Credit to Author: Buddy Tancio| Date: Mon, 11 Dec 2023 00:00:00 +0000
This blog entry delves into MxDR’s unraveling of the AsyncRAT infection chain across multiple cases, shedding light on the misuse of aspnet_compiler.exe, a legitimate Microsoft process originally designed for precompiling ASP.NET web applications.
Read moreCredit to Author: Salim S.I.| Date: Fri, 01 Dec 2023 00:00:00 +0000
The Open Radio Access Network (ORAN) architecture provides standardized interfaces and protocols to previously closed systems. However, our research on ORAN demonstrates the potential threat posed by malicious xApps that are capable of compromising the entire Ran Intelligent Controller (RIC) subsystem.
Read moreCredit to Author: Aliakbar Zahravi| Date: Thu, 23 Nov 2023 00:00:00 +0000
We detail the modular framework of malicious Chrome extensions that consist of various highly obfuscated components that leverage Google Chrome API to monitor, intercept, and exfiltrate victim data.
Read moreCredit to Author: Hitomi Kimura| Date: Wed, 22 Nov 2023 00:00:00 +0000
The Trend Micro Managed XDR team encountered malicious operations that used techniques similar to the ones used by Genesis Market, a website for facilitating fraud that was taken down in April 2023.
Read moreCredit to Author: Peter Girnus| Date: Mon, 20 Nov 2023 00:00:00 +0000
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.
Read moreCredit to Author: Veronica Chierzi| Date: Tue, 14 Nov 2023 00:00:00 +0000
This blog entry explores the effectiveness of ChatGPT’s safety measures, the potential for AI technologies to be misused by criminal actors, and the limitations of current AI models.
Read moreCredit to Author: Sophia Nilette Robles| Date: Fri, 10 Nov 2023 00:00:00 +0000
We encountered the Cerber ransomware exploiting the Atlassian Confluence vulnerability CVE-2023-22518 in its operations.
Read moreCredit to Author: Buddy Tancio| Date: Thu, 09 Nov 2023 00:00:00 +0000
We analyzed a phishing campaign involving malicious emails containing a link to a file-sharing solution, which further leads to a PDF document with a secondary link designed to steal login info and session cookies.
Read moreCredit to Author: Salim S.I.| Date: Fri, 20 Oct 2023 00:00:00 +0000
In the second part of this series, we will examine how attackers can trigger vulnerabilities by sending control messages masquerading as user traffic to cross over from user plane to control plane.
Read moreCredit to Author: Carl Malipot| Date: Mon, 16 Oct 2023 00:00:00 +0000
This blog discusses how threat actors abuse Discord’s content delivery network (CDN) to host and spread Lumma Stealer, and talks about added capabilities to the information stealing malware.
Read more