Mastodawn

🔒 Security News Digest - 2026-03-23

📊 17 updates from 5 sources:

🔹 BleepingComputer: Trivy supply-chain attack spreads to Docker, GitHub repos
https://www.bleepingcomputer.com/news/security/trivy-supply-chain-attack-spreads-to-docker-github-repos/

🔹 Security Boulevard: Tonic Textual + Haystack: Privacy-safe data for RAG pipelines
https://securityboulevard.com/2026/03/tonic-textual-haystack-privacy-safe-data-for-rag-pipelines/

🔹 Security Boulevard: Sacumen Launches ConnectX, an AI Platform for Managing the Full Connector Lifecycle
https://securityboulevard.com/2026/03/sacumen-launches-connectx-an-ai-platform-for-managing-the-full-connector-lifecycle/

🔹 Security Boulevard: AccuKnox Launches AI-Security 2.0 to Extend Zero Trust Protection to AI Models and Agents
https://securityboulevard.com/2026/03/accuknox-launches-ai-security-2-0-to-extend-zero-trust-protection-to-ai-models-and-agents/

🔹 Security Boulevard: Securing the AI Frontier: Suzu Labs Sweeps 4 Global InfoSec Awards 2026
https://securityboulevard.com/2026/03/securing-the-ai-frontier-suzu-labs-sweeps-4-global-infosec-awards-2026/

🔹 The Hacker News: North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware
https://thehackernews.com/2026/03/north-korean-hackers-abuse-vs-code-auto.html

🔹 Security Boulevard: SOCRadar Launches AI Agent Marketplace and Identity Intelligence at RSAC 2026
https://securityboulevard.com/2026/03/socradar-launches-ai-agent-marketplace-and-identity-intelligence-at-rsac-2026/

🔹 Security Boulevard: Protos Labs Opens Up Protos AI for Free, Targeting CTI Teams at RSAC 2026
https://securityboulevard.com/2026/03/protos-labs-opens-up-protos-ai-for-free-targeting-cti-teams-at-rsac-2026/

🔹 The Record from Recorded Future News: Education company Kaplan reports data breach impacting more than 230,000
https://therecord.media/kaplan-data-breach-hack-notification

🔹 Security Boulevard: ZeroTier Launches Quantum-Secure Networking Platform at RSAC 2026
https://securityboulevard.com/2026/03/zerotier-launches-quantum-secure-networking-platform-at-rsac-2026/

🔹 Security Boulevard: BSidesSLC 2025 – So You Think You Can Detect? Lisa Li On Detection Testing In Production
https://securityboulevard.com/2026/03/bsidesslc-2025-so-you-think-you-can-detect-lisa-li-on-detection-testing-in-production/

🔹 Security News | TechCrunch: Russian authorities block paywall removal site Archive.today
https://techcrunch.com/2026/03/23/russian-authorities-block-paywall-removal-site-archive-today/

🔹 BleepingComputer: Crunchyroll probes breach after hacker claims to steal 6.8M users' data
https://www.bleepingcomputer.com/news/security/crunchyroll-probes-breach-after-hacker-claims-to-steal-68m-users-data/

🔹 Security Boulevard: IRONSCALES Launches Email Attack of the Day, a Daily Threat Intelligence Series for Security Teams
https://securityboulevard.com/2026/03/ironscales-launches-email-attack-of-the-day-a-daily-threat-intelligence-series-for-security-teams/

🔹 Security Boulevard: Absolute Security: Enterprise PCs Are Left Unprotected 76 Days a Year as Endpoint Tools Fail 21% of the Time
https://securityboulevard.com/2026/03/absolute-security-enterprise-pcs-are-left-unprotected-76-days-a-year-as-endpoint-tools-fail-21-of-the-time/

🔹 BleepingComputer: TeamPCP deploys Iran-targeted wiper in Kubernetes attacks
https://www.bleepingcomputer.com/news/security/teampcp-deploys-iran-targeted-wiper-in-kubernetes-attacks/

🔹 The Record from Recorded Future News: FBI warns of Russian, Iranian cyber activity involving messaging platforms
https://therecord.media/russia-iran-cyber-fbi-hacks

#InfoSec #SecurityNews

Trivy supply-chain attack spreads to Docker, GitHub repos

The TeamPCP hackers behind the Trivy supply-chain attack continued to target Aqua Security, pushing malicious Docker images and hijacking the company's GitHub organization to tamper with dozens of repositories.

