A massive leak of #BlackBasta's 200,000+ chat messages reveals their tactics, key players, and internal conflicts.
The group uses #QakBot for access, exploits SMB misconfigurations, and faces growing instability. #leaking #Ransomware https://thehackernews.com/2025/02/leaked-black-basta-chat-logs-reveal.html
Трендовые уязвимости мая: лингвистический лесоруб и таинственный файл на ломаном английском
Хабр, привет! Уже по традиции я, Александр Леонов, ведущий эксперт лаборатории PT Expert Security Center, рассказываю про трендовые уязвимости месяца. Всего их было четыре: 1️⃣ уязвимость, приводящая к удаленному выполнения кода в многоплатформенном опенсорсном инструменте для сбора и обработки журналов Fluent Bit (CVE-2024-4323); 2️⃣ уязвимость, приводящая к удаленному выполнения кода в корпоративной веб-вики Confluence (CVE-2024-21683); уязвимости Microsoft, связанные с 3️⃣ обходом функций безопасности в Windows MSHTML Platform (CVE-2024-30040) и 4️⃣ повышением привилегий в Windows DWM Core Library (CVE-2024-30051). Узнать самые опасные уязвимости мая
https://habr.com/ru/companies/pt/articles/820613/
#трендовые_уязвимости #cve #vulnerability_management #microsoft #эксплойт #confluence #dwm #qakbot #ole #патчи
🚨#IcedID, #Smokeloader, #SystemBC, #Pikabot and #Bumblebee botnets have been disrupted by Operation Endgame!! This is the largest operation EVER against botnets involved with ransomware, with gargantuan thanks to a coordinated effort led by international agencies 👏👏
As with the #Qakbot and #Emotet takedowns, Spamhaus are again providing remediation support - those affected will be contacted from today with steps to take.
👉 For more information, read our write-up here: https://www.spamhaus.org/resource-hub/malware/operation-endgame-botnets-disrupted-after-international-action/
In April 2024, while researching CVE-2023-36033, we discovered another zero-day elevation-of-privilege vulnerability, which was assigned CVE-2024-30051 identifier and patched on May, 14 as part of Microsoft's patch Tuesday. We have seen it exploited by QakBot and other malware.
Patch Tuesday, May 2024 Edition
https://krebsonsecurity.com/2024/05/patch-tuesday-may-2024-edition/
#AdobeSubstance3DPainter #macOSSonoma14.5update #AdobeFramemaker #CVE-2024-30040 #CVE-2024-30044 #CVE-2024-30051 #ImmersiveLabs #AdobeAnimate #GoogleChrome #SatnamNarang #TimetoPatch #Illustrator #KevinBreen #Sharepoint #AdobeAero #acrobat #Tenable #MSHTML #Qakbot #reader
#Qakbot came back with new tricks. In this new blog post, we will:
● unpack it
● decrypt it (strings + cnc)
● and write a config extractor in python
using only static analysis (and #malcat of course :). Link:
https://malcat.fr/blog/writing-a-qakbot-50-config-extractor-with-malcat
Starting from a (backdoored) MSI installer, we will unroll the infection to chain to get the final Qakbot sample. Sticking to pure static analysis, we will then decrypt Qakbot's configuration and finally write a script in Malcat to automate the process.
Marcel SIneM(S)US
Anonymous 🐈️🐾☕🍵🏴🇵🇸 
Émilio Gonzalez
Habr
The Spamhaus Project
The Threat Codex
KrebsOnSecurity RSS
ITSEC News
🛡 H3lium@infosec.exchange/:~# 
Malcat