2023-03-26 | Hacker Trends

7 Posts

Emotet malware distributed as fake W-9 tax forms from the IRS

https://www.bleepingcomputer.com/news/security/emotet-malware-distributed-as-fake-w-9-tax-forms-from-the-irs/

7 Posts

GitHub - Cryptogenic/PS5-IPV6-Kernel-Exploit: An experimental webkit-based kernel exploit (Arb. R/W) for the PS5 on <= 4.51FW

https://github.com/Cryptogenic/PS5-IPV6-Kernel-Exploit

6 Posts

Utah social media law requires parental permission for kids : NPR

https://www.npr.org/2023/03/24/1165764450/utahs-new-social-media-law-means-children-will-need-approval-from-parents

6 Posts

GitHub - corkami/pics: Posters, drawings...

https://github.com/corkami/pics

6 Posts

GitHub - Acceis/exploit-CVE-2023-23752: Joomla! < 4.2.8 - Unauthenticated information disclosure

https://github.com/Acceis/exploit-CVE-2023-23752

5 Posts

Guidance for investigating attacks using CVE-2023-23397 - Microsoft Security Blog

https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/

5 Posts

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

https://securityintelligence.com/posts/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock/

5 Posts

GitHub - ZeroMemoryEx/Chaos-Rootkit: x64 ring0 Rootkit with Process Hiding and Privilege Escalation Capabilities

https://github.com/ZeroMemoryEx/Chaos-Rootkit

4 Posts

Josh on Twitter: "Seeing people trot out mom-n-pop ransomware victims to complain about OST is so odd. Those shops would benefit so much more if you yelled at Microsoft to ship actual endpoint protection by default instead of sending nastygrams to random GitHub authors" / Twitter

https://twitter.com/passthehashbrwn/status/1640020575316746243

4 Posts

[QuickNote] Decrypting the C2 configuration of Warzone RAT | 0day in {REA_TEAM}

https://kienmanowar.wordpress.com/2023/03/25/quicknote-decrypting-the-c2-configuration-of-warzone-rat/

4 Posts

Untitled Goose Tool Aids Hunt and Incident Response in Azure, Azure Active Directory, and Microsoft 365 Environments | CISA

https://www.cisa.gov/news-events/alerts/2023/03/23/untitled-goose-tool-aids-hunt-and-incident-response-azure-azure-active-directory-and-microsoft-365

4 Posts

David Buchanan on Twitter: "holy FUCK. Windows Snipping Tool is vulnerable to Acropalypse too. An entirely unrelated codebase. The same exploit script works with minor changes (the pixel format is RGBA not RGB) Tested myself on Windows 11 https://t.co/ovJKPr0x5Y" / Twitter

https://twitter.com/David3141593/status/1638222624084951040

4 Posts

Rob on Twitter: "@RDKLInc School IT staff are people who couldn’t get a better paying IT job in the private sector." / Twitter

https://twitter.com/RockyMtnPaper_/status/1639370154365599744

3 Posts

GitHub - crisprss/magicNetdefs: Similar to Petitpotam, the netdfs service is enabled in Windows Server and AD environments, and the abused RPC method allows privileged processes to access malicious pipes for exploitation

https://github.com/crisprss/magicNetdefs

3 Posts

strandjs - @[email protected] on Twitter: "Warning signs of infosec disaster. "8 characters is fine." "No one wants to hack us." "We are compliant." "No one will find that API." "Insurance will cover us." "If it ain't broke, don't fix it." Yours?" / Twitter

https://twitter.com/strandjs/status/1639637495062077441

strandjs - @strandjs@infosec.exchange on Twitter: "Warning signs of infosec disaster. "8 characters is fine." "No one wants to hack us." "We are compliant." "No one will find that API." "Insurance will cover us." "If it ain't broke, don't fix it." Yours?" / Twitter

3 Posts

GitHub - TheD1rkMtr/HeapCrypt: Encypting the Heap while sleeping by hooking and modifying Sleep with our own sleep that encrypts the heap

https://github.com/TheD1rkMtr/HeapCrypt

3 Posts

Michael Koczwara on Twitter: "Sliver C2 infra in one tweet 😆 263 IPs most of them run Sliver on 31337 but there are also quite a lot of unusual ones There is also overlap with Cobalt Strike, Mythic, Deimos, and so on as TA runs multiple C2 on the servers 🤷‍♂️ 1.13.174.161 3.8.115.155 3.128.135.199… https://t.co/znXZFP6Myt" / Twitter

https://twitter.com/i/web/status/1639587828899147777

3 Posts

дэн on Twitter: "if i was 20 now i’d drop everything and jump into AI. i feel a great deal of FOMO tbh but also hesitant about abandoning all the context i already have in my field. not sure what to do." / Twitter

https://twitter.com/dan_abramov/status/1640022734989139970

3 Posts

Richard Johnson on Twitter: "I wanted to give Philippe the spotlight first but I was also laid off two weeks ago. I’m available for fuzzing related contract work and private trainings. I’ll be posting some public online training events soon. I’m also researching AI model fine tuning for security applications" / Twitter

https://twitter.com/richinseattle/status/1640109577864896512