Tag: SANS Internet Storm Center, InfoCON: green

https://SecTemplates.com – simplified, free open-source templates to enable engineering and smaller security teams to bootstrap security capabilities for their organizations, (Tue, Feb 18th)

This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: https://SecTemplates.com – simplified, free open-source templates to…

The Danger of IP Volatility, (Sat, Feb 15th)

What do I mean by “IP volatility”? Today, many organizations use cloud services and micro-services. In such environments, IP addresses assigned to virtual machines or services can often be volatile, meaning they can change or be reassigned to other organizations…

Fake BSOD Delivered by Malicious Python Script, (Fri, Feb 14th)

I found a Python script that implements a funny anti-analysis trick. The script has a low score on VT (4/59) (SHA256:d716c2edbcdb76c6a6d31b21f154fee7e0f8613617078b69da69c8f4867c9534)[1]. This sample attracted my attention because it uses the tkinter[2] library. This library is used to create graphical user interfaces (GUIs). It…

DShield SIEM Docker Updates, (Thu, Feb 13th)

Over the past several weeks, I have been testing various enhancements to the DShield SIEM, to process DShield sensor log from local and cloud sensors with Filebeat and Filebeat modules to easily send Zeek and NetFlow logs back to a…

Microsoft February 2025 Patch Tuesday, (Tue, Feb 11th)

This month, Microsoft has released patches addressing a total of 141 vulnerabilities. Among these, 4 are classified as critical, highlighting the potential for significant impact if exploited. Notably, 2 vulnerabilities are currently being exploited in the wild, underscoring the urgency…


Reminder: 7-Zip & MoW, (Mon, Feb 10th)

CVE-2025-0411 is a vulnerability in 7-zip that has been reported to be exploited in recent attacks. The problem is that Mark-of-Web (MoW) isn't propagated correctly: when extracted, a file inside a ZIP file inside another ZIP file will not have…

Reminder: 7-Zip & MoW, (Mon, Feb 10th)

CVE-2025-0411 is a vulnerability in 7-zip that has been reported to be exploited in recent attacks. The problem is that Mark-of-Web (MoW) isn't propagated correctly: when extracted, a file inside a ZIP file inside another ZIP file will not have…

Crypto Wallet Scam: Not For Free, (Sat, Feb 8th)

I did some research into multisig wallets (cfr “Crypto Wallet Scam”), and discovered that setting up such a wallet on the TRON network comes with a cost: about $23. This article has been indexed from SANS Internet Storm Center, InfoCON:…

Phishing via “com-” prefix domains, (Wed, Feb 5th)

Phishing is always a “whack the mole” like game. Attackers come up with new ways to fool victims. Security tools are often a step behind. Messages claiming to collect unpaid tolls are one current common theme among phishing (smishing?) messages.…

Some updates to our data feeds, (Tue, Feb 4th)

We have offered several different data feeds via our API or other means. However, we are often not very good at documenting what these feeds are all about. Currently, I am in the process of fixing the documentation around these…

Crypto Wallet Scam, (Mon, Feb 3rd)

Johannes noticed a SPAM comment on his YouTube channel: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Crypto Wallet Scam, (Mon, Feb 3rd)

From PowerShell to a Python Obfuscation Race!, (Wed, Jan 29th)

Attackers like to mix multiple technologies to improve the deployment of their malicious code. I spotted a small script that drops a Python malware. The file was sent on VirusTotal and got a score of 2/60![1] (SHA256:96bb0777a8e9616bc9ca22ca207cf434a947a3e4286c051ed98ddd39147b3c4f). The script starts…

An unusual “shy z-wasp” phishing, (Mon, Jan 27th)

Threat actors who send out phishing messages have long ago learned that zero-width characters and unrendered HTML entities can be quite useful to them. Inserting a zero-width character into a hyperlink can be used to bypass some URL security checks…

XSS Attempts via E-Mail, (Thu, Jan 23rd)

One of the hardest applications to create securely is webmail. E-mail is a complex standard, and almost all e-mail sent today uses HTML. Displaying complex HTML received in an e-mail within a web application is dangerous and often leads to…

