Splunk (Organization): news timeline & CVEs

Vidar Uses Custom Bytecode Interpreter and ARX Stream Ciphers for Per-Build String Obfuscation

Vidar stealer now hides strings with a custom bytecode VM and per-build ARX stream ciphers, weakening static detection.

Zscaler ThreatLabz says the Vidar infostealer, tracked since 2018, now hides embedded strings with a minimal custom virtual machine and per-build stream ciphers. From version 2.0 it uses a 14-handler bytecode interpreter; versions 2.0-2.1 use a modified ChaCha design, while 2.2 onward use an ARX cipher incorporating FNV-1a and the constant 0x9E3779B9. Changing opcodes, keys, and constants undermine static YARA matching. Splunk also observed sandbox and endpoint-security checks, and hashes are published for versions 2.0, 2.5, 3.1, and 3.4.

GBHackersupdated Sep 22, 08:40 UTC · 5d agofirst Sep 22, 05:46 UTC · 5d agoMalware in the wild 3 sources1

Cloud Threat Emulation on Autopilot: Context is Everything

Elastic outlines a plan-first cloud threat-emulation lifecycle so detections rest on realistic identity, telemetry, and cleanup.

Elastic Security Labs argues that cloud, SaaS, and identity threat emulation cannot be a port of endpoint atomic testing because there is often no malware sample to replay. This first post in a series defines a lifecycle from objective and threat modeling through victim IAM, lab provisioning, contextual execution, telemetry verification, coverage evaluation, and fail-closed cleanup. It says tools such as Stratus Red Team, Atomic Red Team, CloudGoat, and ROADTools do not replace that planning. A later part is planned to cover agents and AI executing the method.

Elastic Security LabsSep 21, 00:00 UTC · 6d agoResearch1

Splunk

Timeline2 articles

Appears with

Vidar Uses Custom Bytecode Interpreter and ARX Stream Ciphers for Per-Build String Obfuscation

Cloud Threat Emulation on Autopilot: Context is Everything