research

Analysis and Impact of LockBit Ransomware’s First Linux and VMware ESXi Variant

Posted on by Admin
Analysis and Impact of LockBit Ransomware’s First Linux and VMware ESXi Variant

Analysis and Impact of LockBit Ransomware’s First Linux and VMware ESXi Variant Ransomware LockBit ransomware’s operators announced the release of its first Linux and ESXi variant in October. With samples also spotted in the wild, we discuss the impact and analysis of this variant. By: Junestherry Dela Cruz January 24, 2022 Read time:  ( words) In our monitoring of the LockBit ransomware’s intrusion set, we found an announcement for LockBit Linux-ESXi Locker version 1.0 on…

Read More

Codex Exposed Task Automation and Response Consistency

Posted on by Admin
Codex Exposed Task Automation and Response Consistency

Codex Exposed Task Automation and Response Consistency Cyber Threats Being able to automate tasks or programmatically execute them unsupervised is an essential part of both regular and malicious computer usage, so we wondered if a tool like Codex was reliable enough to be scripted and left to run unsupervised, generating the required code. By: Forward-Looking Threat Research Team January 21, 2022 Read time:  ( words) In June 2020, OpenAI released version 3 of its Generative…

Read More

Cybersecurity for Industrial Control Systems: Part 2

Posted on by Admin
Cybersecurity for Industrial Control Systems: Part 2

Legacy malware had the most detections in India, China, the US, and Taiwan. For coinminer, Equated malware, and WannaCry, India had the most detections. On the other hand, Japan had the most Emotet infections, while ICSs in Germany had the most adware incidents. Through this extensive research, we found that there were several malware threats that pose a great risk on ICSs. By identifying these threats, we can now determine various steps that your enterprise…

Read More

New Ransomware Spotted: White Rabbit and Its Evasion Tactics

Posted on by Admin
New Ransomware Spotted: White Rabbit and Its Evasion Tactics

New Ransomware Spotted: White Rabbit and Its Evasion Tactics Ransomware We analyze the ransomware White Rabbit and bring into focus the familiar evasion tactics employed by this newcomer. By: Arianne Dela Cruz, Bren Matthew Ebriega, Don Ovid Ladores, Mary Yambao January 18, 2022 Read time:  ( words) We spotted the new ransomware family White Rabbit discretely making a name for itself by executing an attack on a local US bank in December 2021. This newcomer takes a page from Egregor, a more established ransomware family, in hiding its malicious activity and carries a potential connection to the advanced persistent…

Read More

Earth Lusca Employs Sophisticated Infrastructure, Varied Tools and Techniques

Posted on by Admin
Earth Lusca Employs Sophisticated Infrastructure, Varied Tools and Techniques

Since mid-2021, we have been investigating a rather elusive threat actor called Earth Lusca that targets organizations globally via a campaign that uses traditional social engineering techniques such as spear phishing and watering holes. The group’s primary motivation seems to be cyberespionage: the list of its victims includes high value targets such as government and educational institutions, religious movements, pro-democracy and human rights organizations in Hong Kong, Covid-19 research organizations, and the media, among others. However,…

Read More

Cybersecurity for Industrial Control Systems: Part 1

Posted on by Admin
Cybersecurity for Industrial Control Systems: Part 2

Cybersecurity for Industrial Control Systems: Part 1 Ransomware In this two-part series, we look into various cybersecurity threats that affected industrial control systems endpoints. We also discuss several insights and recommendations to mitigate such threats. By: Trend Micro Research January 15, 2022 Read time:  ( words) The ever-changing technological landscape has made it possible for the business process on the IT side of an enterprise to be interconnected with the physical process on the OT…

Read More

Analyzing an Old Bug and Discovering CVE-2021-30995

Posted on by Admin
Analyzing an Old Bug and Discovering CVE-2021-30995

On April 26, 2021 Apple patched CVE-2021-1740, which was a vulnerable function inside the system daemon process cfprefsd (these types of processes usually run in the background and handle system tasks). The bug could have been exploited to read arbitrary files, write arbitrary files, and get root privilege escalation. It was addressed in Apple’s Security Update 2021-002 (Catalina) for a variety of Apple operating systems, including iOS and macOS. However, in early August 2021, Zhipeng…

Read More

Codex Exposed How Low Is Too Low When We Generate Code

Posted on by Admin
Codex Exposed How Low Is Too Low When We Generate Code

Codex Exposed How Low Is Too Low When We Generate Code In a series of blog posts, we explore different aspects of Codex and assess its capabilities with a focus on the security aspects that affect not only regular developers but also malicious users. This is the second part of the series. By: Forward-Looking Threat Research Team January 14, 2022 Read time:  ( words) In June 2020, OpenAI released version 3 of its Generative Pre-trained…

Read More

LoRaWAN’s Protocol Stacks: The Forgotten Targets at Risk

Posted on by Admin
LoRaWAN’s Protocol Stacks: The Forgotten Targets at Risk

First, we compiled the code into something easily handled by a fuzzer. For our purposes, we used the generation method that will allow us to cover as many code paths as possible with legitimate and dumb fuzzing using the AFL++ framework (evolution of AFL). This supplies some instrumentation for mutating pseudorandom bits, bytes, and words. We also attempted to collect every type of message that could be interpreted by the parser. We used the persistent…

Read More

Defending Systems Against Attacks With Layers of Remote Control

Posted on by Admin
Defending Systems Against Attacks With Layers of Remote Control

Fortunately, we were able to provide the customer with timely alert and intervention from the moment the initial intrusion via the cloud server was observed all the way to guidance during the cleanup and remediation process. Insights from the threat report and the threat handling perspective Incidents such as this provide security teams opportunities to see attacks from different angles and in a big-picture manner. We discuss key insights below that organizations can consider when…

Read More
1 … 14 15 16 17 18