Geolocation and Starlink, (Tue, Jan 21st)

Until now, satellite internet access has been more of a niche solution for internet access. But with the wide availability of Starlink, this is changing. Starlink's performance and price are competitive for many rural users to forgo solutions like cellular…

Partial ZIP File Downloads, (Mon, Jan 20th)

Say you want a file that is inside a huge online ZIP file (several gigabytes large). Downloading the complete ZIP file would take too long. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original…

New tool: immutable.py, (Sat, Jan 18th)

When performing triage on a Linux system you suspect might be compromised, there are many aspects of the system that you may want to look at. In SANS FOR577, we talk about some existing tools and even writing your own…

Microsoft January 2025 Patch Tuesday, (Tue, Jan 14th)

This month's Microsoft patch update addresses a total of 209 vulnerabilities, including 12 classified as critical. Among these, 3 vulnerabilities have been actively exploited in the wild, and 5 have been disclosed prior to the patch release, marking them as…

Multi-OLE, (Sun, Jan 12th)

VBA macros and embedded files/objects are stored as OLE files inside OOXML files. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Multi-OLE, (Sun, Jan 12th)

Wireshark 4.4.3 Released, (Sat, Jan 11th)

Wireshark release 4.4.3 fixes 0 vulnerabilities and 8 bugs. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Wireshark 4.4.3 Released, (Sat, Jan 11th)

Windows Defender Chrome Extension Detection, (Fri, Jan 10th)

With the recent Cyberhaven Extension(2) attack, looking for specific Chrome extensions installed can be very helpful. If you are running Defender with enhanced vulnerability management, Defender automatically catalogs installed extensions by going to Vulnerability Management -> Inventories and selecting Browser…

Make Malware Happy, (Mon, Jan 6th)

When I teach FOR610[1], I like to use a funny quotation with my students: “Make malware happy!” What does it mean? Yes, we like malware, and we need to treat it in a friendly way. To help the malware work…

SwaetRAT Delivery Through Python, (Fri, Jan 3rd)

We entered a new year, but attack scenarios have not changed (yet). I found a Python script with an interesting behavior[1] and a low Virustotal score (7/61). It targets Microsoft Windows hosts because it starts by loading all libraries required…

Goodware Hash Sets, (Thu, Jan 2nd)

In the cybersecurity landscape, we all need hashes! A hash is the result of applying a special mathematical function (a “hash function”) that transforms an input (such as a file or a piece of text) into a fixed-size string or…

Phishing for Banking Information, (Fri, Dec 27th)

It is again the time of the year when scammers are asking to verify banking information, whether it is credit cards, bank card, package shipping information, winning money, etc. Last night I received a text message to verify a credit…

Compiling Decompyle++ For Windows, (Wed, Dec 25th)

Occasionaly I decompile Python code, with decompilers written in Python. Recently I discovered Decompyle++, a Python disassembler & decompiler written in C++. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Compiling Decompyle++…

More SSH Fun!, (Tue, Dec 24th)

A few days ago, I wrote a diary[1] about a link file that abused the ssh.exe tool present in modern versions of Microsoft Windows. At the end, I mentioned that I will hunt for more SSH-related files/scripts. Guess what? I…

Modiloader From Obfuscated Batch File, (Mon, Dec 23rd)

My last investigation is a file called “Albertsons_payment.GZ”, received via email. The file looks like an archive but is identified as a picture by TrID: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original…

Christmas “Gift” Delivered Through SSH, (Fri, Dec 20th)

Christmas is at our doors and Attackers use the holiday season to deliver always more and more gifts into our mailboxes! I found this interesting file this morning: “christmas_slab.pdf.lnk”[1]. Link files (.lnk) are a classic way to execute something malicious…

Python Delivering AnyDesk Client as RAT, (Tue, Dec 17th)

RATs or “Remote Access Tools” are very popular these days. From an attacker&#x27s point of view, it&#x27s a great way to search and exfiltrate interesting data but also to pivot internally in the network. Besides malicious RATs, they are legit…