Aggregator

Summary After responding to multiple incidents in a single network, Secureworks was able to identify connections between the SUPERNOVA web shell and the SPIRAL threat group. Threat Type Malware, Web Shell Overview Secureworks published a blog post detailing a potential connection between the SUPERNOVA web shell and the SPIRAL threat group. This connection was made after responding to multiple incidents on a single network. The first incident occurred early in 2020, although the threat actor may have been on

Validating Admission Webhook does not observe some previous fields

Summary SAP has released its March 2021 security patches for a variety of products. Each product and a link to details on the vulnerability are listed below. In all, 13 security notes were released. Of these, 4 are rated critical, 1 is rated high, 5 are rated as medium, and 4 are updates to previously released patches. The most serious post-exploitation action, if the vulnerability is exploited, is remote code execution. In addition, privilege escalation, accessing sensitive files, and other nefarious actio

Summary TeamTNT is known to attack cloud services with intent to steal credentials, perform cryptojacking, or install backdoors. Trend Micro reports on a specific script used by the group to steal AWS credentials. Threat Type Malware Overview Trend Micro has published an analysis of a shell script used by TeamTNT to steal AWS credentials. This script was found hardcoded in a malicious binary dropped onto compromised systems. It was likely dropped onto systems after the threat actor exploited a misconfigurat

Summary Dr. Web Virus Laboratory analyzed a backdoor they've named Spyder after it was discovered at a telecommunication company based in Central Asia in December 2020. The backdoor was loaded into the system using the DLL Hijacking method. It's a modular backdoor and can utilize plug-ins it receives from it's C&C server. Threat Type Malware, Backdoor Overview A new modular backdoor was analyzed by the Doctor Web virus laboratory. It was discovered by a telecommunications company based in Central Asia in De

隐私产品细节探究

隐私产品细节探究

隐私产品细节探究

Summary Microsoft and FireEye have identified new malware that is believed to be used by the same attackers who attacked SolarWinds. FireEye refers to them as UNC2452, Microsoft has named them NOBELIUM. One notable feature available in the backdoor is the option to use decoy network traffic mixed in with C2 queries. Threat Type Malware, Backdoor, RAT Overview FireEye has discovered a new sophisticated second-stage backdoor that is possibly connected to UNC2452, the same group believed to be behind the attac

We are pleased to announce the launch of EdgeKV, our distributed key-value store, into beta! EdgeKV is enabling technology for EdgeWorkers, our serverless computing platform that enables developers to create services using JavaScript and deploy them across our platform. When writing JavaScript, data persistence is often necessary to save data from a user interaction, or to retrieve contextual data to evaluate inside a function.

0x00 前言偶然间看到SnakeYaml的资料感觉挺有意思，发现SnakeYaml也存在反序列化利用的问题

0x00 前言偶然间看到SnakeYaml的资料感觉挺有意思，发现SnakeYaml也存在反序列化利用的问题

0x00 前言偶然间看到SnakeYaml的资料感觉挺有意思，发现SnakeYaml也存在反序列化利用的问题

0x00 前言偶然间看到SnakeYaml的资料感觉挺有意思，发现SnakeYaml也存在反序列化利用的问题

0x00 前言偶然间看到SnakeYaml的资料感觉挺有意思，发现SnakeYaml也存在反序列化利用的问题

0x00 前言偶然间看到SnakeYaml的资料感觉挺有意思，发现SnakeYaml也存在反序列化利用的问题

Summary Adobe has released three security updates. The updates are for Framemaker, Creative Cloud Desktop Application, and Connect. Each of the updates address at least one vulnerability rated by Adobe as Critical. Threat Type Vulnerability Overview Adobe has released three security updates. The updates are for Framemaker, Creative Cloud Desktop Application, and Connect. Each of the updates address at least one vulnerability rated by Adobe as Critical. The potential impact of successful exploitation of the

Summary In their March 2021 security updates, Microsoft list eighty-three CVE numbered vulnerabilities. Of those, ten are rated as Critical with the remainder being rated as Important. Aside from the already well publicized exploitation of the Exchange server vulnerabilities, an Internet Explorer vulnerability is reported as being exploited in the wild. Threat Type Vulnerability Overview In their March 2021 security updates, Microsoft list eighty-three CVE numbered vulnerabilities. Of those, ten are rated a

Summary In the wake of a targeted attack against CD Projekt Red, SentinelOne has published a blog post analyzing the HelloKitty ransomware. Threat Type Ransomware Overview SentinelOne has published a blog post analyzing the HelloKitty ransomware family, which was recently leveraged in a targeted attack against CD Projekt Red. HelloKitty appeared in late 2020 and is relatively rudimentary compared to other ransomware families. For example, when processes are being killed a CMD window is spawned in the foregr