Lmst

Cybersecurity experts are joining forces with law enforcement to dismantle the notorious RedLine malware—so much so that a $10M tip could crack the case. Curious how these digital detectives are outsmarting cybercriminals?

https://thedefendopsdiaries.com/the-critical-role-of-cybersecurity-firms-in-combating-redline-malware/

#cybersecurity
#redlinemalware
#infosec
#malwaredetection
#cyberthreats

Your Android might be at risk—Crocodilus malware is disguising itself with fake contacts and overlay attacks to steal sensitive data. How secure is your device?

https://thedefendopsdiaries.com/understanding-the-threat-of-crocodilus-malware-on-android-devices/

#crocodilusmalware
#androidsecurity
#cyberthreats
#malwaredetection
#socialengineering

Understanding the Threat: How .NET MAUI is Changing Android Malware

https://thedefendopsdiaries.com/understanding-the-threat-how-net-maui-is-changing-android-malware/

#dotnetmaui
#androidmalware
#cybersecurity
#mobilethreats
#malwaredetection

Microsoft Exchange Online Bug: Mistaken Quarantine of User Emails

https://thedefendopsdiaries.com/microsoft-exchange-online-bug-mistaken-quarantine-of-user-emails/

#microsoft
#exchangeonline
#emailsecurity
#malwaredetection
#cybersecurity

Hello everyone.
In today's article, we examine in detail the topic of What is Machine Learning in Cybersecurity.

I wish everyone a good read:
https://denizhalil.com/2025/01/17/what-is-machine-learning-in-cybersecurity/

#ai #cybersecurity #machinelearning #malwaredetection #threatdetection #automatedsecurity

just pushed a new release of The Yaralyzer, my unexpectedly popular tool for visually inspecting the output of #YARA scans with a lot of colors. example output below. change is small: it can now use a directory full of YARA rules files without renaming them all to end in .yara.

https://github.com/michelcrypt4d4mus/yaralyzer

someone has packaged this tool for Kali Linux though I don't know if it's in the distro yet. also available for macOS homebrew via an installer someone made for The Pdfalyzer.

Thomas Roccia at #Microsoft was also kind enough to make The Yaralyzer available via a web interface: https://x.com/fr0gger_/status/1749690000478974283

#malware #infosec #cybersecurity #kali #KaliLinux #YARArules #malwaredetection #threathunting #reverseEngineering #malwareAnalysis #reversing #yaralyze #yaralyzer #pdfalyze #pdfalyzer #detectionengineering

We're excited to announce the integration of static file analysis powered by YARA into Corelight’s NDR platform! This powerful integration provides security teams with:

🔍 Enhanced Visibility: Detect malware and emerging threats faster using YARA rules within Corelight sensors.
🚀 Improved SOC Efficiency: Streamline incident response and consolidate security tools.
🛡️ Proactive Threat Hunting: Leverage YARA for customized detection, identifying threats before they execute.

With over 6 billion malware attacks in 2023, staying ahead of threats is crucial. Learn how Corelight + YARA boosts SOC efficiency and strengthens network security.

🔗 Read the release: https://corelight.com/company/newsroom/news/corelight-enables-file-analysis-with-yara-integration?utm_source=mstdn&utm_medium=organic-social&utm_campaign=press-release&utm_adgroup=YARA&utm_content=SSI

Catch Mark Overholser's breakdown on how Corelight's YARA rules integration empowers threat detection 👉 https://www.youtube.com/watch?v=1dv-yqz4kBo
#Cybersecurity #NDR #YARA #MalwareDetection #NetworkSecurity

Community Generated Yara Rules for detection of malware families
https://github.com/harryeetsource/yara_rules

#cybersecurity #infosec #yararules #malwaredetection #threathunting #malware #infosec

🔍 Did you know? Malware like GHOSTPULSE is now hiding within the pixels of images! 🖼️ This technique uses pixel-level deception, bypassing traditional security checks. Are your defenses up to date?

💡 Pro tip: Regularly update your malware detection tools to ensure you're protected against advanced threats like this one. 🔐

How are you enhancing your cybersecurity practices to counter evolving threats? Let’s discuss! 👇

Read more about GHOSTPULSE’s pixel-level tactics here:
https://guardiansofcyber.com/threats-vulnerabilities/ghostpulse-malware-hiding-in-pixels-invisible-threat-in-images/

#Cybersecurity #GuardiansOfCyber #PixelThreat #Malware #OnlineSecurity #TechNews #CyberDefense #MalwareDetection #DataSafety #Guardians

New #theCROWler (a powerful Content Discovery and Cybersecurity development platform) release available for alpha testers!

https://paolozaino.wordpress.com/2024/06/27/new-alpha-release-v0-9-4-for-the-crowler-golang-port/

#cybersecurity #ContentDiscovery #seo #crawling #development #platform #malwaredetection #AI #artificialintelligence #LLM

AsyncRAT, an open-source remote access tool, has been making headlines recently for its use by APTs and cybercriminals alike. It has been observed targeting employees of organizations that manage critical infrastructure. A new blog post from Corelight Labs, authored by Keith Jones, Ph.D., Simeon Miteff , and Travis Green, investigates the elusive AsyncRAT and reveals how SSL certificate analysis can provide crucial insights into detecting and mitigating threats like this that encrypt their communications. Don't miss out on this invaluable resource – read the blog: https://corelight.com/blog/newsroom/news/hunt-of-the-month-detecting-async-rat-malware

#MalwareDetection #HTTPS #Cybersecurity

Thanks Avast for promptly verifying and confirming the Malware FALSE-POSITIVE. Our TopSecret.Chat app is now officially confirmed clean from viruses and malware, as acknowledged by Avast.

