Tag: powershell
-
New Microsoft script updates Windows media with bootkit malware fixes
by
in SecurityNewsMicrosoft has released a PowerShell script to help Windows users and admins update bootable media so it utilizes the new “Windows UEFI CA 2023” certificate before the mitigations of the BlackLotus UEFI bootkit are enforced later this year. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/new-microsoft-script-updates-windows-media-with-bootkit-malware-fixes/
-
Microsoft script updates bootable media for BlackLotus bootkit fixes
by
in SecurityNewsMicrosoft has released a PowerShell script to help Windows users and admins update bootable media so it utilizes the new “Windows UEFI CA 2023” certificate before the mitigations of the BlackLotus UEFI bootkit are enforced later this year. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-script-updates-bootable-media-for-blacklotus-bootkit-fixes/
-
Silent Lynx Using PowerShell, Golang, and C++ Loaders in Multi-Stage Cyberattacks
by
in SecurityNewsA previously undocumented threat actor known as Silent Lynx has been linked to cyber attacks targeting various entities in Kyrgyzstan and Turkmenistan.”This threat group has previously targeted entities around Eastern Europe and Central Asian government think tanks involved in economic decision making and banking sector,” Seqrite Labs researcher Subhajeet Singha said in a technical report…
-
Windows 10/11 KB5053484: Neues PS-Script für Zertifikate in Boot-Medien
by
in SecurityNewsMicrosoft hat gerade ein neues PowerShell-Script für Windows 10 und Windows 11 veröffentlicht, welches die Boot-Medien aktualisiert. Dadurch soll sichergestellt werden, dass das Windows UEFI CA 2023 Zertifikat in naher Zukunft akzeptiert wird. Das Ganze steht im Kontext zur Black … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/02/05/windows-10-11-kb5053484-neues-ps-script-fuer-zertifikate-in-boot-medien/
-
Coyote Banking Trojan targets Brazilian users, stealing data from 70+ financial apps and websites
by
in SecurityNewsCoyote Banking Trojan targets Brazilian users, stealing data from over 70 financial applications and websites. FortiGuard Labs researchers detected a campaign using LNK files executing PowerShell commands to deploy the Coyote Banking Trojan. Threat actors target Brazilian users by stealing financial data, the malware can harvest sensitive information from over 70 financial applications and numerous…
-
Further Adventures With CMPivot”Š”, “ŠClient Coercion
by
in SecurityNewsFurther Adventures With CMPivot”Š”, “ŠClient Coercion Perfectly Generated AI Depiction based on Title TL:DR CMPivot queries can be used to coerce SMB authentication from SCCM client hosts Introduction CMPivot is a component part of the Configuration Manager framework. With the rise in popularity for ConfigMgr as a target in red team operations, this post looks to cover a…
-
Coyote Malware Launches Stealthy Attack on Windows Systems via LNK Files
by
in SecurityNewsFortiGuard Labs has issued a high-severity alert regarding the Coyote Banking Trojan, a sophisticated malware targeting Microsoft Windows users. Over the past month, researchers have identified malicious LNK files employing PowerShell commands to execute scripts and connect to remote servers, initiating a multi-stage attack. The primary objective of this Trojan is to harvest sensitive information…
-
Coyote Banking Trojan: a Threat to Banking Institutions
by
in SecurityNewsOver the past month, cybersecurity experts at FortiGuard Labs have identified a series of malicious Windows Shortcut (LNK) files containing PowerShell commands. These files serve as the initial stage of a sophisticated cyberattack aimed at delivering the Coyote Banking Trojan,… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/coyote-banking-trojan-a-threat-to-banking-institutions/
-
Neue Ransomware-Gruppe Funksec profitiert von LLMs
by
in SecurityNews
Tags: access, ai, cyberattack, data-breach, ddos, extortion, group, leak, LLM, mail, malware, powershell, ransomware, rust, service, tool, usa, windows -
New ransomware group Funksec is quickly gaining traction
by
in SecurityNews
Tags: access, ai, attack, computer, control, country, cybercrime, data, data-breach, ddos, detection, email, encryption, extortion, government, group, leak, LLM, malware, password, powershell, ransom, ransomware, russia, rust, service, threat, tool, usa, windowsThreat reports for December showed a newcomer to the ransomware-as-a-service (RaaS) landscape quickly climbing the ranks. Called Funksec, this group appears to be leveraging generative AI in its malware development and its founders are tied to hacktivist activity.Funksec was responsible for 103 out of 578 ransomware attacks tracked by security firm NCC Group in December,…
