CodeBreach

CodeBreach - Your trusted source for the latest news and updates on the constantly evolving world of cyber hacking, data breaches, and digital security. Stay informed and stay protected with CodeBreach.

Search This Blog

Showing posts with the label Firewall

View all

Posts

The Great Firewall Breach: Unmasking SugarGh0st RAT's Covert Assault on Uzbekistan and South Korea

on December 01, 2023

Get link
Facebook
X
Pinterest
Email
Other Apps

Breaking Boundaries: Unveiling SLAM - The Covert Threat to Intel, AMD, and Arm CPUs

Researchers from the Vrije Universiteit Amsterdam have uncovered a new side-channel attack dubbed SLAM, capable of exploiting current and upcoming CPUs from Intel, AMD, and Arm. The attack exploits a feature in Intel CPUs called Linear Address Masking (LAM), analogous counterparts from AMD (Upper Address Ignore or UAI), and Arm (Top Byte Ignore or TBI). SLAM serves as an end-to-end exploit for Spectre, utilizing unmasked gadgets to leak arbitrary ASCII kernel data. This could potentially lead to the leakage of sensitive information, such as the root password hash, from kernel memory within minutes. While LAM is introduced as a security feature, the research indicates that it ironically diminishes security and significantly expands the Spectre attack surface. The attack involves a transient execution attack, leveraging speculative execution to extract sensitive data through a cache covert channel. Described as the first transient execution attack...

Unveiling Cyber Espionage Tango: Sandman and Storm-0866 Dance with China's KEYPLUG in Coordinated Symphony

Tactical and targeting overlaps have been discovered between the enigmatic advanced persistent threat (APT) called Sandman and a China-based threat cluster that's known to use a backdoor known as KEYPLUG. The assessment comes jointly from SentinelOne, PwC, and the Microsoft Threat Intelligence team based on the fact that the adversary's Lua-based malware LuaDream and KEYPLUG have been determined to cohabit "in the same victim networks." "There are strong overlaps in operational infrastructure, targeting, and TTPs associating the Sandman APT with China-based adversaries using the KEYPLUG backdoor, STORM-0866/Red Dev 40 in particular," the researchers said. "This highlights the complex nature of the Chinese threat landscape." For more details, you can read the full report from SentinelOne , PwC , and the Microsoft Threat Intelligence team .

MedusaLocker's New Attack: GlobeImposter 2.0 Ransomware Spreading Through RDP - Here's How to Protect Your Business

The MedusaLocker ransomware has been distributing a new variant of GlobeImposter ransomware via Remote Desktop Protocol (RDP). According to cybersecurity researchers, the new variant, called GlobeImposter 2.0, uses a different file extension and ransom note than its predecessor, making it more difficult to detect and recover from. RDP is a common tool used by businesses to allow remote access to their systems. However, it is also a popular attack vector for cybercriminals. In this case, the attackers are using brute-force attacks to gain access to RDP connections and then installing the GlobeImposter 2.0 ransomware on the compromised systems. Once installed, the ransomware encrypts the victim's files and demands a ransom payment in exchange for the decryption key. The attackers typically request payment in cryptocurrency, making it difficult to trace and recover the funds. In some cases, even if the ransom is paid, the attackers may not provide the decryption key, leaving the ...

Unveiling the Cyber Underworld: Rhadamanthys and AsyncRAT - The Evolution of Stealthy Threats 🌐🔒 #Cybersecurity #MalwareMayhem

Recent reports from cybersecurity firm Check Point indicate that the developers behind the information-stealing malware, Rhadamanthys, are actively enhancing its features and expanding its capabilities through a plugin system. This evolution transforms it into a more customizable and potent threat. Rhadamanthys, initially documented in October 2022, operates under the malware-as-a-service (MaaS) model and has been sold by an actor known as "kingcrete2022." It is commonly distributed through malicious websites mimicking genuine software sites advertised through Google ads. Rhadamanthys Features and Evolution As of the latest update, version 0.5.2, Rhadamanthys exhibits a new plugin system, turning it into a versatile tool for specific distributor needs. This system allows customers to deploy additional tools tailored to their targets, making it more than just an information stealer. The malware's components are both active and passive, capable of o...

The Silent Menace: Microsoft Reveals Adversaries Exploiting OAuth Applications for Cryptomining and Phishing Escapades!

Microsoft has issued a stark warning about the growing exploitation of OAuth applications by adversaries, who are now utilizing them as an automation tool to deploy virtual machines for cryptocurrency mining and launch sophisticated phishing attacks. The Microsoft Threat Intelligence team has analyzed these attacks, revealing a concerning trend where threat actors compromise user accounts to create, modify, and grant high privileges to OAuth applications. These applications then serve as a camouflage for malicious activities, allowing threat actors to hide their actions effectively. "The misuse of OAuth also enables threat actors to maintain access to applications even if they lose access to the initially compromised account." One notable adversary in these campaigns is identified as Storm-1283. This threat actor has been observed leveraging a compromised user account to create an OAuth application, subsequently deploying virtual machines for...