30
45
45
30
30
Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability
Cisco disclosed a UEFI Secure Boot bypass in UCS servers and UCS-based appliances letting authenticated or physically present attackers execute unauthorized software.
Cisco published an advisory for a vulnerability in the UEFI Shell implementation of UCS servers and UCS-based appliances. Memory write commands remain available in the UEFI Shell while Secure Boot is enabled, allowing an attacker to modify UEFI memory and bypass validation checks to run unauthorized software. Exploitation requires either valid credentials for a user or admin account, or unauthenticated physical access to select the UEFI Shell boot option at boot time. The issue affects firmware boot integrity rather than the running operating system.
20
30
30
45
Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self
Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.
Unit 42 discovered an under-development Perl Shellbot campaign that mines Bitcoin using xmrig and emech while evading detection via a rootkit that replaces the ps tool and the LD_PRELOAD-based libprocesshider.so library. Infected devices download a malicious shell script, connect to IRC-based C2 at eleethub.com and the UnderNet network, and can receive commands for UDP/TCP floods, port scans, and HTTP attacks. The botnet can affect Unix systems and Windows 10 hosts running a Linux subsystem, and its operators use the 'Los Zetas' branding, though they are unlikely to be the Mexican drug cartel. Researchers found only a few compromised 'zombies' before the campaign expanded.
35
45
30
30
30
30
30
30
30
30
Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)
SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.
A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.
33
30
30
30
30
45
30
Data Broker Radaris Loses Domains in Privacy Fightnew
A New Jersey court ordered people-search broker Radaris to transfer radaris.com and a dozen related domains to Atlas Data Privacy over Daniel's Law violations.
On August 26, a New Jersey judge found Radaris failed to defend claims that it violated Daniel's Law, which protects law enforcement officials' personal data and imposes $1,000 fines per ignored removal request. The court ordered radaris.com and more than a dozen related broker domains transferred to plaintiff Atlas Data Privacy Corp. Radaris had delayed litigation using offshore shell entities and previously used a fictitious CEO named 'Gary Norden' in investor-facing press releases.
30
30
30
30
30
45
30
45
35
45
45
30
30
30