BleepingComputer

Security Feed 8h ago

🔒 Security News Digest - 2026-03-23

📊 22 updates from 8 sources:

🔹 SecurityWeek: Aqua’s Trivy Vulnerability Scanner Hit by Supply Chain Attack
https://www.securityweek.com/aquas-trivy-vulnerability-scanner-hit-by-supply-chain-attack/

🔹 Threat Intelligence: M-Trends 2026: Data, Insights, and Strategies From the Frontlines
https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026/

🔹 BleepingComputer: Varonis Atlas: Securing AI and the Data That Powers It
https://www.bleepingcomputer.com/news/security/varonis-atlas-securing-ai-and-the-data-that-powers-it/

🔹 Security News | TechCrunch: Federal immigration agents filmed making airport arrests as Trump calls in ICE to ease security line delays
https://techcrunch.com/2026/03/23/federal-immigration-agents-filmed-making-airport-arrests-as-trump-calls-in-ice-to-ease-security-line-delays/

🔹 SecurityWeek: Chip Services Firm Trio-Tech Says Subsidiary Hit by Ransomware
https://www.securityweek.com/chip-services-firm-trio-tech-says-subsidiary-hit-by-ransomware/

🔹 SecurityWeek: M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds
https://www.securityweek.com/m-trends-2026-initial-access-handoff-shrinks-from-hours-to-22-seconds/

🔹 Security Boulevard: Honeytokens on the Developer Workstation: When Cleanup Takes Time
https://securityboulevard.com/2026/03/honeytokens-on-the-developer-workstation-when-cleanup-takes-time/

🔹 Security Boulevard: Female Cybersecurity Leaders to Watch in Michigan
https://securityboulevard.com/2026/03/female-cybersecurity-leaders-to-watch-in-michigan/

🔹 darkreading: Attackers Hide Infostealer in Copyright Infringement Notices
https://www.darkreading.com/cyberattacks-data-breaches/attackers-hide-infostealer-copyright-infringement-notices

🔹 Security News | TechCrunch: FBI says Iranian hackers are using Telegram to steal data in malware attacks
https://techcrunch.com/2026/03/23/fbi-says-iranian-hackers-are-using-telegram-to-steal-data-in-malware-attacks/

🦠 Malwarebytes: The March Madness scam playbook
https://www.malwarebytes.com/blog/news/2026/03/the-march-madness-scam-playbook

🔹 Security Boulevard: The March Madness scam playbook
https://securityboulevard.com/2026/03/the-march-madness-scam-playbook/

🔹 Security Boulevard: Nike’s 1.4TB IP Theft: When Ransomware Targets Trade Secrets Instead of Files
https://securityboulevard.com/2026/03/nikes-1-4tb-ip-theft-when-ransomware-targets-trade-secrets-instead-of-files/

🔹 Security Boulevard: SecurityScorecard Debuts TITAN AI to Automate Third-Party Risk Management Workflows
https://securityboulevard.com/2026/03/securityscorecard-debuts-titan-ai-to-automate-third-party-risk-management-workflows/

🔹 Security Boulevard: Webinar Recap: Cyber Risk in Wartime – Threat Intelligence, Risk Modeling, and Insurance Strategy
https://securityboulevard.com/2026/03/webinar-recap-cyber-risk-in-wartime-threat-intelligence-risk-modeling-and-insurance-strategy/

🦠 Malwarebytes: FriendlyDealer mimics official app stores to push unvetted gambling apps
https://www.malwarebytes.com/blog/scams/2026/03/friendlydealer-mimics-official-app-stores-to-push-unvetted-gambling-apps

