Search: “persistence”

7 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Threat actor 83 Malware 75 Exploit / PoC 66 AI safety & security 56 Vulnerability 37 Phishing & fraud 36 AI research 35 Research 20 Industry 13 AI industry 12 Tools 10 Policy & legal 10 Model release 9 AI tools & infra 9

SeverityAll critical 43 high 165 medium 123 low 7 info 152

Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)

SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.

A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.

SANS Internet Storm CenterSep 10, 12:58 UTC · 6d agoMalware in the wild1

Def Con Attendees Targeted by Persistent Phishing Campaign

Huntress reports a persistent and elaborate phishing campaign targeting attendees following the Def Con security conference.

A Huntress researcher documented being targeted by an elaborate and persistent phishing scam after attending Def Con. The campaign specifically went after conference attendees, suggesting deliberate targeting of the security community. Details of the social engineering approach and persistence were shared.

Infosecurity MagazineAug 20, 09:30 UTC · 27d agoPhishing & fraud

When Agents Look Like Beacons: NIDS Evasion by Model Context Protocol Traffic

Research shows Model Context Protocol agent traffic structurally resembles C2 beaconing and evades Suricata signatures and RITA behavioral scoring in testbeds.

An arXiv study demonstrates that Model Context Protocol (MCP) JSON-RPC traffic over Streamable HTTP mimics the polling patterns of C2 frameworks like Cobalt Strike and is not flagged as anomalous by standard enterprise defenses. In a Docker testbed with eleven traffic profiles across three TLS conditions, Suricata with the Emerging Threats Open ruleset produced near-zero alerts and RITA assigned a consistent 0.0 beacon score, regardless of jitter or TLS inspection. The authors propose an agent-native network indication standard using Agent-Native ALPN and out-of-band headers.

arXiv cs.CRSep 16, 17:27 UTC · 12h agoResearch

Driver’s License Data for Sale

Schneier on Security highlights that driver's license data is being sold, underscoring concerns over monetization of driver records and surveillance.

A post on Bruce Schneier's blog is titled 'Driver's License Data for Sale.' The available excerpt contains no article body, so the specifics of the reported data sales are not detailed. The topic concerns the commercial availability of driver's license records, a recurring data-privacy and surveillance theme on the blog.

Schneier on SecuritySep 9, 16:05 UTC · 7d agoData breach

Ukraine prosecutor general steps down amid scam call center bribery probe

Ukraine's prosecutor general Ruslan Kravchenko resigned amid a probe into officials who allegedly took bribes to protect fraudulent call centers.

Ukraine's prosecutor general Ruslan Kravchenko resigned over an anti-corruption probe into officials who allegedly took bribes since mid-2025 to protect fraudulent call centers; he has not been charged. NABU named five suspects, including senior prosecutor Serhii Kropyva, who was remanded with bail of 120 million hryvnias (about $2.7 million) on suspicion of laundering over 89 million hryvnias (roughly $2 million). The scam centers targeted victims in Ukraine and abroad; Ukrainian authorities reported shutting about 340 call centers over the past year, including 94 in a single week during a nationwide crackdown.

The RecordSep 9, 12:15 UTC · 7d agoPolicy & legal

Once popular for attacking AI, ASCII smuggling is embraced by spammers

Spammers adopt ASCII smuggling—invisible Unicode tag characters—to evade email filters, with Microsoft Defender detections spiking to 2.5 million per day.

ASCII smuggling hides text in Unicode tag characters (e.g., U+E0041 for "A") that are invisible to humans but readable by LLMs and text processors. The technique gained attention as a stealthy prompt-injection vector and is now used by spammers to obfuscate keywords from email detectors. Microsoft reported Defender for Office smuggling detections jumped from roughly 21,000 per day to over 1.3 million in early February, reaching 2.5 million within four days, before falling sharply in mid-May.

Ars Technica · SecuritySep 4, 17:18 UTC · 12d agoPhishing & fraud

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.

Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.

The Hacker NewsSep 2, 07:47 UTC · 14d agoResearch CVE-2021-318862