60
ISC Releases Security Patches for New BIND DNS Software Vulnerabilities
60
60
60
60
CISA Warns of Exploitable Vulnerabilities in Popular BIND 9 DNS Software
60
60
60
60
60
60
60
60
60
60
60
60
Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)
SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.
A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.
33
Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Unit 42 tracks the new Mole ransomware (CryptoMix family) spread via USPS-themed malspam, with tactics escalating to JavaScript downloaders dropping multiple malware families.
On April 11, 2017, a malspam campaign began distributing Mole ransomware, a CryptoMix-family strain, through USPS-themed emails linking to fake Microsoft Word Online sites offering a bogus Office plugin. By April 13 the campaign added Nemucod JavaScript downloaders installing Mole alongside Kovter and Miuref, and by April 18 it switched to the KINS banking Trojan before moving to speeding-ticket themes and a fake parking services website. Unit 42 notes the rapid tactic changes are likely intended to evade detection, and CryptoMix variants like Mole are typically repackaged within weeks.
27
60
60
60
Microsoft Rolls Out Patches for 73 Flaws, Including 2 Windows Zero
60
60
Warning: 3 Critical Vulnerabilities Expose ownCloud Users to Data Breaches
60
Week in review: Chrome zero-day is actually in libwebp, Sony hacking rumours
60
60
60
60
U.S. Cybersecurity Agency Adds 6 Flaws to Known Exploited Vulnerabilities Catalog
60
60
60
60
Microsoft Patch Tuesday, December 2021 Edition
60
60
60
60
60
60
60