If the issue persists on your devices, kindly allow 24 hours for your Avast antivirus to update. Big thanks to our vigilant users for notifying us promptly.

Avast's apologies below

#TopSecretChat #FalsePositive #AntivirusUpdate #Cybersecurity #Avast #MalwareDetection #DigitalSecurity

"🔍 Homoglyph Attack: Deadglyph's Deceptive Disguise 🎭"

Deadglyph, the newly discovered backdoor by ESET, employs a homoglyph attack to mimic Microsoft Corporation, a tactic to deceive and evade detection. This showcases an elevated level of sophistication in its design, further emphasizing the expertise behind Stealth Falcon's cyber-espionage campaigns. The continuous monitoring of system processes and randomized network patterns are among its counter-detection mechanisms, making Deadglyph a formidable tool in the arsenal of Stealth Falcon. 🛡️🎯

Source: ESET Research Blog

Tags: #HomoglyphAttack #Deadglyph #StealthFalcon #CyberSecurity #MalwareDetection #EvasionTechniques #InfoSec #cyberthreats

🔍 Technical Analysis: Smoke Loader Malware Leveraging Wi-Fi Access Points for Geolocation

📅 Date: August 28, 2023
🖋️ Author: Eswar

📌 Tags: #Malware #SmokeLoader #Geolocation #Wi-FiScanning #Cybersecurity

🛠️ The Smoke Loader malware, recently discovered, employs a novel technique to locate infected systems through Wi-Fi access points and Google's Geolocation API. This technical analysis sheds light on the key mechanisms used by this malware.

🔗 System Location Identification:
The malware, also known as "Whiffy Recon," utilizes a custom Wi-Fi scanning tool to identify an infected system's precise coordinates using nearby Wi-Fi access points. This is achieved by leveraging the Windows WLANSVC service and Google's Geolocation API.

🔒 Infection Process:
The malware checks the existence of the WLANSVC service, regardless of its operational status. If the service exists, the malware creates a wlan.lnk shortcut in the Startup folder pointing to the malware's original location. On the other hand, if the service is absent, the malware terminates execution.

🔄 Malware Loops:
There are two loops in the malware's execution flow:

The first loop checks for the presence of the file %APPDATA%\wlan\str-12.bin. If valid parameters are found, the malware proceeds to the next loop for Wi-Fi scanning.
In the absence of the file, the malware registers the bot with the Command and Control (C2) server, sending a JSON payload in an HTTPS POST request with a hard-coded UUID for bot identification.

📥 Registration and Communication:
Upon successful registration, the server responds with a secret UUID, replacing the initial bot ID for future requests. Both UUIDs are stored in the str-12.bin file. The malware then scans for Wi-Fi access points using the Windows WLAN API, sending results to Google's Geolocation API via HTTPS POST requests.

🌐 Google Geolocation API:
The Geolocation API provides system coordinates based on Wi-Fi access points and mobile network data. The obtained coordinates are integrated into a JSON structure along with encryption methods of access points. This data is sent to the C2 server through HTTP POST requests with Authorization UUID and specific URLs.

🔎 Indicators of Compromise:

Whiffy Recon sample dropped by Smoke Loader

MD5 hash: 009230972491f5f5079e8e86e19d5458
SHA256 hash: 935b44784c055a897038b2cb6f492747c0a1487f0ee3d3a39319962317cd4087

Whiffy Recon sample dropped by Smoke Loader

SHA1 hash: 8532e67e1fd8441dc8ef41f5e75ee35b0d12a087

Whiffy Recon C2 server

194.87.32[.]20

Whiffy Recon payload URL

http://195.123.212[.]53/wlan.exe

🛡️ Recommendations:
Cybersecurity professionals are advised to be vigilant against Smoke Loader malware and Whiffy Recon malware. Monitoring for these indicators of compromise can aid in identifying and mitigating potential threats.

Source: https://cybersecuritynews.com/smoke-loader-malware-locates-using-wi-fi/

#Cybersecurity #ThreatAnalysis #MalwareDetection #GeolocationTracking #WindowsMalware

📢 We are extremely happy to announce the release of Slips v1.0.0! Slips is our Stratosphere machine learning-based behavioural intrusion detection and prevention system!

We will be celebrating this milestone by presenting Slips in Black Hat Europe Arsenal!

Slips is the first machine learning-based free software IDS, born at Stratosphere in the Czech Technical University in Prague 7 years ago!

We have been working hard to get to the 1.0.0 version, bringing more stability and detection capabilities to our tool. We hope you enjoy this version and we are happy to hear about any feedback through our GitHub repository (https://github.com/stratosphereips/StratosphereLinuxIPS).

#FreeSoftware #Cybersecurity #machinelearning #infosec #behavioralanalysis #trafficanalysis #malwaredetection #homeIDS #IDS #IPS #cybersec #toolshare #Slips #Stratosphere #networkpacketanalysis #PacketAnalysis