Bunt hier bei den schwarzen Massen!!

#SporthalleHamburg #Hamburg #LordoftheLost #LotL

📰 SharePoint Flaw Chain Exploited to Deploy Warlock Ransomware

Ransomware alert: Storm-2603 exploits SharePoint flaws (CVE-2025-49706) to deploy Warlock ransomware. Attackers abuse the legitimate DFIR tool 'Velociraptor' to evade detection. Patch SharePoint now! ⚠️ #Ransomware #SharePoint #LotL

🔗 https://cyber.netsecops.io/articles/sharepoint-flaws-chained-to-deliver-warlock-ransomware/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

Living off the Land: Как легитимные утилиты стали оружием в руках хакеров на примере Rare Werewolf

В мире кибербезопасности уже не первый год набирает популярность тактика «Living off the Land» (LOTL) — «живущие за счёт земли». Её суть заключается в том, чтобы максимально использовать легитимное программное обеспечение и встроенные функции операционной системы для достижения злонамеренных целей. Это позволяет злоумышленникам эффективно маскироваться на заражённой системе, ведь активность программ вроде curl.exe, AnyDesk.exe или установщика WinRAR редко вызывает подозрения у рядовых пользователей и даже у некоторых систем защиты. Давайте детально разберём один из ярких примеров использования этой тактики, чтобы наглядно увидеть, как безобидные, на первый взгляд, программы могут быть превращены в мощное оружие для целевой атаки. Всем привет! Меня зовут Александр, я вирусный аналитик и реверс-инженер. Подписывайтесь на мой тг-канал - там много полезного контента. Поднять занавес атаки

https://habr.com/ru/articles/967934/

#анализ_вредоносов #реверсинжиниринг #Librarian_Ghouls #Rare_Werewolf #living_off_the_land #lotl #malware_analysis #троян #стилер #упаковщик

Heute gibt’s was auf die Ohren.

🤘

#dusseldorf #MitsubishiElectricHalle #LOTL #LordOfTheLost #Feuerschwanz

👨‍💻 Evasive #malware is on the rise, and in our latest webinar, #ANYRUN experts revealed how to detect #phishkits, #ClickFix, and #LOTL attacks.

These methods help SOC teams cut triage time, gain better threat visibility, and respond faster.

Watch now: https://youtu.be/Ze27bW8v5MU?si=sq6ZAq_MkEUqHo-6

Morning, cyber pros! It's been a bit quiet over the last 24 hours, but we've still got some critical updates to chew on. We're looking at a nasty WhatsApp zero-day, some clever abuse of forensic tools for C2, and a new infostealer campaign leveraging fake PDF editors. Let's dive in:

Actively Exploited Zero-Days in WhatsApp and Apple ⚠️
- WhatsApp has patched CVE-2025-55177, a vulnerability in its iOS and macOS apps, which may have been exploited in the wild.
- This flaw, related to insufficient authorisation of linked device sync messages, is believed to have been chained with Apple's CVE-2025-43300, an ImageIO out-of-bounds write, for targeted zero-click attacks.
- Amnesty International confirmed WhatsApp notified targeted individuals, including civil society members, suggesting an advanced spyware campaign. Users should factory reset and keep all software updated.

🤔 The Hacker News | https://thehackernews.com/2025/08/whatsapp-issues-emergency-update-for.html

New Tradecraft: Velociraptor Abuse, Teams Phishing, and Infostealer Campaigns 🛡️
- Threat actors are evolving their living-off-the-land tactics by abusing legitimate tools like Velociraptor, an open-source forensic platform, to establish C2 tunnels and deploy Visual Studio Code.
- We're also seeing a rise in Microsoft Teams phishing, where attackers impersonate IT help desks to deliver remote access tools and PowerShell payloads for credential theft and RCE, bypassing traditional email defences.
- A new infostealer, "TamperedChef," is being distributed via fraudulent PDF editing apps promoted through Google ads, with the malicious payload activated days after installation to evade initial detection. Some of these apps also turn user systems into residential proxies.

🤔 The Hacker News | https://thehackernews.com/2025/08/attackers-abuse-velociraptor-forensic.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/tamperedchef-infostealer-delivered-through-fraudulent-pdf-editor/

#CyberSecurity #InfoSec #ThreatIntelligence #ZeroDay #Vulnerability #WhatsApp #Apple #Malware #Infostealer #Velociraptor #MicrosoftTeams #Phishing #SocialEngineering #LotL #IncidentResponse