Collaborate Disseminate
Since March 2018 we have discovered several infections where a previously unknown Trojan was injected into the lsass.exe system process memory. This campaign was active immediately prior to Central Asian high-level meeting and we suppose that actor behind still follows regional political agenda. Continue reading LuckyMouse signs malicious NDISProxy driver with certificate of Chinese IT company
A Pinterest browser button leaks malformed code into any browser-based text editor. Continue reading Pinterest Browser Extension Injects Unwanted Code into 5K Websites
Changes in the group’s script may indicate that the hackers may start using attack vectors other than ActiveX. Continue reading Recent Andariel Group ActiveX Attacks Point to Future Targets
Researchers have identified what they are calling an Early Bird code injection technique used by the Iranian group APT33 to burrow the TurnedUp malware inside infected systems while evading anti-malware tools. Continue reading New ‘Early Bird’ Code Injection Technique Helps APT33 Evade Detection
On March 7, we reported that a massive Dofoil campaign attempted to install malicious cryptocurrency miners on hundreds of thousands of computers. Windows Defender Antivirus, with its behavior monitoring, machine learning technologies, and layered appr… Continue reading Poisoned peer-to-peer app kicked off Dofoil coin miner outbreak
Canadian researchers from human rights organization Citizen Lab uncovered a major computer espionage operation spreading across Turkey, Egypt and, indirectly, Syria. The operation, which started in 2017, is a nation-state-level network injection to del… Continue reading Turkish, Egyptian ISPs help local government conduct massive spyware operation
Microsoft has found a file-transfer tool used by the Platinum APT that leverages Intel Active Management Technology to stealthily load malware onto networked computers. Continue reading Platinum APT First to Abuse Intel Chip Management Feature
In April 2017 we started observing new rooting malware being distributed through the Google Play Store. Unlike other rooting malware, this Trojan not only installs its modules into the system, it also injects malicious code into the system runtime libraries. Continue reading Dvmap: the first Android malware with code injection
Apache Struts,versions 2.3.5 – 2.3.31 and 2.5 – 2.5.10,is vulnerable to code injection leading to remote code execution(RCE). Continue reading VU#834067: Apache Struts 2 is vulnerable to remote code execution
Attackers can leverage a design weakness in all versions of Windows to carry out code injection attacks that bypass detection by security software. Continue reading Windows Atom Tables Can Be Abused for Code Injection Attacks