Collaborate Disseminate
Attackers can abuse a new DLL search order hijacking technique to execute code in applications within the WinSxS folder.
The post New DLL Search Order Hijacking Technique Targets WinSxS Folder appeared first on SecurityWeek.
Continue reading New DLL Search Order Hijacking Technique Targets WinSxS Folder
In 2022 we investigated a series of attacks against industrial organizations in Eastern Europe. In the campaigns, the attackers aimed to establish a permanent channel for data exfiltration, including data stored on air-gapped systems. Continue reading Common TTPs of attacks against industrial organizations
Kaspersky analysis of a complicated multi-stage attack dubbed Minas that features a number of detection evasion and persistence techniques and results in a cryptocurrency miner infection. Continue reading Minas – on the way to complexity
At the end of September, GTSC reported the finding of two 0-day vulnerabilities in Microsoft Exchange Server, CVE-2022-41040 and CVE-2022-41082. The cybersecurity community dubbed the pair of vulnerabilities ProxyNotShell. Continue reading CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
Brazilians are warned of a new Vizom malware masquerading as video conferencing and browser software. Continue reading Overlay Malware Targets Windows Users with a DLL Hijack Twist
In mid-April, our threat monitoring systems detected malicious files being distributed under the name “on the new initiative of the World Bank in connection with the coronavirus pandemic” (in Russian) with the extension EXE or RAR. Inside the files was the well-known Rovnix bootkit. Continue reading Oh, what a boot-iful mornin’
Bitdefender researchers Janos Gergo SZELES and Ruben Andrei CONDOR have documented a new Metamorfo campaign that uses legitimate software components to compromise computers. Metamorfo is a family of banker Trojans that has been active since mid-2018. I… Continue reading Banking Trojan Metamorfo Hijacks Trusted Apps to Run Malware
We recently discovered malware that spread through injecting malicious code into Windows executable files; in other words, a virus. It is the first “living” virus in recent years that we have spotted in the wild. We named it KBOT. Continue reading KBOT: sometimes they come back
The vulnerability stems from an issue with DLL loading in Open Source Hardware, used by tens of millions of computers, researchers say. Continue reading HP Touchpoint Analytics Opens PCs to Code Execution Attack
In April, Bitdefender broke the news of an emerging botnet dubbed Scranos. Originating from China, it has spread across Europe and the United States, snaring Windows and Android devices with advertising fraud and social network manipulation. Our origin… Continue reading Scranos Revisited – Rethinking persistence to keep established network alive