Jan Rammel

🚨 #WormLocker Returns with New Builds. First detected in 2021, this #ransomware remains active, with new samples recently identified. 👨‍💻 With #ANYRUN Sandbox, analysts can trace the full execution chain and uncover #malware behavior without the need for reverse engineering or manual debugging. Let’s see it in action. 📥 Upon execution, WormLocker 2.0 creates worm_tool.sys files in both the Desktop and Downloads folders. It uses the ‘takeown’ and ‘icacls’ commands to take ownership of system files and modifies their access control lists. Malware then unpacks its resources into the System32 folder. 🚫 To disrupt system recovery, it disables Task Manager, deletes hidden files, and terminates the Explorer process. The Shell settings are set to empty, keeping the Explorer disabled even after reboot. WormLocker 2.0 employs #AES-256 in CBC mode with a fixed salt. The key is generated from the hardcoded static password ‘LUC QPV BTR’ by applying SHA-256. 🔑 Entering this key restores system settings and decrypts the affected data. Finally, the ransomware runs a VBS script to play audio containing its ransom demand. 👨‍💻 Analysis session: https://lnkd.in/etVcmK-R With ‘LUC QPV BTR’ password entered: https://lnkd.in/evQtPqxr Improve your SOC operations with #ANYRUN 🚀 #ExploreWithANYRUN

27

⚠️ NoName057(16), a hacktivist group responsible for cyberattacks on critical infrastructure in Europe, taken down. 🌐 The group, which professed support for the Russian Federation since the start of the war of aggression against Ukraine, executed multiple DDoS attacks during high-level political events in Europe. 💻 To execute their attacks, the group recruited supporters through a messaging service. It is estimated that the hackers were able to mobilise around 4000 users who supported their operations. ⚖️ During an action day this week, authorities from 12 countries disrupted over 100 servers worldwide with Eurojust & Europol support. Press release 👉 https://lnkd.in/e2sbi2eX

215

8 Kommentare

🚨 Urgent Alert for IT Pros & CISOs: SharePoint on-premises is under active attack (CVE‑2025‑53770, CVSS 9.8) via the "ToolShell" exploit chain. Threat actors are installing web shells (like spinstall0.aspx), extracting machine keys, and moving laterally. ✅ Immediate actions: • Patch with July emergency updates • Enable AMSI + Microsoft Defender • Hunt for IOCs and malicious POST activity • Rotate cryptographic keys Details & detection tips are detailed in our latest community post. Don’t delay — this is actively exploited. Learn more here: https://lnkd.in/g9v9knUN

24

Cybersecurity isn’t one-size-fits-all. Organizations at different stages of security maturity often face the same question: Do we need 𝐄𝐧𝐝𝐩𝐨𝐢𝐧𝐭 𝐃𝐞𝐭𝐞𝐜𝐭𝐢𝐨𝐧 & 𝐑𝐞𝐬𝐩𝐨𝐧𝐬𝐞 (𝐄𝐃𝐑), or should we invest in 𝐌𝐚𝐧𝐚𝐠𝐞𝐝 𝐃𝐞𝐭𝐞𝐜𝐭𝐢𝐨𝐧 & 𝐑𝐞𝐬𝐩𝐨𝐧𝐬𝐞 (𝐌𝐃𝐑)? EDR gives you visibility and control over endpoints—but it demands strong in-house expertise. MDR, on the other hand, adds 24/7 monitoring and response capabilities, acting as an extension of your security team. The real challenge lies not in choosing the “better” option, but in identifying the one that aligns with your current maturity level, resources, and long-term vision. Check out this blog to explore the differences and make an informed decision for your organization’s security roadmap. https://lnkd.in/gxc2pkaT

19

1 Kommentar