🔹 Security Boulevard: FriendlyDealer mimics official app stores to push unvetted gambling apps
https://securityboulevard.com/2026/03/friendlydealer-mimics-official-app-stores-to-push-unvetted-gambling-apps/

🔹 Krebs on Security: ‘CanisterWorm’ Springs Wiper Attack Targeting Iran
https://krebsonsecurity.com/2026/03/canisterworm-springs-wiper-attack-targeting-iran/

🔹 SecurityWeek: RSAC 2026 Conference Announcements Summary (Pre-Event)
https://www.securityweek.com/rsac-2026-conference-announcements-summary-pre-event/

🔹 Security Boulevard: SOC 2 penetration testing requirements
https://securityboulevard.com/2026/03/soc-2-penetration-testing-requirements/

🔹 Security Boulevard: Capital One Software Expands Databolt to Protect Unstructured Data for AI Use
https://securityboulevard.com/2026/03/capital-one-software-expands-databolt-to-protect-unstructured-data-for-ai-use/

#InfoSec #SecurityNews

Aqua's Trivy Vulnerability Scanner Hit by Supply Chain Attack

Aqua Security’s Trivy vulnerability scanner was compromised in a supply chain attack, leading to information-stealing infections.

SecurityWeek

Security Feed 11h ago

🔒 Security News Digest - 2026-03-23

📊 13 updates from 6 sources:

🔹 BleepingComputer: FBI warns of Handala hackers using Telegram in malware attacks
https://www.bleepingcomputer.com/news/security/fbi-warns-of-handala-hackers-using-telegram-in-malware-attacks/

🔹 SecurityWeek: Tycoon 2FA Fully Operational Despite Law Enforcement Takedown
https://www.securityweek.com/tycoon-2fa-fully-operational-despite-law-enforcement-takedown/

🔹 The Hacker News: Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware
https://thehackernews.com/2026/03/microsoft-warns-irs-phishing-hits-29000.html

🔹 The Record from Recorded Future News: US soldier sentenced for helping North Korean IT workers
https://therecord.media/us-soldier-sentencer-for-helping-nk-it-workers

🔹 SecurityWeek: QNAP Patches Four Vulnerabilities Exploited at Pwn2Own
https://www.securityweek.com/qnap-patches-four-vulnerabilities-exploited-at-pwn2own/

🔹 Security Boulevard: AI Readiness Assessment: How to Evaluate If Your Business Is Truly Ready for AI
https://securityboulevard.com/2026/03/ai-readiness-assessment-how-to-evaluate-if-your-business-is-truly-ready-for-ai/

🔹 The Hacker News: We Found Eight Attack Vectors Inside AWS Bedrock. Here's What Attackers Can Do with Them
https://thehackernews.com/2026/03/we-found-eight-attack-vectors-inside.html

🔹 BleepingComputer: Microsoft Exchange Online service change causes email access issues
https://www.bleepingcomputer.com/news/microsoft/new-exchange-online-virtual-account-blocks-email-access-via-mobile-mac-apps/

🔹 Security Boulevard: Cisco Extends Security Reach to AI Agents
https://securityboulevard.com/2026/03/cisco-extends-security-reach-to-ai-agents/

🦠 Malwarebytes: Advanced Flow will make Android sideloading safer
https://www.malwarebytes.com/blog/news/2026/03/advanced-flow-will-make-android-sideloading-safer

🔹 Security Boulevard: RSA Launches ID Plus Sovereign Deployment for Organizations That Can’t Afford Identity Downtime
https://securityboulevard.com/2026/03/rsa-launches-id-plus-sovereign-deployment-for-organizations-that-cant-afford-identity-downtime/

🔹 Security Boulevard: Ridge Security Brings Agentic AI Pentesting to SMBs With PurpleRidge 3.0
https://securityboulevard.com/2026/03/ridge-security-brings-agentic-ai-pentesting-to-smbs-with-purpleridge-3-0/

🔹 Security Boulevard: Vorlon Survey: 99% of Organizations Got Hit by a SaaS or AI Security Incident in 2025
https://securityboulevard.com/2026/03/vorlon-survey-99-of-organizations-got-hit-by-a-saas-or-ai-security-incident-in-2025/

#InfoSec #SecurityNews

FBI warns of Handala hackers using Telegram in malware attacks

The U.S. Federal Bureau of Investigation (FBI) warned network defenders that Iranian hackers linked to the country's Ministry of Intelligence and Security (MOIS) are using Telegram in malware attacks.

