home.social

#threatresearch — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #threatresearch, aggregated by home.social.

  1. AA @[email protected] ·

    New.

    "The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12. It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected."

    Rapid7: DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors rapid7.com/blog/post/tr-dprk-a @Rapid7Official #infosec #cybercrime #threatresearch #Linux

    #infosec #cybercrime #threatresearch #linux
  2. AA @[email protected] ·

    New.

    "The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12. It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected."

    Rapid7: DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors rapid7.com/blog/post/tr-dprk-a @Rapid7Official #infosec #cybercrime #threatresearch #Linux

    #infosec #cybercrime #threatresearch #linux
  3. AA @[email protected] ·

    New.

    "The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12. It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected."

    Rapid7: DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors rapid7.com/blog/post/tr-dprk-a @Rapid7Official #infosec #cybercrime #threatresearch #Linux

    #infosec #cybercrime #threatresearch #linux
  4. AA @[email protected] ·

    New.

    "The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12. It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected."

    Rapid7: DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors rapid7.com/blog/post/tr-dprk-a @Rapid7Official #infosec #cybercrime #threatresearch #Linux

    #linux #threatresearch #cybercrime #infosec
  5. AA @[email protected] ·

    New.

    "The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12. It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected."

    Rapid7: DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors rapid7.com/blog/post/tr-dprk-a @Rapid7Official #infosec #cybercrime #threatresearch #Linux

    #infosec #cybercrime #threatresearch #linux
  6. AA @[email protected] ·

    Note: the actor in question targets Russian organizations.

    Kaspersky: Angry Birds: Toy Ghouls’ new toys securelist.com/toy-ghouls-new- @Kaspersky #infosec #threatresearch #cybercrime

    #infosec #threatresearch #cybercrime
  7. AA @[email protected] ·

    Note: the actor in question targets Russian organizations.

    Kaspersky: Angry Birds: Toy Ghouls’ new toys securelist.com/toy-ghouls-new- @Kaspersky #infosec #threatresearch #cybercrime

    #infosec #threatresearch #cybercrime
  8. AA @[email protected] ·

    Note: the actor in question targets Russian organizations.

    Kaspersky: Angry Birds: Toy Ghouls’ new toys securelist.com/toy-ghouls-new- @Kaspersky #infosec #threatresearch #cybercrime

    #infosec #threatresearch #cybercrime
  9. AA @[email protected] ·

    Note: the actor in question targets Russian organizations.

    Kaspersky: Angry Birds: Toy Ghouls’ new toys securelist.com/toy-ghouls-new- @Kaspersky #infosec #threatresearch #cybercrime

    #cybercrime #threatresearch #infosec
  10. AA @[email protected] ·

    Note: the actor in question targets Russian organizations.

    Kaspersky: Angry Birds: Toy Ghouls’ new toys securelist.com/toy-ghouls-new- @Kaspersky #infosec #threatresearch #cybercrime

    #infosec #threatresearch #cybercrime
  11. TechNadu @[email protected] ·

    Threat actors continue to operationalize current-events lures as part of malware delivery chains.

    Recent research shows a backdoor deployed via attachments themed around breaking geopolitical news, using legitimate binaries and DLL sideloading techniques for persistence.

    No attribution assumptions - just a reminder that contextual relevance remains one of the most effective social engineering tools.

    What controls have you found most effective against news-driven phishing?

    Engage with us in the comments and follow @technadu for practical threat intelligence coverage.

    Source: darktrace.com/blog/maduro-arre

    #InfoSec #ThreatResearch #MalwareTTPs #PhishingDefense #CyberOperations #ThreatDetection #TechNadu

    #infosec #threatresearch #malwarettps #phishingdefense #cyberoperations #threatdetection
  12. mle✨ @[email protected] ·

    Home from #LABScon23 and I know I’ll be thinking about many of these talks and the great conversations for days to come. Getting to talk a bit about the Internet presence and security of #MFT tools like #MOVEit and #GoAnywhere was an added bonus 📂☺️🗄️

    #threatResearch #security #infosec

    #labscon23 #mft #moveit #goanywhere #threatresearch #security
  13. Renée Burton @[email protected] ·

    A few months ago I posted about a DNS malware C2 we had discovered— Decoy Dog — that was based on Pupy, had been undetected for over a year, and had some inexplicable behavior. We hoped the community would easily find the infected devices based on the info we provided. No suck luck. Since then we have used DNS to learn and an astonishing amount about the operations. Once we realized Decoy Dog was more advanced than Pupy, and we saw how the actors responded to our original relesases, we went back to the binaries. Today we released an indepth technical analysis of Decoy Dog, a Pupy research data set, and a new Yara rule. This is the exec summary. Link to the full technical paper and other tidbits in the comments. #dns #theatintel #malware #decoydog #rat #c2 #infoblox #datascience #threatresearch blogs.infoblox.com/cyber-threa

    #dns #theatintel #malware #decoydog #rat #c2