Introduction Understanding Windows internals has always been fascinating to me because whether someone does offensive or defensive work, understanding this information should be the foundation of that work. System privileges are one of the Windows OS …
[ By: Jonny Johnson, Senior Researcher of Adversarial Techniques and Capabilities at Binary Defense Introduction DLL Hijack-based attacks have been popular within the offensive community for several years. This technique has been used to achieve initial …
This blog is written by Jonny Johnson, Senior Researcher of Adversarial Techniques and Capabilities at Binary Defense, and co-authored with Charlie Clark and Andrew Schwartz from TrustedSec 1. Introduction One thing often forgotten is that detection …
Author: Jonny Johnson (@jsecurity101) Recently a friend of mine, Nick Powers, sent me the gmer.sys driver that was involved with the Blackout activity which exposed functionality to terminate any process you wanted from a medium integrity level context. …
Security professionals are facing an ever-increasing number of sophisticated cyber threats. Safeguarding organizational assets and data has become a challenging endeavor, demanding robust solutions that not only detect and respond to threats effectively …
The evolution of threats is constant in today’s digital landscape. Organizations need to harness the data they have to garner insights to better combat emerging threats and risks. To accomplish this, there’s a powerful asset hiding in plain sight: phishing …
A vulnerability in the Microsoft Support Diagnostic Tool (MSDT), dubbed “Follina” (CVE-2022-30190) has been under active exploitation by threat actors for several months. The attack technique that delivers malware via Microsoft Word files first became …
A report recently released by Kaspersky Labs has detailed a threat actor making use of a CLFS (Common Log File System) exploit to escalate privileges. The group Kaspersky attributed to this attack is well known for its many distinct but similar CLFS driver …
The enterprise software vendor SAP has released several security updates for its products, two of which concern critical-severity vulnerabilities that impact the SAP Diagnostics Agent and the SAP BusinessObjects Business Intelligence Platform. SAP is the …
Last week Checkmarx Security detailed the attack that led to a temporary Denial of Service (DoS) on the Node.js package repository npm in March. Threat actors uploaded hundreds of thousands of fake packages in a type of SEO-poisoning attack that relies on …
According to a recent report from Kaspersky, criminals are trading malicious loader programs that can trojanize Android applications to evade Google Play Store defenses. These loader programs are particularly popular for hiding malware and unwanted …
Yum Brands, the parent company of popular fast-food chains KFC, Pizza Hut, and Taco Bell, has disclosed a data breach after a ransomware attack on its systems. The company, which operates more than 50,000 restaurants in over 150 countries, said the breach …
In order to address two actively exploited zero-day vulnerabilities discovered by Google’s Threat Analysis Group and Amnesty International’s Security Lab that also affect earlier iPhones, iPads, and Macs, Apple has published emergency updates to backport …
Over the past week, Israel has experienced significant cyber attacks on the Israel Post and irrigation systems in the North. The Israel Postal Company detected and prevented an attack on their computer servers by a “hostile party” and shut down part of …
A threat group known as ARES is becoming well-known on the cybercrime scene due to selling and leaking databases stolen from businesses and government agencies. The actor first appeared on Telegram in late 2021 and has since been linked to the RansomHouse …
The Iranian nation-state group known as MuddyWater has been observed carrying out destructive attacks on hybrid environments under the guise of a ransomware operation. That’s according to new findings from the Microsoft Threat Intelligence team, which …
A coordinated international law enforcement operation has dismantled Genesis Market, an illegal online marketplace that specialized in the sale of stolen credentials associated with email, bank accounts, and social media platforms. Coinciding with the …
Typhon, a C# based information stealing malware that was first discovered in mid-2022, has had a new version released by the threat actors behind it. Dubbed Typhon Reborn, the new malware has a heavily modified codebase from its original version, …
A new phishing scam on YouTube has been uncovered, where hackers are using authentic-looking email addresses to trick users into giving away their account login information. The scam starts with a fraudulent email claiming to be from YouTube’s support team …
As cyber threats continue to impact businesses of all sizes, the need for round-the-clock security monitoring also grows. Being able to detect and respond to threats quickly is essential for preventing attacks and mitigating losses if a breach does occur. …
