A sophisticated remote access Trojan (RAT) has been discovered operating within a legitimate Windows process, using advanced evasion techniques. The malware's PE and DOS headers were deliberately corrupted, making traditional analysis difficult. Fortinet's FortiGuard Incident Response Team analyzed the malware using a full memory dump, recreating the compromised environment. The RAT's features include screenshot capture, remote server mode, and service control. It uses over 250 Windows APIs, encrypts C2 communications, and employs custom XOR-based encryption. The analysis highlights the need for enhanced security measures, including monitoring of legitimate processes, memory analysis tools, and network traffic analysis to defend against such sophisticated threats.
In late October 2024, a government website was discovered hosting malware targeting multiple government entities. The malware, dubbed TOUGHPROGRESS, utilized Google Calendar for command and control. Attributed to APT41, a PRC-based actor, the campaign targeted global organizations in various sectors. The malware infection chain involved three modules: PLUSDROP, PLUSINJECT, and TOUGHPROGRESS, employing stealth and evasion techniques. TOUGHPROGRESS used encrypted Calendar events for communication. Google Threat Intelligence Group disrupted the campaign by developing custom fingerprints, terminating attacker-controlled infrastructure, and updating Safe Browsing. APT41 has been observed using free web hosting tools and URL shorteners for malware distribution since August 2024. The blog post provides indicators of compromise and YARA rules to aid in detection and defense against similar attacks.
The TA-ShadowCricket group, formerly known as Shadow Force, has been active in the Asia-Pacific region since 2012, targeting Windows servers and MS-SQL servers. They operate an IRC server with over 2,000 affected IPs in 72 countries. The group uses various malware and tools, including Upm, SqlShell, Maggie, and Wgdrop. Their activities involve three stages: initial access and reconnaissance, backdoor deployment, and additional malicious behaviors. The group has connections to China and has been quietly stealing information for over 13 years without demanding ransom or releasing stolen data. Their persistent activity suggests preparation for potential large-scale attacks in the future.
A new malicious campaign has been discovered targeting the Python Package Index (PyPI) by exploiting the Pickle file format in machine learning models. Three malicious packages posing as an Alibaba AI Labs SDK were detected, containing infostealer payloads hidden inside PyTorch models. The packages exfiltrate information about infected machines and .gitconfig file contents. This attack demonstrates the evolving threat landscape in AI and machine learning, particularly in the software supply chain. The campaign likely targeted developers in China and highlights the need for improved security measures and tools to detect malicious functionality in ML models.
In this post, I break down how the BadUSB attack works—starting from its origin at Black Hat 2014 to a hands-on implementation using an Arduino UNO and custom HID firmware. The attack exploits the USB protocol's lack of strict device type enforcement, allowing a USB stick to masquerade as a keyboard and inject malicious commands without user interaction.
The write-up covers:
* How USB device firmware can be repurposed for attacks
* Step-by-step guide to converting an Arduino UNO into a BadUSB
A new Dero mining campaign is infecting containerized Linux environments through exposed Docker APIs. The attack uses two Golang malware components: 'nginx' for propagation and 'cloud' for mining. The 'nginx' malware scans for vulnerable Docker hosts, creates malicious containers, and compromises existing ones. It maintains persistence and spreads without a command-and-control server. The 'cloud' component is a modified DeroHE CLI miner with hardcoded wallet and node addresses. This campaign demonstrates the potential risks of insecurely published Docker APIs and the need for robust container security measures.
