🚨 Alert: New macOS Malware Variants, FlexibleFerret, Undetected by Apple’s XProtect 🚨 @sentinellabs.bsky.social researchers @philofishal.bsky.social and @hegel.bsky.social have uncovered new variants, which slip past Apple's XProtect, of the DPRK-linked macOS malware, Ferret.

New blog post on the abuse of the IDispatch COM interface to get unexpected objects loaded into a process. Demoed by using this to get arbitrary code execution in a PPL process. googleprojectzero.blogspot.com/2025/01/wind...

Very interesting post by Microsoft about the internals of the new Admin Protection feature It seems they have patched my SSPI UAC bypass based on NTLM as well as the Kerberos UAC bypass in which both were able to bypass AP as well More details here 👇 techcommunity.microsoft.com/blog/microso...

Had some fun reviving an old vulnerable driver, read all about it here: decoder.cloud/2025/01/09/t... 🤠

Thanks to a recent post from @ericlawrence.com on Defender and Dev Drive, I was reminded of this amazing research series by @n4r1B n4r1b.com/posts/2020/0... I only comprehend ~30% if I'm lucky, but that's a good 10% more than last time I read it 🤣 Still, it's definitely worth reading ;)

Working in it .... 😇 www.youtube.com/watch?v=fUqC...

@decoder-it.bsky.social and i noticed that it's no more possible to call NtLoadDriver pointing to an unprivileged regkey such as \REGISTRY\USER Even if you have the SeLoadPrivilege you would still require the Admin group to write the required regkey. Some more technical details below 👇

🔮 What does the future hold? Surprises 🎲, certainly, but some of the forces that will shape #2025 can already be discerned in the shadows of 2024. The @sentinellabs.bsky.social team takes a look at what might be coming over the horizon for #cybersecurity this coming year.

[BLOG] Today's post is all about Cobalt Strike's Postex Kit. rastamouse.me/cobalt-strik...

[BLOG] This post summarises how to tie Cobalt Strike's UDRL, SleepMask, and BeaconGate together for your syscall and call stack spoofing needs. rastamouse.me/udrl-sleepma...

Relaying DCOM has always intrigued me, so I decided to dive in. Started with a MiTM attack using a fake DNS entry, targeting certificate requests to an ADCS server and relaying to SMB.

Windows.Storage . lol www.hexacorn.com/blog/2024/11...

💡Dr. Cristina Cifuentes, the Mother of Decompilation, reflects in her #LABScon2024 keynote on three decades of innovation in reverse engineering. 📺 Watch the full video: s1.ai/LC24-CC

I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx A Kerberos relay & forwarder for MiTM attacks! >Relays Kerberos AP-REQ tickets >Manages multiple SMB consoles >Works on Win& Linux with .NET 8.0 >... GitHub: github.com/decoder-it/K...

A new malicious campaign is using a legitimate but old and vulnerable Avast Anti-Rootkit driver to evade detection and take control of the target system by disabling security components. www.bleepingcomputer.com/news/securit...

🚨 New Research Drop: 🇰🇵 DPRK IT Workers | A Network of Active Front Companies and Their Links to China Summary: ⚪ Newly Disrupted Front Companies by USG ⚪ Impersonating US based software and tech orgs ⚪ Links to still-active front orgs, CN association Report: www.sentinelone.com/labs/dprk-it...

Following my prev tweet, my Kerberos MITM relay/forwarder is almost finished! It targets for example insecure DNS updates in AD, allowing DNS name forgery. It intercepts, relays, and forwards traffic, with the client unaware. Currently supporting smb->smb and smb->http (adcs)

Awesome new addition to krbrelayx by Hugow from Synacktiv: www.synacktiv.com/publications...

TrustedSec Tech Brief 00:30 - NTLM Hash Disclosure Zero-Day 01:45 - Task Scheduler Vulnerability 02:30 - Exchange Server Issues 03:15 - AD Certificate Services Flaw 04:00 - Vulnerability Breakdown 04:45 - Palo Alto Zero-Day 05:30 - FortiGate VPN Update www.youtube.com/watch?v=3mSD...

What we saw with Hidden Risk (s1.ai/BNThief), we’ll see plenty more of in 2025: threat actors exploring all the old methods of #macOS persistence because the lazy LaunchAgents way is now too noisy thanks to changes Apple made in Ventura.(1/2)

Working on my "new" Kerberos Relay & PortForwarder tool designed for managing also MITM attacks 😇

Almost embarrassed to post this, but I've always used Fiddler or Burp for capturing things like this... I didn't have admin rights and was trying to capture network traffic from a pop-up, so Dev Tools wasn't working Apparently this is built into Chrome/Edge! So cool :) edge://net-export/

Weekly summary is out... ctoatncsc.substack.com/p/cto-at-ncs...

AdobeFips - Adobe Reader Lolbin www.hexacorn.com/blog/2024/11...

Beyond good ol’ Run key, Part 144 www.hexacorn.com/blog/2024/11...

The Three Buddies Problem podcast episode 21 is now live! Together with @ryanaraine.bsky.social and @jags.bsky.social we talk geography, cyber magic walls, Aria Sepehr Ayandehsazan aka Emennet Pasargad, Predatory Sparrow and of course, magic money #bitcoin: securityconversations.com/episode/what...

Great work by the @volexity.bsky.social crew!

Bunch of new Amos/Atomic #macOS #infostealers if you pivot off ```behaviour_processes:"sh -c curl -s https[:]//api.ipify[.]org/?format=text" tag:macho``` Low detections on V(h/t x.com/malwrhuntert...) #malware #apple #cybersecurity

🧵Today’s blogpost focuses on a newer ransomware variant named SafePay. Needless to say, ransomware sucks. When this new variant appeared, it gained our attention. 👀 Let’s dig into what happened and what makes it tick ⬇️:

France's former domestic spy chief on trial for allegedly collecting classified info for Luis Vuitton owner Bernard Arnault. Bernard Squarcini allegedly spied on a former journalist and current MP who made a documentary critical of Arnault and on Hermès, a competitor of Arnault. (archive.ph/VAocp)

I wrote a post on the realities of cloud & webserver ransomware. Check it out to see some of the toolsets & frameworks that can be used for these attacks.

This MemProcFS has a lot of potentials. I have seen it also abused by some ransomware operator to dump lsass. If you see the loading of such drivers and aren’t commonly used in your environment then you should set some alerts based on that.

NEW: Security researchers confirm that iPhones running iOS 18 now automatically reboot if they are not unlocked for 72 hours. The "inactivity reboot" feature will make life harder for thieves, law enforcement, and forensic experts trying to extract data from iPhones. techcrunch.com/2024/11/14/n...

Attacking JWT with Self-Signed Claims - trustedsec.com/blog/attacki...

🆕 New blog post! "Exploiting KsecDD through Server Silos" In my latest mini research project, I've been working with my teammate @PMa1n (X) on extending the work of @floesen_ (X) on the KsecDD driver. I'm thrilled to finally share the results. 👉 blog.scrt.ch/2024/11/11/e...

Hello world 👋