Lmst

Attention-Worthy Links for December 18th, 2024

#Enceladus #Arctic #Vents #hydrogen-rich #Blooms #silicon #magnesium #iron #ISPs # ABA #regulate #$15 #25Mbps #$20 #200Mbps #Humpback #Whales #Pregnant #Lactating #Hawaii #Alaska #Mooresville #Hydrail #Initiative #diesel-to-hydrogen #Kits #locomotives #Veniaminof #Volcano #Stealthy #flux #deformation #low-level #ash #clouds

New [Perfctl] Malware Targets Linux Servers for Cryptocurrency Mining & Proxyjacking. :linux:

According to Aqua Nautilus researchers who discovered perfctl, the malware likely targeted millions of Linux servers in recent years and possibly caused infections in several thousands of them.

https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/

#linux #server #perfctl #stealthy #malware #it #security #privacy #engineering #technology #media #news

According to Aqua Nautilus, the primary purpose of perfctl is for cryptomining, using the compromised servers to mine the hard-to-trace Monero cryptocurrency. However, it could be easily used for more damaging operations.

The researchers have also observed exploitation of CVE-2023-33246, a remote command execution impacting Apache RocketMQ versions 5.1.0 and older, and CVE-2021-4034 (PwnKit), an elevation of privilege flaw in Polkit.

[ImageSource: Aqua Nautilus]

Locations where the malware drops files.

Once initial access is established, the packed and obfuscated payload, named "httpd", is downloaded from the attacker's server and executed. It then copies itself in the /tmp directory under the "sh" name and then deletes the original binary.

The new process assumes the same name ("sh"), essentially blending with normal Linux system operations.

Additional copies are created in other system locations, such as "/root/.config", "/usr/bin/" and "usr/lib" to ensure persistence in the case of a cleanup.

[ImageSource: Aqua Nautilus]

Overview of perfctl attack flow.

When launched, perfctl opens a Unix socket for internal communications and establishes an encrypted channel with the threat actor's servers over TOR, making it impossible to decipher the exchange.

It then drops a rootkit named 'libgcwrap.so' which hooks into various system functions to modify authentication mechanisms and intercept network traffic as needed to facilitate evasion.

Additional userland rootkits are also deployed, replacing the ldd, top, crontab and lsof utilities with trojanized versions, again, preventing direct detection of the malware's activities.

Finally, an XMRIG miner is dropped onto the system and executed to mine Monero using the server's CPU resources.

A jaguar slowly walking along a fallen tree trunk as it stalks prey in the water. See more here: https://joan-carroll.pixels.com/featured/jaguar-on-the-prowl-4-pantanal-brazil-joan-carroll.html

#jaguar #bigcat #pantanal #brazil #stalking #hunting #spotted #stealthy #wildlife #wildlifephotography #southamerica #animals #nature #artforsale #wallartforsale #AYearForArt #BuyIntoArt #giftideas @joancarroll

Jaguar stealthily climbing down a riverbank, intently staring at its intended prey. In the Pantanal Brazil. See more here: https://joan-carroll.pixels.com/featured/jaguar-hunting-for-its-next-meal-pantanal-brazil-joan-carroll.html

#jaguar #pantanal #brazil #stealthy #hunting #spotted #bigcat #wildlife #wildlifephotography #nature #animals #southamerica #feline #camouflage #artforsale #wallartforsale #AYearForArt #BuyIntoArt #giftideas @joancarroll

Jaguar stealthily hunting its prey in the dense forest growth in the Pantanal, Brazil. See more here: https://joan-carroll.pixels.com/featured/jaguar-in-the-pantanal-brazil-joan-carroll.html

#jaguar #pantanal #brazil #stealthy #hunting #spotted #bigcat #wildlife #wildlifephotography #nature #animals #southamerica #feline #camouflage #artforsale #wallartforsale #AYearForArt #BuyIntoArt #giftideas @joancarroll

"Prowler"
throwback from my sketchbook in 2020
#prowler #stealthy #stealthyhunter #wolf #night #cryptid #ghost #apparition #dark #darkness #moonlight #painting #sketch #sketchdaily #sketchbook #pencil #pencildrawing #pencilart #colours #muted #mutedcolours #imagination #art #artist #artistsonpixelfed

"Prowler"

#prowler #stealthy #stealthyhunter #wolf #night #cryptid #ghost #apparition #dark #darkness #moonlight #painting #sketch #sketchdaily #sketchbook #pencil #pencildrawing #pencilart #colours #muted #mutedcolours #imagination #art #artist

Word Search Puzzle 242

Word List : #madbrain #yashmac #moorship #unstuffy #anatase #lethean #engore #wrast #burbank #odel #tampa #pilori #cristae #stealthy #folsom #estampie #gallying #floreal

http://karafinance.com/2024/02/27/word-search-puzzle-242/

While the malware is capable of collecting files of interest and system information, it lacks some features found in advanced stealer malware in the cybercrime underground.

#Cybersecurity #India #Malware #Phishing #Rust #RusticWeb #Stealthy #Government

https://cybersec84.wordpress.com/2023/12/23/unveiling-the-stealthy-malware-aimed-at-indian-government-operation-rusticweb-decoded/

Are you ready for a #spooky and #stealthy #adventure? 🕵️‍♀️👻 Check out #HauntedHouse. Sneak, solve puzzles, and survive a ghost-infested mansion to save your uncle. 😱 It’s cute, challenging, and nostalgic. 🎮 Out now! #Xbox #Switch #PS5 #PC #halloween

https://churapereviews.com/2023/11/17/roguelite-stealth-game-haunted-house-review/

Seems like #Wikipedia could be totally blocked in #Russia

I can open it now only with certain browser extensions (like #stealthy in #firefox) or #VPN

Previously it opened just fine without any shenanigans

When I noticed it first time there was no news on the matter, but the wikipedia block is unfortunately confirmed - https://twitter.com/globalchecknet/status/1683146460106244096

upd.
seems like it was purely technical issue, and I really hope that was the case

Screenshot of firefox browser page with "The connection has timed out" error

Screenshot of chrome browser page with "This site can't be reached" error

I've got a Plexgear GSW1016 PRO switch that has managed to leave pretty much zero traces across the internet. Stealthy. #Plexgear #GSW1016PRO #Stealthy