TAU Threat Analysis: Hakbit Ransomware

The bad actors behind Hakbit ransomware recently released an updated variant of their ransomware, which encrypts the victim’s data and demands 3 Bitcoins in ransom payment. This updated variant is delivered via phishing email as a malicious Excel document, and contains added functionality from th...

WebLogic Server Deserialization Remote Code Execution Exploit

This Metasploit module exploits a Java object deserialization vulnerability in multiple versions of WebLogic. Unauthenticated remote code execution can be achieved by sending a serialized BadAttributeValueExpException object over the T3 protocol to vulnerable versions of WebLogic. Leveraging an...

Storefront 3.12 - Cannot Join Server Group - Joining the Server Group failed. Joiner cleanup was unsuccessful. Please refer to the Windows Event Log for Details

When attempting to add a Storefront Server to a Server group the following error is observed on Joiner Server: Error:Cannot Join Server Group - Joining the Server Group failed. Joiner cleanup was unsuccessful. Please refer to the Windows Event Log for Details. See image below Event logs: Event 1 ...

TAU Threat Analysis: Medusa Locker Ransomware

In recent weeks Carbon Black’s Threat Analysis Unit TAU has seen an increase in the number of infections attributed to the Medusa Locker ransomware family. There were notable traits exhibited by Medusa Locker in these attacks that warranted further investigation to determine behavioral tactics th...

Veeam Backup for Microsoft 365 Modern App-Only Authentication Limitations

Information Veeam Backup for Microsoft 365 v8 and higher Due to Microsoft's deprecation of Basic Authentication, the only option available when adding a new Microsoft 365 organization to Veeam Backup for Microsoft 365 v8 is Modern App-Only Authentication. Veeam Backup for Microsoft 365 v7 and v7a...

TAU Threat Analysis: Medusa Locker Ransomware

In recent weeks Carbon Black’s Threat Analysis Unit TAU has seen an increase in the number of infections attributed to the Medusa Locker ransomware family. There were notable traits exhibited by Medusa Locker in these attacks that warranted further investigation to determine behavioral tactics th...

How to Remove Missing Restore Points From Veeam Cloud Connect Backups

Purpose This article documents how to handle a situation in which the tenant of a Cloud Provider needs to forget missing restore points from a backup chain stored in a Cloud Repository. By design, the Forget and Remove operations are not available for restore points in a Cloud Repository. A resto...

Turla APT Revamps One of Its Go-To Spy Tools

The Turla APT group has been spotted using an updated version of the ComRAT remote-access trojan RAT to attack governmental targets. Turla a.k.a. Snake, Venomous Bear, Waterbug or Uroboros, is a Russian-speaking threat actor known since 2014, but with roots that go back to 2004 and earlier,...

AutoRDPwn v5.1 - The Shadow Attack Framework

AutoRDPwn is a post-exploitation framework created in Powershell, designed primarily to automate the Shadow attack on Microsoft Windows computers. This vulnerability listed as a feature by Microsoft allows a remote attacker to view his victim's desktop without his consent, and even control it on...

Plesk/myLittleAdmin - ViewState .NET Deserialization (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule VIEWSTATEGENERATOR = 'CA0B0334'.freeze VIEWSTATEVALIDATIONKEY = "\x5c\x7e\xef\x66\x50\x63\x9d\x2c\xb8\xfa\xa0\xda\x36\xaf\x24\x45\x2d\xcf" ...

Plesk / myLittleAdmin ViewState .NET Deserialization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule VIEWSTATEGENERATOR = 'CA0B0334'.freeze VIEWSTATEVALIDATIONKEY = "\x5c\x7e\xef\x66\x50\x63\x9d\x2c\xb8\xfa\xa0\xda\x36\xaf\x24\x45\x2d\xcf" ...

TAU Technical Report: New Attack Combines TinyPOS With Living-off-the-Land Techniques for Scraping Credit Card Data

In April of 2020 VMware Carbon Black Threat Analysis Unit TAU researchers worked with an Incident Response IR partner on a piece of malware that was discovered during an ongoing PCI investigation. The combined analysis showed that attackers who previously leveraged a malware family called TinyPOS...

Nishang - Offensive PowerShell For Red Team, Penetration Testing And Offensive Security

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. By nikhilmitt Usage Import all the scripts in the current PowerShell session...

Update Rollup 3 for System Center 2012 R2 Data Protection Manager

Update Rollup 3 for System Center 2012 R2 Data Protection Manager Introduction This article describes new features and issues that are fixed in Update Rollup 3 for Microsoft System Center 2012 R2 Data Protection Manager DPM. Additionally, this article contains the installation instructions for...

ProLock Ransomware Teams Up With QakBot Trojan to Infect Victims

A relatively new ransomware, ProLock, has paired up with the QakBot banking trojan to access victims’ networks. ProLock’s leveraging of QakBot gives it bolstered persistence, anti-detection and credential-dumping techniques. ProLock ransomware first emerged in March as a successor to another rece...

Failed to call RPC function: Error code: 0x80131500

Challenge Backup of Remote Desktop Server VMs with Application-Aware Processing may fail with an Unknown error, error code 0x80131500. You will see error messages similar to: "Failed to call RPC function 'Vss.GetSqlInfoForLastSnapshot2': Error code: 0x80131500. Failed to invoke func...

Kali Linux 2020.2 Release - Penetration Testing and Ethical Hacking Linux Distribution

We are incredibly excited to announce the second release of 2020, Kali Linux 2020.1.2 A quick overview of what’s new since January: KDE Plasma Makeover & Login PowerShell by Default. Kind of. Kali on ARM Improvements Lessons From The Installer Changes New Key Packages & Icons Behind the Scenes,...

Microsoft researchers work with Intel Labs to explore new deep learning approaches for malware classification

The opportunities for innovative approaches to threat detection through deep learning, a category of algorithms within the larger framework of machine learning, are vast. Microsoft Threat Protection today uses multiple deep learning-based classifiers that detect advanced threats, for example,...

How to configure antivirus configuration XML file for secure restore

Challenge The article provides information on adding additional antivirus options to Veeam Backup & Replication Secure Restore. NOTE : When adding an antivirus that is not already predefined, you may need to contact the antivirus vendor for assistance to gather the required attributes and exit...

Kentico CMS 12.0.14 Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Kentico CMS Staging SyncServer Unserialize Remote Command Execution', 'Description' = %q This module exploits a vulnerability in the Kentico CMS...