Category: SANS Internet Storm Center, InfoCON: green

AutoIT Payload Injector , (Tue, Jul 28th)

For a long time, AutoIT[1] has been pretty common in the malware ecosystem. Threat actors still use it because it's easy to write and powerful. Indeed, it can perform all the required actions to inject a payload into a remote…

Java Spring Boot “heapdump” scans, (Mon, Jul 27th)

Spring Boot exposes the endpoint "/actuator/heapdump" to collect debug information. By default, the endpoint will return a file heapdump.hprof, which includes a binary heapdump that can be used to analyze the current state of the application. Non-Java readers may be…

Rondo Meets Geoserver, (Wed, Jul 22nd)

This isn't a new attack, but something I saw “pop-up” in our logs this week: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Rondo Meets Geoserver, (Wed, Jul 22nd)