st1nger 
🏴☠️ 
#PgDog is a #network #proxy and it can see every byte sent between #Postgres and the clients. It understands #SQL and can infer where queries should go, without requiring changes to application code. In this article, we discuss how we handle the Postgres wire protocol and manipulate it to serve queries to multiple databases at the same time. https://pgdog.dev/blog/hacking-postgres-wire-protocol
OTX BotLatest Mustang Panda Arsenal: Toneshell, StarProxy, PAKLOG, CorKLOG, and SplatCloak
Mustang Panda, a threat actor group, has developed new tools including two keyloggers (PAKLOG and CorKLOG) and an EDR evasion driver (SplatCloak). PAKLOG monitors keystrokes and clipboard data, using a custom encoding scheme. CorKLOG captures keystrokes, encrypts data with RC4, and establishes persistence through services or scheduled tasks. SplatCloak disables kernel-level notification callbacks for Windows Defender and Kaspersky drivers, employing obfuscation techniques like control flow flattening and mixed boolean arithmetic. Along with those tools, the group has been observed using updated versions of ToneShell and a new tool called StarProxy. ToneShell, a backdoor, now features changes in its FakeTLS C2 communication protocol and client identifier storage methods. StarProxy, a lateral movement tool, uses the FakeTLS protocol to proxy traffic and facilitate attacker communications.
Pulse ID: 6800148cd0bb0e7851cc6218
Pulse Link: https://otx.alienvault.com/pulse/6800148cd0bb0e7851cc6218
Pulse Author: AlienVault
Created: 2025-04-16 20:35:24
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#BackDoor #Clipboard #CyberSecurity #EDR #InfoSec #Kaspersky #KeyLogger #OTX #OpenThreatExchange #Proxy #TLS #Windows #bot #AlienVault
ADMIN magazine
Claudio Pires
Acreium
Comunitatea Linux România
Marcus Jaschen
Rad Web Hosting