Description of the vulnerability: https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html Construction of the POC: https://github.com/BobTheShoplifter/Spring4Shell-POC Steps to Build/Run Tested with JDK 11.0.14, Spring Boot 2….
On April 26th, we identified a suspicious email that targeted a government official from Jordan’s foreign ministry. The email contained a malicious Excel document that drops a new backdoor named Saitama. Following our investigation, we were able to attribute this attack to the known Iranian Actor APT34. Also known as OilRig/COBALT GYPSY/IRN2/HELIX KITTEN, APT34 is…
The post APT34 targets Jordan Government using new Saitama backdoor appeared first on Malwarebytes Labs.
As the title implies, I would like to design a secure file storage/sharing platform. This is an abstract design question, so details regarding programing languages or platforms are not particularly relevant, unless they represent the only …
TL;DR:
Adopt a modern, test-driven methodology for securing your organization with Detection-as-Code.
Over the past decade, threat detection has become business-critical and even more complicated. As businesses move to the cloud, manual threat detect…
On May 11, 2022, the EU will publicize a proposal for a law on mandatory chat control. Privacy advocates aren’t happy.
The post Client side scanning may cost more than it delivers appeared first on Malwarebytes Labs.
The notorious ransomware operation known as REvil (aka Sodin or Sodinokibi) has resumed after six months of inactivity, an analysis of new ransomware samples has revealed.
“Analysis of these samples indicates that the developer has access to REvil’s s…
Cybersecurity researchers have dissected the inner workings of an information-stealing malware called Saintstealer that’s designed to siphon credentials and system information.
“After execution, the stealer extracts username, passwords, credit card de…
This is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965). Full Java source for the war is provided and modifiable, the war will get re-built whenever the docker image is built. The built WAR will then be …
An email warning of supposed chemical attacks that delivers Jester Stealer malware is being sent to people in Ukraine.
The post “Chemical attack” email warnings deliver Jester Stealer malware appeared first on Malwarebytes Labs.
Microsoft on Monday disclosed that it mitigated a security flaw affecting Azure Synapse and Azure Data Factory that, if successfully exploited, could result in remote code execution.
The vulnerability, tracked as CVE-2022-29972, has been codenamed “Sy…