BleepingComputer

Security Feed 16h ago

🔒 Security News Digest - 2026-03-23

📊 7 updates from 4 sources:

🔹 The Hacker News: Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems
https://thehackernews.com/2026/03/hackers-exploit-cve-2025-32975-cvss-100.html

🦠 Malwarebytes: A week in security (March 16 – March 22)
https://www.malwarebytes.com/blog/uncategorized/2026/03/a-week-in-security-march-16-march-22

🔹 Security Boulevard: A week in security (March 16 – March 22)
https://securityboulevard.com/2026/03/a-week-in-security-march-16-march-22/

🔹 Security Boulevard: Building a Layered Security Stack: Identity, Network and Device Protection
https://securityboulevard.com/2026/03/building-a-layered-security-stack-identity-network-and-device-protection/

🔹 BleepingComputer: New KB5085516 emergency update fixes Microsoft account sign-in
https://www.bleepingcomputer.com/news/microsoft/new-kb5085516-emergency-update-fixes-microsoft-account-sign-in/

🔹 The Hacker News: Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper
https://thehackernews.com/2026/03/trivy-hack-spreads-infostealer-via.html

🔹 BleepingComputer: CISA orders feds to patch DarkSword iOS flaws exploited attacks
https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-darksword-ios-flaws-exploited-attacks/

#InfoSec #SecurityNews

Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems

CVE-2025-32975 exploited since March 2026 on unpatched KACE SMA systems, enabling admin takeover and payload delivery.

The Hacker News

Security Feed 19h ago

🔹 SecurityWeek

Oracle Releases Emergency Patch for Critical Identity Manager Vulnerability

CVE-2026-21992 can be used without authentication for remote code execution and it may have been exploited in the wild. The post Oracle Releases Emergency Patch for Critical Identity Manager Vulnerability appeared first on SecurityWeek.

🔗 https://www.securityweek.com/oracle-releases-emergency-patch-for-critical-identity-manager-vulnerability/

Oracle Releases Emergency Patch for Critical Identity Manager Vulnerability

Oracle issues out-of-band updates to patch CVE-2026-21992, a critical vulnerability in Identity Manager and Web Services Manager.

SecurityWeek

Security Feed 19h ago

🔹 Security Boulevard

The Real State of Offensive Security: AI, Penetration Testing & The Road Ahead with Andrew Wilson

Tom Eston interviews offensive AI researcher and PhD candidate Andrew Wilson, a former Bishop Fox partner who helped grow the firm from under 20 people to nearly 500, built award-winning AI solutions for SOC modernization, founded Cactus Con, and relocated his family to Guadalajara to open and scale a Bishop Fox office. They discuss Mexico’s […] The post The Real State of Offensive Security: AI, Penetration Testing & The Road Ahead with Andrew Wilson appeared first on Shared Security Podcast. The post The Real State of Offensive Security: AI, Penetration Testing & The Road Ahead with Andrew Wilson appeared first on Security Boulevard.

🔗 https://securityboulevard.com/2026/03/the-real-state-of-offensive-security-ai-penetration-testing-the-road-ahead-with-andrew-wilson/

The Real State of Offensive Security: AI, Penetration Testing & The Road Ahead with Andrew Wilson

Tom Eston interviews offensive AI researcher and PhD candidate Andrew Wilson, a former Bishop Fox partner who helped grow the firm from under 20 people to nearly 500, built award-winning AI solutions for SOC modernization, founded Cactus Con, and relocated his family to Guadalajara to open and scale a Bishop Fox office. They discuss Mexico’s The post The Real State of Offensive Security: AI, Penetration Testing & The Road Ahead with Andrew Wilson appeared first on Shared Security Podcast.

