All the latest news on Cybersecurity

The Black Basta ransomware gang infected over 300 victims accumulating ransom payments exceeding 0 million since early 2022. The Black Basta ransomware group has been active since April 2022, like other ransomware operations, it implements a double-extortion attack model.   A joint research by Elliptic and Corvus Insurance revealed that the group accumulated at least […]

Bitcoin ransom

Several cases of children creating indecent images of other children using AI software add to the worries about harmful uses of AI technology

creating indecent indecent images software add technology Teaching

Hackers use Remote Access Trojans (RATs) to gain unauthorized access and control over a victim’s computer remotely.  RATs allow threat actors to execute the following malicious actions while remaining hidden from the victim:- Recently, cybersecurity researchers at Cisco Talos discovered a malicious campaign that was found to be delivering a new RAT that’s been dubbed […] The post New SugarGh0st RAT Delivered via Malicious Windows Shortcut & JavaScript appeared first on Cyber Security News.

Malicious Windows RAT Delivered Windows Shortcut

Aladdin is a payload generation technique based on the work of James Forshaw (@tiraniddo) that allows the deseriallization of a .NET payload and execution in memory. The original vector was documented on https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html. By spawning the process AddInProcess.exe with arguments /guid:32a91b0f-30cd-4c75-be79-ccbd6345de99 and /pid:, the process will start a named pipe under \.pipe32a91b0f-30cd-4c75-be79-ccbd6345de99 and will wait for a .NET Remoting object. If we generate a payload that has the appropiate packet bytes required to communicate with a .NET remoting listener we will be able to trigger the ActivitySurrogateSelector class from System.Workflow.ComponentModel. and gain code execution. Originally, James Forshaw released a POC at https://github.com/tyranid/DeviceGuardBypasses/tree/master/CreateAddInIpcData. However this POC will fail on recent versions of Windows since Microsoft went ahead and patched the vulnerable System.Workflow.ComponentModel (https://github.com/microsoft/dotnet-framework-early-access/blob/master/release-notes/NET48/dotnet-48-changes.md). Nick Landers (@monoxgas) however, identified a way to disable the check that Microsoft introduced and wrote a detailed article at https://www.netspi.com/blog/technical/adversary-simulation/re-animating-activitysurrogateselector/ . The bypass is documented at pwntester/ysoserial.net#41 . Aladdin is a payload generation tool, which using the specific bypass as well as the necessary header bytes of the .NET remoting protocol is able to generate initial access payloads that abuse the AddInProcess as originally documented. The provided templates are: * HTA* VBA* JS* CHM Notes In order for the attack to be successfull the .NET assembly must contain a single public class with an empty constructor to act as the entry point during deserialization. An example assembly has been included in the project. Usage Usage: -w, --scriptType=VALUE Set to js / hta / vba / chm. -o, --output=VALUE The generated output, e.g: -o C:UsersNettitudeDesktoppayload -a, --assembly=VALUE Provided Assembly DLL, e.g: -a C:UsersNettitudeDesktoppopcalc.dll -h, --help Help OpSec The user supplied .NET binary will be executed under the AddInProcess.exe that gets spawned from the HTA / JS payload. The spawning of the processes currently happens using the 9BA05972-F6A8-11CF-A442-00A0C90A8F39 COM object (https://dl.packetstormsecurity.net/papers/general/abusing-objects.pdf) which will launch the process as a child of Explorer.exe process. The GUID supplied in the process parameters of AddInProcess.exe can be user controlled. At the moment the guid is hardcoded in the template and the code. CHM executes the JScript through XSLT transformation Defensive Considerations Addinprocess.exe will always launch with /guid and /pid. Baseline your environment for legitimate uses - monitor the rest Useful References: * https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html* https://www.netspi.com/blog/technical/adversary-simulation/re-animating-activitysurrogateselector/ Readme / Credits Code is based on the following repos: * https://github.com/tyranid/DeviceGuardBypasses/tree/master/CreateAddInIpcData* https://github.com/pwntester/ysoserial.net Shouts to: @m0rv4i for helping with C# nuances @ace0fspad3s for troubleshooting @ Nettitude RT for being awesome Download Aladdin

Aladdin Generation Technique Payload Generation

US CISA added ownCloud and Google Chrome vulnerabilities to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added ownCloud and Google Chrome vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The two issues are: CVE-2023-6345 – The CVE-2023-5217 is a high-severity integer overflow in Skia. Skia is an open-source 2D graphics library that provides […]

Chrome vulnerabilities

Black Basta, the fourth-most active ransomware strain with more than 329 victims, has reportedly made over 0 million in ransom payments. This ransomware has also been discovered to resemble the Conti ransomware group, which stopped its operations by May 2022. A group known as Black Basta has been found to engage in double-extortion tactics, whereby […] The post Black Basta Ransomware Received Over 0 Million From Victims appeared first on Cyber Security News.

Basta Ransomware Received

A new toolset comprised of malware (Agent Raccoon and Ntospy) and a custom version of Mimikatz (Mimilite) was used to target organizations in the U.S., Middle East and Africa. The post New Tool Set Found Used Against Middle East, Africa and the US appeared first on Unit 42.

Agent Raccoon toolset comprised

Today marks the day when Google makes good on its new policy to reserve the right to delete inactive accounts after two years of inactivity. The company defines activity as “actions you take when you sign in or while you're signed in to your Google Account”: Reading or sending an email Using Google Drive Watching […] The post Google bins inactive accounts first appeared on IT Security Guru. The post Google bins inactive accounts appeared first on IT Security Guru.

bins inactive Google bins

The U.S. Department of Justice (DOJ) and the FBI recently collaborated in a multinational operation to dismantle the notorious Qakbot malware and botnet. While the operation was successful in disrupting this long-running threat, concerns have arisen as it appears that Qakbot may still pose a danger in a reduced form. This article discusses the aftermath of the takedown, provides mitigation

Future Threats Qakbot Takedown Takedown Aftermath

Founded in 2017 to support startups in their IT strategy, in France and abroad, SysWings has extended its activities to the cloud and managed services. The team is made up of heterogeneous profiles, mixing employees and consultants, scaled according to your projects.

A suspected Chinese-speaking threat actor has been attributed to a malicious campaign that targets the Uzbekistan Ministry of Foreign Affairs and South Korean users with a remote access trojan called SugarGh0st RAT. The activity, which commenced no later than August 2023, leverages two different infection sequences to deliver the malware, which is a customized variant of Gh0st RAT 

Target South Uzbekistan Ministry

The most recent Gcore Radar report and its aftermath have highlighted a dramatic increase in DDoS attacks across multiple industries. At the beginning of 2023, the average strength of attacks reached 800 Gbps, but now, even a peak as high as 1.5+ Tbps is unsurprising. To try and break through Gcore's defenses, perpetrators made two attempts with two different strategies.

Gcore Thwarted multiple industries Thwarted Powerful