news
Security and FUD Leftovers
-
Dark Reading ☛ 'RingReaper' Sneaks Right Past Linux EDRs
The highly sophisticated post-compromise tool abuses the Linux kernel's io_uring interface to remain hidden from endpoint detection and response systems.
A stealthy post-exploit tool that surfaced earlier this year may well be one of the first real-world examples of malware that exploits a relatively modern Linux kernel interface for I/O operations, all in order to evade endpoint detection and response (EDR) systems.
-
Fear, Uncertainty, Doubt/Fear-mongering/Dramatisation
-
TechRadar ☛ A clever new Linux malware is breaking into systems - and then shutting the door behind it to avoid detection [Ed: The issue here is a hole in Apache software already patched 2 years ago, nothing to do with Linux]
A hacker was recently spotted patching someone’s vulnerable cloud Linux instance - but they did not do it out of the goodness of their heart.
Security researchers Red Canary observed a threat actor abusing a maximum severity flaw, tracked as CVE-2023-46604, to break into a cloud Linux system.
-
HackRead ☛ New DripDropper Malware Exploits Linux Flaw Then Patches It Lock Rivals Out
A new report from Red Canary reveals a clever Linux malware called DripDropper that exploits a flaw and then patches it to prevent other hackers from getting in. Learn how this tactic works.
-
-
Windows TCO / Windows Bot Nets
-
Google ☛ A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor
When the script initially executes, a check verifies the command line arguments of the node.exe process, keeping in mind that the binary is initially spawned with a single argument (the script itself), this check forces the script to create a child process which has 1 as an additional argument, then the initial node.exe exits. When the child process runs, since it now has three arguments, it will pass this initial check and execute the rest of the script.
-
Security Week ☛ Telecom Firm Colt Confirms Data Breach as Ransomware Group Auctions Files
The telecommunications firm said at the time that the internal system on which it detected the intrusion was separate from customer infrastructure. Colt has since been working on restoring impacted systems, but some services, such as Colt Online and its Voice API platform, remain offline.
-