AntiVirus Evasion Tool: AVET

AVET is an AntiVirus Evasion Tool, which was developed for making life easier for pentesters and for experimenting with antivirus evasion techniques. What & Why: when running an exe file made with msfpayload & co, the exe file will often be recognized by the antivirus software avet is a antivirus...

Fraudsters Using GiftGhostBot Botnet to Steal Gift Card Balances

Gift cards have once again caused quite a headache for retailers, as cyber criminals are using a botnet to break into and steal cash from money-loaded gift cards provided by major retailers around the globe. Dubbed GiftGhostBot, the new botnet specialized in gift card fraud is an advanced...

Blank Slate Campaign Pushes Cerber Ransomware

Criminals are breathing new life into Cerber ransomware with a stubborn spam campaign called Blank Slate that is successfully abusing hosting providers to spread the malware. Researchers at the SANS Internet Storm Center said the campaign has shifted from spreading Sage 2.0 and Locky ransomware, ...

UBUNTU-CVE-2017-7177

Suricata before 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching...

CVE-2017-7177

Suricata before 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching...

Design/Logic Flaw

Suricata before 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching...

CVE-2017-7177

Suricata before 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching...

DEBIAN-CVE-2017-7177

Suricata before 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching...

CVE-2017-7177

Suricata before 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching...

CVE-2017-7177

Suricata (IDS/IPS) is affected by CVE-2017-7177 due to an IPv4 defragmentation evasion flaw: it does not check the IP protocol during fragment matching. This can enable an attacker to craft fragments that bypass reassembly/detection. Affected are Suricata releases prior to 3.2.1. Remediation: upg...

CVE-2017-7177

Suricata before 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching...

CVE-2015-8986

Sandbox detection evasion vulnerability in hardware appliances in McAfee now Intel Security Advanced Threat Defense MATD 3.4.2.32 and earlier allows attackers to detect the sandbox environment, then bypass proper malware detection resulting in failure to detect a malware file false-negative via...

Design/Logic Flaw

Sandbox detection evasion vulnerability in hardware appliances in McAfee now Intel Security Advanced Threat Defense MATD 3.4.2.32 and earlier allows attackers to detect the sandbox environment, then bypass proper malware detection resulting in failure to detect a malware file false-negative via...

CVE-2015-8986

CVE-2015-8986 is described as a sandbox-detection evasion vulnerability in McAfee/Intel Security Advanced Threat Defense (MATD) versions up to 3.4.2.32. The issue allows malware to detect the sandbox environment and bypass malware detection, resulting in false negatives. The available sources ide...

CVE-2015-8986

Sandbox detection evasion vulnerability in hardware appliances in McAfee now Intel Security Advanced Threat Defense MATD 3.4.2.32 and earlier allows attackers to detect the sandbox environment, then bypass proper malware detection resulting in failure to detect a malware file false-negative via...

StoneDrill Disk Wiping Malware Found Targeting European Industries

A new disk wiping malware has been uncovered targeting a petroleum company in Europe, which is quite similar to the mysterious disk wiper malware Shamoon that wiped data from 35,000 computers at Saudi Arabia's national oil company in 2012. Disk wiping malware has the ability to cripple any...

Antivirus Evasion Framework: Veil Framework

Antivirus Evasion Framework: Veil Framework The Veil-Framework is a collection of red team security tools that implement various attack methods focused on evading detection. It currently consists of: Veil-Evasion : a tool to generate antivirus-evading payloads using a variety of techniques and...

AntiVirus Evasion Reconstructed – Veil 3.0

The Veil Framework is a collection of tools designed for use during offensive security testing. When the time calls for it, Mandiant’s Red Team will use the Veil-Framework to help achieve their objective. The most commonly used tool is Veil-Evasion, which can turn an arbitrary script or piece of...

AntiVirus Evasion Reconstructed – Veil 3.0

The Veil Framework is a collection of tools designed for use during offensive security testing. When the time calls for it, Mandiant’s Red Team will use the Veil-Framework to help achieve their objective. The most commonly used tool is Veil-Evasion, which can turn an arbitrary script or piece of...

Spear Phishing Techniques Used in Attacks Targeting the Mongolian Government

Introduction FireEye recently observed a sophisticated campaign targeting individuals within the Mongolian government. Targeted individuals that enabled macros in a malicious Microsoft Word document may have been infected with Poison Ivy, a popular remote access tool RAT that has been used for...