One Mikro Typo: How a simple DNS misconfiguration enables malware delivery botnet
This botnet uses a global network of Mikrotik routers to send malicious emails that are designed to appear to come from legitimate domains..:
https://blogs.infoblox.com/threat-intelligence/one-mikro-typo-how-a-simple-dns-misconfiguration-enables-malware-delivery-by-a-russian-botnet/
This botnet uses a global network of Mikrotik routers to send malicious emails that are designed to appear to come from legitimate domains..:
https://blogs.infoblox.com/threat-intelligence/one-mikro-typo-how-a-simple-dns-misconfiguration-enables-malware-delivery-by-a-russian-botnet/
Infoblox Blog
How A Large-Scale Russian Botnet Operation Stays Under the Radar
Russian threat actors combine domain name vulnerabilities with hidden router proxy techniques to scale their attacks while remaining shielded from detection.
Forwarded from OpenBLD.net (Yevgeniy Goncharov)
Excited to introduce the next milestone in the evolution of the open DNS service OpenBLD.net! Here’s what’s new:
• Speed – UNIX sockets + Caching + Load Balancing
• Efficiency – Port reuse allows multiple instances to run on the same port
• Load Balancing – Zero logs (except for errors) for maximum performance
• Memory Optimization – The core binaries take up just 6MB, with the cache stored in binary form, totaling only 11MB
• Buffered Disk Writes – When necessary, writes go through dedicated buffers (tested at 10 million entries in 3.3 seconds)
🔐 Security – Supports Prometheus, SIEM, and Syslog exports for advanced monitoring (for business usage needs)
New mechanisms unlock new possibilities—helping you maintain cyber hygiene, save time, and protect your privacy.
Easy setup: https://openbld.net/docs/category/get-started/
Stay safe. Stay free. Peace to all! ✌️
Please open Telegram to view this post
VIEW IN TELEGRAM
ClamAV OLE2 File Format Decryption Denial of Service Vulnerability
A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA
A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA
Cisco
Cisco Security Advisory: ClamAV OLE2 File Format Decryption Denial of Service Vulnerability
A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to an integer underflow…
This vulnerability is due to an integer underflow…
PlushDaemon compromises supply chain of Korean VPN service
supply-chain attack research:
https://www.welivesecurity.com/en/eset-research/plushdaemon-compromises-supply-chain-korean-vpn-service/
supply-chain attack research:
https://www.welivesecurity.com/en/eset-research/plushdaemon-compromises-supply-chain-korean-vpn-service/
Welivesecurity
PlushDaemon compromises supply chain of Korean VPN service
ESET researchers uncover a supply-chain attack against a VPN provider in South Korea by a new China-aligned APT group we have named PlushDaemon.
AWS re:Invent re:Cap в Алматы
AWS re:Invent — здесь Amazon Web Services показывает, каким будет IT завтра. Разбор ключевых анонсов, трендов и новинок, всё самое важное и практичное, можно узнать не летая в Лас-Вегас.
Что будет:
• Самые свежие технологии в облаках, данных, AI/ML и DevOps.
• Полезные инсайты и идеи для вашего бизнеса и проектов.
• Лайфхаки от практиков AWS, которые знают, как это работает в реальной жизни.
• 30 января, 19:00. Алматы, ул. Ходжанова 2/2, MOST IT Hub (8 этаж).
Вход бесплатный.
Спикеры
• Антон Коваленко — 20 лет в IT, Senior Solutions Architect в AWS.
• Александр Бернадский — 15+ лет опыта, Solutions Architect в AWS.
• Мест немного, регистрация здесь
AWS re:Invent — здесь Amazon Web Services показывает, каким будет IT завтра. Разбор ключевых анонсов, трендов и новинок, всё самое важное и практичное, можно узнать не летая в Лас-Вегас.
Что будет:
• Самые свежие технологии в облаках, данных, AI/ML и DevOps.
• Полезные инсайты и идеи для вашего бизнеса и проектов.
• Лайфхаки от практиков AWS, которые знают, как это работает в реальной жизни.
• 30 января, 19:00. Алматы, ул. Ходжанова 2/2, MOST IT Hub (8 этаж).
Вход бесплатный.
Спикеры
• Антон Коваленко — 20 лет в IT, Senior Solutions Architect в AWS.
• Александр Бернадский — 15+ лет опыта, Solutions Architect в AWS.
