Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 6th, 2021 https://isc.sans.edu/podcastdetail.html?id=7782, (Mon, Dec 6th)
We are well on our way to closing 2021 and looking back at this year, it is easy to see that 2021 has been dominated by phishing and ransomware. With zero-day exploits in their possession, threat actors have been looking for new ways to target supply chain, source code, firmware and industrial control systems (ICS).
Today, many malware samples that you can find in the wild are “packed”. The process of packing an executable file is not new and does not mean that it is de-facto malicious. Many developers decide to pack their software to protect the code. But why malware are often packed&#;x26;#;x3f; Because packing slows down the malware analyst job and defeats many static analysis tools. The advantages of packed malware (from an attacker&#;x26;#;39;s point of view) are (amongst others):
Continue reading The UPX Packer Will Never Die!, (Fri, Dec 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, December 3rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7780, (Fri, Dec 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, December 2nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7778, (Thu, Dec 2nd)
We already reported multiple times that, when you offer an online (cloud) service, there are a lot of chances that it will be abused for malicious purposes. I spotted an info-stealer that exfiltrates data through webhook.site. Today, many Python scripts use Discord as a C2 communication channel. This time, something different and that looks definitively less suspicious.
Continue reading Info-Stealer Using webhook.site to Exfiltrate Data, (Wed, Dec 1st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7776, (Wed, Dec 1st)
One rather persistent pattern in our honeypot logs is attacks against older PHPUnit flaws. These attacks appear to exploit %%cve:2017-9841%%, a simple remote code execution vulnerability [1]. Back in 2019, Imperva called it “one of the most exploitable CVEs of 2019”, and even now, attacks keep coming in [2]. After tuning one of our honeypots to be more sensitive to these attacks, we saw one to two thousand attacks against the honeypot a day (the honeypot covers multiple IP addresses).
Continue reading Hunting for PHPUnit Installed via Composer, (Tue, Nov 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, November 30th, 2021 https://isc.sans.edu/podcastdetail.html?id=7774, (Tue, Nov 30th)