-
MintsLoader Delivers StealC Malware and BOINC in Targeted Cyber Attacks
by
in SecurityNewsThreat hunters have detailed an ongoing campaign that leverages a malware loader called MintsLoader to distribute secondary payloads such as the StealC information stealer and a legitimate open-source network computing platform called BOINC.”MintsLoader is a PowerShell based malware loader that has been seen delivered via spam emails with a link to Kongtuke/ClickFix pages or a…
-
Entra Connect Attacker Tradecraft: Part 2
by
in SecurityNews
Tags: access, attack, authentication, business, cloud, control, credentials, detection, group, microsoft, password, powershell, service, windowsNow that we know how to add credentials to an on-premises user, lets pose a question: “Given access to a sync account in Domain A, can we add credentials to a user in another domain within the same Entra tenant?” This is a bit of a tall order assuming we have very few privileges in Entra…
-
Telegram captcha tricks you into running malicious PowerShell scripts
by
in SecurityNewsThreat actors on X are exploiting the news around Ross Ulbricht to direct unsuspecting users to a Telegram channel that tricks them into executing PowerShell code that infects them with malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/telegram-captcha-tricks-you-into-running-malicious-powershell-scripts/
-
Part 15: Function Type Categories
by
in SecurityNewsOn Detection: Tactical to Functional Seven Ways to View API Functions Introduction Welcome back to Part 15 of the On Detection: Tactical to Functional blog series. I wrote this article to serve as a resource for those attempting to create tool graphs to describe the capabilities of the attacker tools or malware samples they encounter.…
-
ADFS”Š”, “ŠLiving in the Legacy of DRS
by
in SecurityNewsADFS”Š”, “ŠLiving in the Legacy of DRS It’s no secret that Microsoft have been trying to move customers away from ADFS for a while. Short of slapping a “deprecated” label on it, every bit of documentation I come across eventually explains why Entra ID should now be used in place of ADFS. And yet”¦ we still encounter…
-
Lumma Stealer Attacking Users To Steal Login Credentials From Browsers
by
in SecurityNewsResearchers observed Lumma Stealer activity across multiple online samples, including PowerShell scripts and a disguised EXE installer, as analysis revealed a parent-child relationship between these samples, all of which communicated with the same C2 server. The Lumma Stealer Trojan, observed in the provided sample, employs advanced techniques to exfiltrate sensitive data from popular browsers and…
-
New Python NodeStealer Attacking Facebook Business To Steal Login Credentials
by
in SecurityNews
Tags: business, credentials, credit-card, cyber, data, email, finance, login, malicious, malware, phishing, powershell, spear-phishing, threatNodeStealer, initially a JavaScript-based malware, has evolved into a more sophisticated Python-based threat that targets Facebook Ads Manager accounts, stealing sensitive financial and business data in addition to credit card details and browser information. The malware is delivered through spear-phishing emails with malicious links, uses DLL sideloading and encoded PowerShell for stealthy execution, and exfiltrates…
-
Enhance Microsoft security by ditching your hybrid setup for Entra-only join
by
in SecurityNews
Tags: ai, authentication, business, cloud, compliance, conference, credentials, email, firewall, group, identity, infrastructure, intelligence, Internet, microsoft, network, ntlm, office, powershell, risk, service, switch, technology, tool, vpn, windowsArtificial intelligence is top of mind for nearly everything Microsoft is doing these days, but there’s another goal the company would like to see its users strive to attain, one that may not be easily obtained, and that’s to be Entra-joined only.That means no more Active Directory (AD) and no more traditional domain: instead, your…
-
Hackers Weaponizing LNK Files To Create Scheduled Task And Deliver Malware Payload
by
