Experimental News Clipping Site

Tag: persistence mechanisms

  • Microsoft Security Blog: StilachiRAT analysis: From system reconnaissance to cryptocurrency theft

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.microsoft.com/en-us/security/blog/2025/03/17/stilachirat-analysis-from-system-reconnaissance-to-cryptocurrency-theft/ Source: Microsoft Security Blog Title: StilachiRAT analysis: From system reconnaissance to cryptocurrency theft Feedly Summary: Microsoft Incident Response uncovered a novel remote access trojan (RAT) named StilachiRAT, which demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data. This blog primarily focuses on analysis of the WWStartupCtrl64.dll…

  • Microsoft Security Blog: New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/ Source: Microsoft Security Blog Title: New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects Feedly Summary: Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that infects Xcode projects, in the wild. Its first known variant since 2022, this latest XCSSET malware features…

  • Cloud Blog: XRefer: The Gemini-Assisted Binary Navigator

    —

    by

    system automation
    in

    Source URL: https://cloud.google.com/blog/topics/threat-intelligence/xrefer-gemini-assisted-binary-navigator/ Source: Cloud Blog Title: XRefer: The Gemini-Assisted Binary Navigator Feedly Summary: Written by: Muhammad Umair Here at Mandiant FLARE, malware reverse engineering is a regular part of our day jobs. At times we are required to perform basic triages on binaries, where every hour saved is critical to incident response timelines. At…

  • The Register: Here’s what happens if you don’t layer network security – or remove unused web shells

    —

    by

    system automation
    in

    Source URL: https://www.theregister.com/2024/11/22/cisa_red_team_exercise/ Source: The Register Title: Here’s what happens if you don’t layer network security – or remove unused web shells Feedly Summary: TL;DR: Attackers will break in and pwn you, as a US government red team demonstrated The US Cybersecurity and Infrastructure Agency often breaks into critical organizations’ networks – with their permission,…

  • Cisco Talos Blog: Threat Spotlight: WarmCookie/BadSpace

    —

    by

    system automation
    in

    Source URL: https://blog.talosintelligence.com/warmcookie-analysis/ Source: Cisco Talos Blog Title: Threat Spotlight: WarmCookie/BadSpace Feedly Summary: WarmCookie is a malware family that emerged in April 2024 and has been distributed via regularly conducted malspam and malvertising campaigns.  AI Summary and Description: Yes Summary: The text discusses the emergence and operational characteristics of the WarmCookie malware family, which has…

  • Schneier on Security: Perfectl Malware

    —

    by

    system automation
    in

    Source URL: https://www.schneier.com/blog/archives/2024/10/perfectl-malware.html Source: Schneier on Security Title: Perfectl Malware Feedly Summary: Perfectl in an impressive piece of malware: The malware has been circulating since at least 2021. It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the Internet potential targets, researchers from Aqua…

  • Wired: Stealthy Malware Has Infected Thousands of Linux Systems for Years

    —

    by

    system automation
    in

    Source URL: https://arstechnica.com/security/2024/10/persistent-stealthy-linux-malware-has-infected-thousands-since-2021/ Source: Wired Title: Stealthy Malware Has Infected Thousands of Linux Systems for Years Feedly Summary: Perfctl malware is hard to detect, persists after reboots, and can perform a breadth of malicious activities. AI Summary and Description: Yes Summary: The text discusses a stealthy malware strain named Perfctl that has infected thousands of…