Raccine

Raccine A Simple Ransomware Protection Why We see ransomware delete all shadow copies using vssadmin pretty often. What if we could just intercept that request and kill the invoking process? Let's try to create a simple vaccine. How it works We register a debugger for vssadmin.exe and wmic.exe,...

ThreatIntelligenceDiscordBot

Threat Intelligence Discord Bot The vx-underground Threat Intelligence Discord Bot gets updates from various clearnet domains, ransomware threat actor domains, and Telegram channels. This bot will check for updates in intervals of 1800 seconds omit Telegram bot, this is gotten in real time. Don't...

ESXi-Ransomware-Scanner-mi

ESXiransomwarescanner A program that scans IP addresses for signs of ESXi compromise by grabbing the ransom note from an html page and comparing the strings. Requirements python 3.x requests BeautifulSoup tqdm colorama Installation Use the package manager pip to install the required packages...

FalconGate

Falcongate An advanced cybersecurity platform to stop Malware, Ransomware, detect cyber attacks and more... Motivation Cyber attacks are on the raise and the cyber criminals are continuously improving their tactics and developing new tools and Malware to achieve their goals of breaching their...

cpanel-cve-41940-detector

cPanel IOC Detector for CVE-2026-41940 Read-only IOC detector for cPanel/WHM servers that may have been affected by CVE-2026-41940 and related post-compromise activity. The script helps an operator review .sorry ransomware indicators, MrRot13 Filemanager backdoor traces, suspicious cron entries,...

RansomLord

RansomLord NG v1.0 Anti-Ransomware exploit tool. Proof-of-concept tool that automates the creation of PE files, used to exploit ransomware pre-encryption. Updated version NG: https://github.com/malvuln/RansomLord/releases/tag/v1.0 Lang: C SHA256:...

Umbra

Umbra Umbra is an experimental remotely controllable LKM rootkit for kernels 4.x and 5.x up to 5.7 which opens a network backdoor that can spawn reverse shells to remote hosts, launch malware remotely and much more. The rootkit is still under development, although the features listed below are...

melee

MELEE: A Tool to Detect Ransomware Infections in MySQL Instances Attackers are abusing MySQL instances for conducting nefarious operations on the Internet. The cybercriminals are targeting exposed MySQL instances and triggering infections at scale to exfiltrate data, destruct data, and extort mon...

CVE-2024-30851-jasmin-ransomware-path-traversal-poc

Jasmin ransomware web panel path traversal PoC EducationalPurposes https://github.com/codesiddhant/Jasmin-Ransomware I discovered a pre-auth path traversal vulnerability in the Jasmin Ransomware web panel CVE-2024-30851, allowing an attacker to deanonymize panel operators and dump decryption keys...

strafer

Strafer Elasticsearch infections are rising exponentially. The adversaries are exploiting open and exposed Elasticsearch interfaces to trigger infections in the cloud and non-cloud deployments. During this talk, we will release a tool named "STRAFER" to detect potential infections in the...

strafer

Strafer Las infecciones en Elasticsearch están aumentando exponencialmente. Los adversarios están explotando interfaces de Elasticsearch abiertas y expuestas para desencadenar infecciones en implementaciones en la nube y fuera de ella. Durante esta charla, lanzaremos una herramienta llamada...

CVE-2022-47986

CVE-2022-47986 Perché Questa vulnerabilità viene sfruttata in the wild. IceFire usa questa vulnerabilità per distribuire il ransomware sui sistemi presi di mira; vorrei aiutare i team SOC/Blue a identificare i sistemi interessati e i Pentester/Red team a sfruttarla e segnalarla. Descrizione...

tarian

Tarian Vogliamo mantenere questo progetto open-source per combattere gli attacchi al nostro ecosistema Kubernetes preferito. Possiamo combattere le minacce insieme come comunità, attraverso un contributo continuo. Proteggi le tue applicazioni in esecuzione su Kubernetes da attacchi malevoli...

Exploit-CVE-2014-4210-

INIZIA CON UNA COSA FIGA AMICOUSALA PER SCOP&RE POTENZIAMENTI PER CAUSARE SOFFERENZA UMANA: 1. Verme Auto-Replicante : Si diffonde tramite brute-force SSH/exploit SMB verso tutte le reti connesse. 2. Sovrascrittura MBR : Rende inutilizzabile l'hardware fisico distruggendo le tabelle delle...

EthernalBlue_report

EthernalBlue-Bericht Was ist das? Dies ist ein vom NSA entwickelter Exploit, der von einer Hackergruppe gestohlen wurde und vor allem für den Einsatz bei Ransomware-Angriffen wie WannaCry oder NotPetya bekannt ist... Warum hast du diesen Bericht erstellt? Ich wurde gebeten, diesen Bericht über de...

Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run...

LockBit-Tattoo

LockBit-Tattoo Electronic: ID: 272784 Iscritto: Jul 20, 2022 Maschio: BTC: 3HeNJmgecLNHEhVn3JMcboybTgiFx4DGe3 Media: photo2022-09-0822-15-38.jpg Femmina: BTC: 3HC5eCcYtW27jhD59mg4U3haWr36teiLXB Media: photo2022-09-1101-07-49.jpg photo2022-09-1101-07-54.jpg DegB2W: ID: 272203 Iscritto: Jul 16, 202...

GwisinMsi

GwisinMsi Questo repository contiene la PoC del payload MSI utilizzato nel post del blog. Il payload si basa sull'analisi del payload MSI del ransomware Gwisin effettuata dal team AhnLab ASEC nel loro post del blog. Configurazione di compilazione DLL Progetto Proprietà del progetto C/C++...

Malware

Regole YARA, programmi per famiglie di ransomware: Akira Babuk Beast BlackByte BlackCat ALPHV BlackMatter BlueLocker MemeCryptor Cerber Conti DarkBit DeadBolt Dharma Enmity GarrantyDecrypt GlobeImposter / NewBomani GoodMorning / SD HardBit Hive / Hunters International HsHarada / Rapture Hunters...

ESXi_ransomware_bitcoinWallets

Hintergrund https://blog.ovhcloud.com/ransomware-targeting-vmware-esxi/ https://twitter.com/ValeryMarchive/status/1621528499315150849 Beispiel einer Lösegeldforderung: Opfer bisher Bisher verwendete Wallets1. 1N8v8sRa2RdYq4xUUwpEePFT34TMzesPUx 2. 15vx9oDSQTJuAoYCL1VwzVBDgKYexRHpyC 3...