• Мест немного, регистрация здесь
RID Hijacking Technique
RID Hijacking is typically performed by manipulating the Security Account Manager (SAM) database. Threat actors can create an administrator account or escalate privileges to gain administrator access without knowing the password..:
https://asec.ahnlab.com/en/85942/
RID Hijacking is typically performed by manipulating the Security Account Manager (SAM) database. Threat actors can create an administrator account or escalate privileges to gain administrator access without knowing the password..:
https://asec.ahnlab.com/en/85942/
ASEC
RID Hijacking Technique Utilized by Andariel Attack Group - ASEC
RID Hijacking Technique Utilized by Andariel Attack Group ASEC
119 vulnerabilities in LTE/5G (some with RCE)
Cellular networks are considered critical infrastructure both for day-to-day communication and emergency services, to the extend that their availability and reliability is often highly regulated by government agencies... what happens if they suddenly become unavailable?
Research:
https://cellularsecurity.org/ransacked
Cellular networks are considered critical infrastructure both for day-to-day communication and emergency services, to the extend that their availability and reliability is often highly regulated by government agencies... what happens if they suddenly become unavailable?
Research:
https://cellularsecurity.org/ransacked
Browser Syncjacking: How Any Browser Extension can Be Used to Takeover Your Device
https://labs.sqrx.com/browser-syncjacking-cc602ea0cbd0
https://labs.sqrx.com/browser-syncjacking-cc602ea0cbd0
Medium
Browser Syncjacking: How Any Browser Extension can Be Used to Takeover Your Device
SquareX’s Research Team Discovers a Vulnerability that Puts Millions of Users At Risk
Unauthorized Data Upload in Alibaba Cloud Object Storage Service
https://medium.com/@muhammadwaseem29/unauthorized-data-upload-in-alibaba-cloud-object-storage-service-cefa6abcef7f
https://medium.com/@muhammadwaseem29/unauthorized-data-upload-in-alibaba-cloud-object-storage-service-cefa6abcef7f
Medium
Unauthorized Data Upload in Alibaba Cloud Object Storage Service
Assalam o Alaikum!
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2025-21293)
https://birkep.github.io/posts/Windows-LPE/
https://birkep.github.io/posts/Windows-LPE/
A tale of mediocracy
Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2025-21293)
Introduction
Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach
https://www.zimperium.com/blog/mobile-indian-cyber-heist-fatboypanel-and-his-massive-data-breach/
https://www.zimperium.com/blog/mobile-indian-cyber-heist-fatboypanel-and-his-massive-data-breach/
Zimperium
Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach
true
Weaponizing Background Images for Information Disclosure && LPE: AnyDesk CVE-2024-12754, ZDI-24-1711
https://mansk1es.gitbook.io/AnyDesk_CVE-2024-12754
https://mansk1es.gitbook.io/AnyDesk_CVE-2024-12754
mansk1es.gitbook.io
Weaponizing Background Images for Information Disclosure && LPE: AnyDesk CVE-2024-12754, ZDI-24-1711 | AnyDesk CVE-2024-12754
AnyDesk is a popular personal and enterprise software for remote administration distributed by AnyDesk Software GmbH. This post will dive into the vulnerability I found on AnyDesk mid of the year.
Leaking the email of any YouTube user for $10,000
https://brutecat.com/articles/leaking-youtube-emails
https://brutecat.com/articles/leaking-youtube-emails
brutecat.com
Leaking the email of any YouTube user for $10,000
What could've been the largest data breach in the world - an attack chain on Google services to leak the email address of any YouTube channel
Forwarded from OpenBLD.net (Yevgeniy Goncharov)
This is undoubtedly an innovation. OpenBLD.net smart balancing service is now a separate project, introducing key features:
► Detects slow servers before they start lagging
► If an upstream server shows an increase in timeouts or errors → ML predicts potential failures and automatically prepares backup routes before the infrastructure starts "firing"
► Based on historical data, ML knows when servers experience peak loads (e.g., during lunch hours or at the end of the workday)
► Instead of reacting to downtime, it distributes traffic efficiently in advance
► Reduces latency and timeouts by proactively optimizing traffic distribution
► And much more, including environmental factors such as server energy consumption optimization
The balancer operates like a living organism, learning and adapting to conditions on its own)
How does this benefit users?
🚀 More autonomy and focus on your own development.
⚡ More speed.
📢 This week, the updated balancers will be seamlessly integrated into ADA’s infrastructure—the only thing you might notice is the increased speed.
✌️ Stay fast, stay optimized!