Security Boulevard

Security Feed 22h ago

🔒 Security News Digest - 2026-03-23

📊 8 updates from 2 sources:

🔹 Security Boulevard: Is there an innovative way to manage Agentic AI risks
https://securityboulevard.com/2026/03/is-there-an-innovative-way-to-manage-agentic-ai-risks/

🔹 Security Boulevard: How capable are NHIs in managing company secrets
https://securityboulevard.com/2026/03/how-capable-are-nhis-in-managing-company-secrets/

🦠 Malwarebytes: This is all it takes to stop a train (Lock and Code S07E06)
https://www.malwarebytes.com/blog/podcast/2026/03/this-is-all-it-takes-to-stop-a-train-lock-and-code-s07e06

🔹 Security Boulevard: This is all it takes to stop a train (Lock and Code S07E06)
https://securityboulevard.com/2026/03/this-is-all-it-takes-to-stop-a-train-lock-and-code-s07e06/

🔹 Security Boulevard: Side-Channel Attack Mitigation for Quantum-Resistant MCP Metadata
https://securityboulevard.com/2026/03/side-channel-attack-mitigation-for-quantum-resistant-mcp-metadata/

🔹 Security Boulevard: Booz Allen Rolls Out Vellox, a Five-Product AI Cyber Suite Built on Adversary Tradecraft
https://securityboulevard.com/2026/03/booz-allen-rolls-out-vellox-a-five-product-ai-cyber-suite-built-on-adversary-tradecraft-2/

🔹 Security Boulevard: CTG Launches Cyber Resilience Scoring Dashboard to Give CISOs a Single Risk Number
https://securityboulevard.com/2026/03/ctg-launches-cyber-resilience-scoring-dashboard-to-give-cisos-a-single-risk-number/

🔹 Security Boulevard: Bindplane Adds Autonomous Pipeline Monitoring and Threat Intel Enrichment Ahead of RSAC
https://securityboulevard.com/2026/03/bindplane-adds-autonomous-pipeline-monitoring-and-threat-intel-enrichment-ahead-of-rsac/

#InfoSec #SecurityNews

Is there an innovative way to manage Agentic AI risks

How Are Organizations Tackling the Challenges of Non-Human Identities? What steps are organizations taking to secure their digital environments from machine-based threats? Both opportunities and challenges arise with the introduction of non-human identities (NHIs). These machine identities are pivotal in modern cybersecurity frameworks, yet they can also be a source of vulnerabilities if not managed The post Is there an innovative way to manage Agentic AI risks appeared first on Entro.

Security Boulevard

Security Feed 1d ago

🔒 Security News Digest - 2026-03-22

📊 5 updates from 2 sources:

🔹 Security Boulevard: When Data Mining Conti Leaks Leads to Actual Binaries and to a Hardcoded C2 With an Encryption Key on Tripod.com – Part Three
https://securityboulevard.com/2026/03/when-data-mining-conti-leaks-leads-to-actual-binaries-and-to-a-hardcoded-c2-with-an-encryption-key-on-tripod-com-part-three/

🔹 Security Boulevard: A Compilation of BitCoin Wallet Addresses from the RAMP (Russian Anonymous Marketplace) Forum Members – A Compilation
https://securityboulevard.com/2026/03/a-compilation-of-bitcoin-wallet-addresses-from-the-ramp-russian-anonymous-marketplace-forum-members-a-compilation/

🔹 Security Boulevard: A Domains Portfolio Belonging to RAMP (Russian Anonymous Marketplace) Forum Members – A Compilation
https://securityboulevard.com/2026/03/a-domains-portfolio-belonging-to-ramp-russian-anonymous-marketplace-forum-members-a-compilation/

🔹 iTnews - Security: "CanisterWorm" supply chain malware attacks npm
https://www.itnews.com.au/news/canisterworm-supply-chain-malware-attacks-npm-624485?utm_source=feed&utm_medium=rss&utm_campaign=iTnews+Security+feed

🔹 iTnews - Security: US, Germany, Canada disrupt botnets
https://www.itnews.com.au/news/us-germany-canada-disrupt-botnets-624497?utm_source=feed&utm_medium=rss&utm_campaign=iTnews+Security+feed

