Windows-SignedBinary

異なるハッシュを持つWindows署名付きバイナリを生成する このアイデアは、「regsvr32.exe」などの既知の「悪意のある」署名付きアプリケーションをブロックするエンドポイントソリューションをバイパスすることでした。 有効な署名付きファイルで、異なるハッシュを持つものを取得する方法を探していました。 分析 signtool verify /v /a cmd.exe を使用 root@kitploit: C:\signchecksigntool verify /a /v cmd.exe Verifying: cmd.exe File is signed in catalog:...

BYOSI

BYOSI EDR을 우회하는 간단한 방법: 후킹된 API를 전혀 건드리지 않는 것. 이론 대부분의 EDR이 스크립팅 파일을 스캔하지 못하고 단순 텍스트 파일로 취급한다는 점을 발견했습니다. EDR 입장에서는 불행한 일이지만, 우리에게는 이익을 얻을 기회입니다. 메모리 상주나 스레드 인젝션 같은 화려한 방법은 철저히 모니터링됩니다. 유효한 인증 기관CA이 서명한 바이너리가 없으면 실행이 거의 불가능합니다. BYOSIBring Your Own Scripting Interpreter를 소개합니다. 모든 스크립팅 인터프리터는 제작자가...

SharpWSUS

SharpWSUS SharpWSUS는 WSUS를 통한 측면 이동Lateral Movement을 위한 CSharp 도구입니다. 도구, 사용 사례 및 탐지에 대한 자세한 정보는 관련 블로그https://labs.nettitude.com/blog/introducing-sharpwsus/에서 확인할 수 있습니다. 크레딧 아래 리소스들은 이 작업의 90%를 완료해 주었습니다. 이 도구는 C2 안정성과 유연성을 위해 아래 도구들을 개선한 것에 불과합니다. https://github.com/AlsidOfficial/WSUSpendu -...

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the...

Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign

A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering ...

Arbitrary Code Injection

Overview desktop-electron is a My Electron application description Affected versions of this package are vulnerable to Arbitrary Code Injection via the ELECTRONRUNASNODE environment variable. An attacker can execute arbitrary code with the application's entitlements and code signature by launchin...

CVE-2026-42890: Improper Control of Generation of Code

Actual is an open-source personal finance application. In the macOS desktop application version 25.x built on Electron 39.2.7, the ELECTRONRUNASNODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app binary wit...

PT-2026-47558

Summary A electron run as node vulnerability was identified in actual macOS application, version 25.x Electron 39.2.7. Vulnerability Type: Electron Run As Node Description ELECTRON RUN AS NODE fuse enabled Electron 39.2.7 — app can be converted to Node.js REPL for arbitrary code execution Impact ...

PT-2026-47599

Name of the Vulnerable Software and Affected Versions Actual versions prior to 26.5.0 Description In the macOS desktop application, the ELECTRON RUN AS NODE fuse is not disabled. This allows an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app...

Backdoored 3CXDesktopApp Installer Used in Active Threat Campaign

Emergent threats evolve quickly. We will update this blog with new information as it comes to light and we are able to verify it. Erick Galinkin, Ted Samuels, Zach Dayton, Eoin Miller, Caitlin Condon, Stephen Fewer, Spencer McIntyre, and Christiaan Beek all contributed to this blog. On Wednesday,...

New PlugX variant “Talisman” used by famous Chinese APT

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here PlugX is a well-known malware family with samples dating back to as early as 2008. A Chinese state-backed threat actor, RedFoxtrot group, is discovered to use a new variant of the PlugX malware, Talisman. The threat actor grou...

North Korean state-sponsored threat actor Lazarus Group exploiting Chrome Zero-day vulnerability

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here For more than a month before a fix was available, North Korean state hackers known as Lazarus group exploited a zero-day, remote code execution vulnerability CVE-2022-0609 in Google Chromes web browser. The attack mainly targe...

Mustang Panda targets European diplomats using enhanced PlugX backdoor

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Mustang Panda, a Chinese cyberespionage group, has been targeting European diplomats with a revised version of the PlugX backdoor in an ongoing campaign linked to the ongoing conflict in Ukraine. The group, also known as...

Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables

THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...

New SEO Poisoning Campaign Distributing Trojanized Versions of Popular Software

An ongoing search engine optimization SEO poisoning attack campaign has been observed abusing trust in legitimate software utilities to trick users into downloading BATLOADER malware on compromised machines. "The threat actor used 'free productivity apps installation' or 'free software developmen...

ManageEngine ADSelfService Plus has been abused in the wild due to a zero-day vulnerability

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. An APT actor is attempting to exploit a zero-day vulnerability in ManageEngine ADSelfService Plus, a self-service password management and single sign-on solution that poses a high risk to critical infrastructure companies,...

CVE-2020-1313

An elevation of privilege vulnerability exists when the Windows Update Orchestrator Service improperly handles file operations, aka ‘Windows Update Orchestrator Service Elevation of Privilege Vulnerability’. Recent assessments: bwatters-r7 at September 18, 2020 9:01pm UTC reported: This...

Applocker Evasion - Windows Presentation Foundation Host

This module will assist you in evading Microsoft Windows Applocker and Software Restriction Policies. This technique utilises the Microsoft signed binary PresentationHost.exe to execute user supplied code. This module requires Metasploit: https://metasploit.com/download Current source:...

Applocker Evasion - MSBuild

This module will assist you in evading Microsoft Windows Applocker and Software Restriction Policies. This technique utilises the Microsoft signed binary MSBuild.exe to execute user supplied code. This module requires Metasploit: https://metasploit.com/download Current source:...

Check Point Endpoint Security Client Command Execution Vulnerability

Check Point Endpoint Security Client is an endpoint security protection software from Check Point Israel. A security vulnerability exists in Check Point Endpoint Security Client versions prior to E81.00 with Anti-Malware blade installed for Windows-based platforms. An attacker with administrator...