Please open Telegram to view this post
VIEW IN TELEGRAM
Vgod RANSOMWARE
The ransomware specifically targets Windows systems using advanced encryption techniques, appending a unique file extension to encrypted files...
https://www.cyfirma.com/research/vgod-ransomware
The ransomware specifically targets Windows systems using advanced encryption techniques, appending a unique file extension to encrypted files...
https://www.cyfirma.com/research/vgod-ransomware
CYFIRMA
Vgod RANSOMWARE - CYFIRMA
EXECUTIVE SUMMARY CYFIRMA Research and Advisory Team has found Vgod Ransomware while monitoring various underground forums as part of our...
♾ AppSecFest - 25 апреля в Алматы. CFP.
Который год AppSecFest.kz радует контентом, организацией, масштабом. Организаторы настроены на серъезный контент, аудиторию и содержание.
Добрая атмосфера для всех, а + для докладчиков возможность рассказать о своих ресерчах, достижениях в области разработки и защите приложений.
Пока сайт конфы делается, организаторы организуются - ведется CFP набор заявок на доклады связанные с:
- Mobile, Web, X-Platform, Frontend/Backend, Microservices, Docker/K8s, Blockchain, AI, ML
- DevOps, CI/CD, Agile, UI/UX, качеством и безопасностью кода
- SAST, DAST, IAST, API, IaC, Cloud Security, Pentesting, SDLC, DevSecOps, Vulnerability Management
Подать спикер-заявку - https://appsecfest.kz
Который год AppSecFest.kz радует контентом, организацией, масштабом. Организаторы настроены на серъезный контент, аудиторию и содержание.
Добрая атмосфера для всех, а + для докладчиков возможность рассказать о своих ресерчах, достижениях в области разработки и защите приложений.
Пока сайт конфы делается, организаторы организуются - ведется CFP набор заявок на доклады связанные с:
- Mobile, Web, X-Platform, Frontend/Backend, Microservices, Docker/K8s, Blockchain, AI, ML
- DevOps, CI/CD, Agile, UI/UX, качеством и безопасностью кода
- SAST, DAST, IAST, API, IaC, Cloud Security, Pentesting, SDLC, DevSecOps, Vulnerability Management
Подать спикер-заявку - https://appsecfest.kz
New variant of the Snake Keylogger (also known as 404 Keylogger)
https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Fortinet Blog
FortiSandbox 5.0 Detects Evolving Snake Keylogger Variant
Explore how FortiSandbox 5.0 detected this malware, the behavioral indicators it leveraged for identification, and Snake Keylogger's technique to evade detection and analysis.…
Android trojan TgToxic updates its capabilities
..TgToxic is an Android banking trojan discovered by Trend Micro in July 2022. It’s designed to steal user credentials, cryptocurrency from digital wallets and funds from banking and finance apps.
The actors once again changed the way the malware obtains the C2 URL, from a dead drop location to a domain generation algorithm (DGA)..:
https://intel471.com/blog/android-trojan-tgtoxic-updates-its-capabilities
..TgToxic is an Android banking trojan discovered by Trend Micro in July 2022. It’s designed to steal user credentials, cryptocurrency from digital wallets and funds from banking and finance apps.
The actors once again changed the way the malware obtains the C2 URL, from a dead drop location to a domain generation algorithm (DGA)..:
https://intel471.com/blog/android-trojan-tgtoxic-updates-its-capabilities
Intel 471
Android trojan TgToxic updates its capabilities
Intel 471 mobile malware researchers recently discovered a campaign leveraging an updated version of TgToxic, an Android banking trojan. Here's an…
Massive Botnet Targets M365 with Stealthy Password Spraying Attacks
https://securityscorecard.com/research/massive-botnet-targets-m365-with-stealthy-password-spraying-attacks/
https://securityscorecard.com/research/massive-botnet-targets-m365-with-stealthy-password-spraying-attacks/
SecurityScorecard
Massive Botnet Targets M365 with Stealthy Password Spraying Attacks
A Technical Breakdown of Large-Scale Password Spraying Through Non-Interactive Sign-Ins
Auto-Color: An Emerging and Evasive Linux Backdoor
https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/
https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/
Unit 42
Auto-Color: An Emerging and Evasive Linux Backdoor
The new Linux malware named Auto-color uses advanced evasion tactics. Discovered by Unit 42, this article cover its installation, evasion features and more. The new Linux malware named Auto-color uses advanced evasion tactics. Discovered by Unit 42, this…