent, a Chinese tech giant. It has raised privacy concerns as it takes screenshots of users' entire display. ACE has components with screenshot-taking capabilities, sparking worries about data privacy and potential misuse.
An AI system detected a CSRF vulnerability in the popular WordPress plugin Modula.
Chinese hackers breached 20,000 FortiGate systems globally by exploiting a critical vulnerability.
A 16-year-old in France was arrested for links to the Epsilon hacking group attacks.
Sponsored
Break away from traditional SOAR with Tines. Trusted by security teams at McKesson, Canva, and Mars, Tines is scalable and accessible for the whole team.
Security researchers warn of a critical PHP vulnerability that allows trivial remote code execution on Windows devices. Within 24 hours of its disclosure and patch release, scans for vulnerable servers were detected. Experts strongly recommend checking and patching PHP servers immediately to mitigate risks.
Frontier Communications suffered a data breach and the personal information of over 750,000 individuals, including names, addresses, emails, dates of birth, phone numbers, and Social Security numbers got leaked.
A leak of data from Disney's internal Confluence server was published to 4chan last week. The data was thought to only contain archives about Club Penguin but was revealed to also contain new information about Disney's corporate strategies, advertising plans, internal tools, business projects, and internal infrastructure. One of the tools was a high-performance asynchronous messaging library and the other was a show authoring and playback tool that allows Disney producers and authors to create non-linear experiences using real world input from sensors in Disney parks.
This post explores potential AI threat vectors through an offensive mindset. It discusses mitigation strategies and acknowledges the need for further development of AI security solutions as adoption rapidly increases.
This post discusses the importance of encryption at rest for web and cloud applications to protect sensitive data. It highlights the need for a clear threat model and proper key management when implementing encryption at rest. It also emphasizes the risks of confused deputy attacks and the importance of understanding the nuances of encryption strategies.
This post introduces the identity problems that modern SaaS apps face and the more complex ways that attackers hunt for access. It lays out SSO, user provisioning (via SCIM), and programmatic access to logs as requirements for modern SaaS apps. It also proposes proof-of-possession, continuous access evaluation profiles, and universal logout for SaaS apps of the future.
Sponsored
Watch ThreatLocker® initiate a legit ransomware attack and provide a full breakdown of how it operates, followed by a demonstration of
AirMDR utilizes AI for triaging security events, investigating alerts, and deploying response and containment measures.
Betterscan is an orchestration toolchain that uses state-of-the-art tools to scan your source code and infrastructure IaC and analyze your security and compliance risks.
Kubelet CSR Approver is a Kubernetes controller designed to automatically approve kubelet-serving CSRs after validating a configurable series of security checks.
The U.S. Justice Department's antitrust lawsuit against Google's alleged adtech monopoly will proceed as a bench trial before a judge this fall, after Google filed a $2.3 million cashier's check to cover potential damages, avoiding a potentially unpredictable jury trial.
Microsoft is revising its controversial "Recall" feature for Copilot+ PCs after privacy concerns. Originally designed to capture desktop screenshots, Microsoft is now making Recall an opt-in feature with improved privacy and security safeguards.
DuckDuckGo unveiled a new AI Chat service that allows users to freely converse with mid-range LLMs while attempting to preserve privacy. The available models include OpenAI's GPT-3.5 Turbo, Anthropic's Claude 3 Haiku, Meta's Llama 3, and Mistral's Mixtral 8x7B. DuckDuckGo notes that in the case of GPT-3.5 Turbo and Claude 3 Haiku, the data needs to be sent to remote servers outside of DuckDuckGo, so the privacy experience is not as strong.
Amid controversy over changes to its Terms of Services, Adobe claims that it does not train Firefly Gen AI models and will never assume ownership over a customer's work.
Apple plans to increase the accessibility of its password manager by breaking it out into a standalone app.
Trail of Bits has announced that it will be providing AI/ML safety and security training for organizations that covers fundamentals, vulnerabilities, risk assessment, and mitigation strategies for securing AI/ML systems.
Sponsored
In this virtual GameDay [4], you will complete a series of cloud security quests using Lacework and AWS [4].
TikTok has fixed a 0-day vulnerability that allowed attackers to take over accounts. The vulnerability required the attacker to send a DM to the victim and the victim to open the message but did not require any further interaction such as clicking links. TikTok has not given details as to the number of accounts that were compromised.
Security researcher Jeremiah Fowler discovered an unprotected database belonging to Patties Food Limited that was internet accessible. The database contained nearly 500K internal logs which exposed internal, customer, and vendor emails. The database also contained over 25K invoices which included vendors, contacts, emails, and banking information. The databases were managed by a third party known as Proveno.ai, which has responded to the responsible disclosure and protected the databases.
The US Justice Department filed a civil forfeiture action seeking to recover over $5 million stolen from a Massachusetts trade union. The funds, part of a $6.4 million theft, have been traced to seven bank accounts which are currently seized. The legal action aims to enable the recovery of the stolen money held in those accounts
Terrascan is an IaC scanner by Tenable that can be used to scan Terraform files, Helm Charts, Dockerfiles, and other IaC files. This post walks through the steps to install Terrascan and run it against Terraform files. It provides the full output of the sample run and walks through the found vulnerabilities.
Viktor Petersson, co-founder of Screenly, walks through the process of utilizing certificates generated by Tailscale for Mutual TLS to provide an added layer of security to sensitive applications or those that don't require authentication. Petersson first generates a client certificate with Tailscale and exports it to a PKCS#12 bundle, then he imports that to a browser, and finally deploys a ghostunnel server to reverse proxy traffic on the server.
Static and dynamic app testing are important but not enough to fully secure modern software. New automated testing procedures are needed to address evolving threats and vulnerabilities. Detection in source code is crucial for enhancing application security beyond traditional methods.
Sponsored
If you need managed file transfer (MFT) you can trust, choose the only MFT platform tough enough for FedRAMP and IRAP [11]. Kiteworks is regularly audited against 325 security controls for NIST 800-53, built on a hardened virtual appliance, and offers enterprise scale-out and high availability [11] — in the cloud, on-premises, or hybrid. Get a
VulnCheck provides exploit intelligence for vulnerability prioritization and an early-warning system for in-the-wild software exploitation activity.
OXO is a security scanning framework that combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, fingerprinting, and more.
TotalRecall is a tool that extracts and displays data from the new Recall feature in Windows 11. The tool demonstrates how the local Recall database can be abused by an attacker. It was developed using an Azure VM with access to the feature as Copilot+ devices have not shipped yet.
The British Independent Retailers Association filed a damages claim against Amazon in a £1.1 billion ($1.3 billion) collective action, alleging illegal misuse of members' proprietary data for competitive purposes and manipulation of the coveted "Buy Box" feature.
Threat actors are increasingly abusing legitimate packer software like BoxedApp to evade detection and distribute malware such as remote access trojans and information stealers, primarily targeting financial institutions and government sectors.
Microsoft announced that it has officially deprecated the outdated NTLM authentication protocol in favor of more secure alternatives. NTLM will still work in the next release of Windows server and the next annual release of Windows. Administrators are encouraged to audit their use of NTLM and users are encouraged to transition to Negotiate which attempts authentication with Kerberos before falling back to NTLM.
The FBI obtained 7,000 decryption keys from the LockBit ransomware group. Victims can now unlock their data for free.
There are more than 1.2 million cybersecurity workers in the United States, but 225,200 more people are needed.
Google plans to store Maps Timeline data on users' devices instead of in their Google account starting December 1.