Observed campaign summary:

Initial Access:
• Phishing emails with Excel (.XLAM) attachments
Execution:
• CVE-2018-0802 (EQNEDT32.EXE)
• HTA → mshta.exe
• PowerShell in-memory decoding
Deployment:
• Fileless .NET loader disguised as Microsoft.Win32.TaskScheduler
• Process hollowing into Msbuild.exe
• AES-encrypted C2 packets
• delimited command protocol
• Plugin-based architecture (50+ modules)

Capabilities include credential theft, ransomware, DDoS, system control, registry persistence, and remote command execution.

This campaign demonstrates mature modular RAT engineering combined with social engineering entry points.

Blue teamers - which telemetry source provides the strongest signal here?

Source: https://www.fortinet.com/blog/threat-research/deep-dive-into-new-xworm-campaign-utilizing-multiple-themed-phishing-emails?lctg=330010614

Follow @technadu for ongoing malware analysis and threat intelligence coverage.

#Infosec #MalwareResearch #ThreatIntel #XWorm #RAT #ProcessInjection #EDR #DFIR #CyberDefense #BlueTeam #TechNadu

RedirectThread: Building more evasive primitives to use as alternative for existing process injection techniques

https://github.com/Friends-Security/RedirectThread

#processinjection #infosec

Just read this amazing article about #processinjection technique #doppelganger

This one here gives a detailed and understandable inside of this technique for #redteam and #blueteam equally.

https://vari-sh.github.io/posts/doppelganger/

It's been quite a bit since I have been on here. A small update:
- I have a security analyst working with me, the help has been great!
- I going back to Penn State for the third time to do a security talk about process injection!
- I am prepping our annual penetration tests against our web app!

I continue to grow and learn more about my field in Security and am so grateful for the fun I get to have!
#security #updates #gratitude #processinjection #pennstate

A good read about Process injection techniques.

https://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/

#redteam #processinjection #pentesting

Well, isn't this just "punch you in the gut while I rip your teeth out" peachy. Never thought a #PoolParty would be such a downer #Hacking #ProcessInjection

https://securityaffairs.com/155464/hacking/pool-party-bypassing-edr.html

A couple of blog posts for learning about Linux process injection (specifically sshd injection for credential harvesting)

https://blog.xpnsec.com/linux-process-injection-aka-injecting-into-sshd-for-fun/

https://jm33.me/sshd-injection-and-password-harvesting.html

#processinjection #redteam #cybersecurity