in SecurityNewsTA397, also known as Bitter, targeted a Turkish defense organization with a spearphishing email containing a RAR archive, which included a decoy PDF, a malicious LNK file disguised as a PDF, and an ADS file with PowerShell code. This technique, common for TA397, leverages NTFS ADS to establish persistence and deploy further malware like wmRAT…
-
Malicious Microsoft VSCode extensions target devs, crypto community
by
in SecurityNewsMalicious Visual Studio Code extensions were discovered on the VSCode marketplace that download heavily obfuscated PowerShell payloads to target developers and cryptocurrency projects in supply chain attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/malicious-microsoft-vscode-extensions-target-devs-crypto-community/
-
Detection Engineer’s Guide to Powershell Remoting
by
in SecurityNews
Tags: access, attack, automation, computer, control, credentials, crowdstrike, cyberattack, data, detection, edr, endpoint, exploit, firewall, guide, hacker, malicious, microsoft, mitre, monitoring, network, penetration-testing, powershell, risk, service, siem, threat, tool, update, windowsPowershell Remoting is a powerful feature in Windows that enables IT administrators to remotely execute commands, manage configurations, and automate tasks across multiple systems in a network. Utilizing Windows Remote Management (WinRM), it facilitates efficient management by allowing centralized control over endpoints, making it an essential tool for system administrators to streamline operations and maintain…
-
Malicious ads push Lumma infostealer via fake CAPTCHA pages
by
in SecurityNewsA large-scale malvertising campaign distributed the Lumma Stealer info-stealing malware through fake CAPTCHA verification pages that prompt users to run PowerShell commands to verify they are not a bot. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/malicious-ads-push-lumma-infostealer-via-fake-captcha-pages/
-
Arctic Wolf beobachtet Zero-Day-Exploit von Cleo-MFT-Software
by
in SecurityNewsDas Threat-Intelligence-Team der Arctic Wolf Labs haben neue schadhafte Aktivitäten beobachtet. Diese stehen im Zusammenhang mit der von Huntress aufgedeckten Zero-Day-Schwachstelle in der Cleo-Managed-File-Transfer (MFT) -Software. Im Dezember 2024 beobachtete Arctic Wolf Labs eine Mass-Exploitation-Kampagne, bei der Cleo-MFT-Lösungen für den unberechtigten Fernzugriff genutzt wurden. Die Ausführungskette umfasste einen verschleierten Powershell-Stager, einen Java-Loader sowie eine Java-basierte Backdoor,…
-
Attackers exploit zero-day RCE flaw in Cleo managed file transfer
by
in SecurityNews
Tags: advisory, attack, cve, edr, exploit, firewall, flaw, group, Internet, malicious, mitigation, moveIT, powershell, ransomware, rce, remote-code-execution, software, tool, update, vulnerability, vulnerability-management, windows, zero-daySecurity researchers have warned about in-the-wild attacks that exploit a remote code execution vulnerability in managed file transfer (MFT) solutions developed by enterprise software vendor Cleo Communications.The impacted products include the latest versions of Cleo LexiCom, Cleo VLTrader and Cleo Harmony, with experts advising to temporarily disconnect these systems from the internet until a patch…
-
SPA is for Single-Page Abuse! Using Single-Page Application Tokens to Enumerate Azure
by
in SecurityNewsAuthor: Lance B. Cain Overview Microsoft Azure is a leading cloud provider offering technology solutions to companies, governments, and other organizations around the globe. As such, many entitles have begun adopting Azure for their technology needs to include identity, authentication, storage, application management, and web services. One of the most common methods for organizations to begin…
-
Russian APT RomCom combines Firefox and Windows zero-day flaws in drive-by exploit
by
in SecurityNews
Tags: access, antivirus, apt, attack, backdoor, browser, business, computer, cve, cybercrime, cyberespionage, defense, endpoint, exploit, flaw, germany, government, group, insurance, intelligence, malicious, microsoft, msp, password, powershell, russia, software, threat, ukraine, vulnerability, windows, zero-dayA Russia-aligned group that engages in both cybercrime and cyberespionage operations used a zero-click exploit chain last month that combined previously unknown and unpatched vulnerabilities in Firefox and Windows.The campaign, whose goal was to deploy the group’s RomCom backdoor on computers, targeted users from Europe and North America. The APT group, also known as Storm-0978,…