#InfoSec #SecurityNews

When Data Mining Conti Leaks Leads to Actual Binaries and to a Hardcoded C2 With an Encryption Key on Tripod.com - Part Three

Dear blog readers, Continuing the "When Data Mining Conti Leaks Leads to Actual Binaries and to a Hardcoded C2 With an Encryption Key on Tripod.com - Part Two" blog post series in this post I'll continue analyzing the next malicious software binary which I obtained by data mining Conti Leaks with a lot of success. The actual malicious software binary location URL:hxxp://shighil.com/dl2.exeMD5: c2055b7fbaa041d9f68b9d5df9b45eddSHA-1: e4bd443bd4ce9029290dcd4bb47cb1a01f3b1b06SHA-256: 342f04c4720590c40d24078d46d9b19d8175565f0af460598171d58f5ffc48f3Here's the actual analysis.Executive Summary dl2.exe is a Windows x86_64 PE executable (849.5 KB) exhibiting characteristics consistent with malicious software. The binary demonstrates sophisticated capabilities including registry manipulation, dynamic API resolution, file system operations, and system information gathering. Analysis identified multiple high-risk behaviors typical of malware, particularly around persistence mechanisms and anti-analysis techniques. Key Findings Critical Capabilities (High Severity) 1. Registry Manipulation Functions: sub_419118, sub_419228, sub_419198, sub_4192e8, sub_4193c4, sub_40da8c, sub_422ef4, sub_418ffcAPIs Used: RegOpenKeyA, RegSetValue, RegCreateKey, RegQueryValueRegistry Keys Accessed: SoftwareMicrosoftWindowsCurrentVersionRestrictRun and NoRun keys (policy restriction keys)Risk: High - Can modify system configuration and establish persistence 2. Dynamic API Resolution Function: sub_40b868 (0x40b868)APIs Used: GetProcAddress, LoadLibrary, GetModuleHandleRisk: High - Common evasion technique to bypass static analysis and API monitoringDetails: Dynamically resolves function addresses at runtime, making static detection more difficult Medium Severity Capabilities 3. File System Operations Functions: sub_423718, sub_4228a4, sub_423360, sub_41aeecAPIs Used: CreateFile, DeleteFile, MoveFile, CopyFile, FindFirstFile, FindNextFile, GetFileAttributesRisk: Medium - Can manipulate files on the system 4. System Information Gathering Functions: sub_4542b0, sub_40f0ac, sub_46df44, sub_46d3bcAPIs Used: GetVersionExA, GetSystemInfo, GetComputerName, GetUserNameRisk: Medium - Fingerprints the system, likely for profiling or anti-VM checks 5. Memory Manipulation Functions: sub_4540e0, sub_453df0, sub_453d10, sub_453b50APIs Used: VirtualAlloc, VirtualProtect, HeapAlloc, HeapFreeRisk: Medium - Can change memory protection flags, potentially indicating code injection or unpacking behavior 6. Mutex Creation Function: sub_46be50 (0x46be50)API Used: CreateMutexRisk: Medium - Commonly used for single-instance enforcement in malware Security Features (Informational) 7. Stack Protection Mechanisms Stack Cookie Initialization (sub_45ca90 at 0x45ca90): Uses multiple entropy sources (GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter) to generate stack cookiesStack Guard Pages (sub_4540e0 at 0x4540e0): Implements guard pages using VirtualQuery, VirtualAlloc, and VirtualProtect Notable Observations Entry Point: 0x4545a0 (_start)Main Function: 0x46d9f4 (jumps to 0x46da1c)Imported Libraries: ADVAPI32.dll, GDI32.dll, KERNEL32.dll, OLEAUT32.dll, SHELL32.dll, SHLWAPI.dll, USER32.dll, WINSPOOL.DRV, comdlg32.dll, ole32.dll, oledlg.dllTotal Functions Identified: 2,616No Network APIs Detected: No direct socket, HTTP, or network communication APIs were found in the analyzed functions (analysis incomplete)No Obvious Encryption Strings: No strings matching common encryption algorithm names were found Malware Classification Based on identified capabilities, this binary exhibits behaviors consistent with: System modification malware (registry manipulation, file operations)Information stealer (system information gathering)Potentially a dropper/loader (dynamic API resolution, memory manipulation)Critical Malicious Capabilities Identified 1. Windows Policy Restriction Manipulation (HIGH SEVERITY) The binary targets multiple Windows policy registry keys designed to restrict user actions: Registry Keys Targeted: SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer NoRun - Prevents running programs via Run dialogRestrictRun - Restricts which programs can executeNoDrives - Hides/restricts drive accessNoNetConnectDisconnect - Prevents network connections/disconnectionsNoRecentDocsHistory - Disables recent documentsNoClose - Prevents closing windowsSoftwareMicrosoftWindowsCurrentVersionPoliciesNetwork NoEntireNetwork - Restricts network browsingSoftwareMicrosoftWindowsCurrentVersionPoliciesComdlg32 Common dialog restrictions Functions Involved: sub_419228 (0x419228) - Writes DWORD registry valuessub_4192e8 (0x4192e8) - Writes/deletes registry string values and keyssub_419198 (0x419198) - Reads registry integer valuessub_4193c4 (0x4193c4) - Reads registry string valuessub_419118 (0x419118) - Opens registry keyssub_40b0d4 (0x40b0d4) - Saves settings to registrysub_432610 (0x432610) - Batch registry operations 2. Console Output Manipulation sub_46be50 (0x46be50) - Opens CONOUT$ device handle, likely for output redirection or hiding console output 3. Persistence & Configuration The binary uses both registry and INI file storage for configuration, with registry taking precedence. This dual-storage approach suggests: Fallback mechanisms for different environmentsAbility to persist settings across system changesSummary of Malicious Findings This binary is highly malicious with the following critical behaviors: Primary Threat: System Restriction Malware The binary manipulates Windows Group Policy registry keys to: Disable the Run dialog (NoRun)Restrict program execution (RestrictRun)Hide/disable drives (NoDrives)Prevent network operations (NoNetConnectDisconnect, NoEntireNetwork)Disable system features (NoClose, NoRecentDocsHistory) This behavior is characteristic of ransomware preparation, system lockers, or destructive malware that prevents users from: Running recovery toolsAccessing safe modeUsing system utilitiesConnecting to networks for help Additional Malicious Capabilities: Dynamic API resolution - Evades static analysisDual persistence - Registry + INI file storageConsole manipulation - Hides output/errorsFile system operations - Can modify/delete filesMemory manipulation - Can inject code or unpack payloadsSystem fingerprinting - Profiles victim environment

Security Boulevard

Security Feed 1d ago

🔹 Security Boulevard

BSidesSLC 2025 – Faces In The Fog – Seth Law On Unconventional User Enumeration

Author, Creator & Presenter: Seth Law, Founder of Redpoint Security Our thanks to BSidesSLC for publishing their Creators, Authors and Presenter’s outstanding BSidesSLC 2025 content on the Organizations' YouTube Channel. The post BSidesSLC 2025 – Faces In The Fog – Seth Law On Unconventional User Enumeration appeared first on Security Boulevard.

🔗 https://securityboulevard.com/2026/03/bsidesslc-2025-faces-in-the-fog-seth-law-on-unconventional-user-enumeration/

BSidesSLC 2025 - Faces In The Fog - Seth Law On Unconventional User Enumeration

Security Boulevard

Security Feed 1d ago

🔹 Security News | TechCrunch

Delve accused of misleading customers with ‘fake compliance’

An anonymous Substack post accuses compliance startup Delve of “falsely” convincing “hundreds of customers they were compliant” with privacy and security regulations.

🔗 https://techcrunch.com/2026/03/22/delve-accused-of-misleading-customers-with-fake-compliance/

Delve accused of misleading customers with ‘fake compliance’ | TechCrunch

An anonymous Substack post accuses compliance startup Delve of “falsely” convincing “hundreds of customers they were compliant” with privacy and security regulations.

TechCrunch