VMWare Security Blog - Threat Analysis

Authors: Alex Murillo, Alan Ngo, Abe Schneider, Fae Carlisle Contributors: Nikki Benoit Executive Summary For years, threat actors have been using legitimate software for illegitimate or malicious purposes.  One such software is NetSupport Manager – a remote control application used for remote systems management.  In recent years, however, threat actors have repurposed this software as … Continued

The post NetSupport RAT: The RAT King Returns appeared first on VMware Security Blog.

Contributor: Nikki Benoit Executive Summary New Jupyter Infostealer variants continue to evolve with simple yet impactful changes to the techniques used by the malware author. This improvement aims to avoid detection and establishes persistence, enabling the attacker to stealthily compromise victims. The Carbon Black MDR Team has contained countless Jupyter Infostealer infections over the years. … Continued

The post Jupyter Rising: An Update on Jupyter Infostealer appeared first on VMware Security Blog.

In information security, even seemingly insignificant issues could pose a significant threat. One notable vector of attack is through device drivers used by legitimate software developers. There are numerous available drivers to support legacy hardware in every industry, some of which are from businesses that have long stopped supporting the device. To continue operations, organizations … Continued

The post Hunting Vulnerable Kernel Drivers appeared first on VMware Security Blog.

Contributors: Chris Wagner and Nikki Benoit Executive Summary  LummaStealer is a Malware-as-a-Service (MaaS) that is available on the dark web. MAAS models have substantially reduced the barrier to entry in the realm of big game hunting.  Instead of executing malspam and phishing campaigns directly, developers offer their platforms to other threat actors through an ecosystem … Continued

The post An iLUMMAnation on LummaStealer appeared first on VMware Security Blog.

The 8Base ransomware group has remained relatively unknown despite the massive spike in activity in Summer of 2023. The group utilizes encryption paired with “name-and-shame” techniques to compel their victims to pay their ransoms. 8Base has an opportunistic pattern of compromise with recent victims spanning across varied industries. Despite the high amount of compromises, the … Continued

The post 8Base Ransomware: A Heavy Hitting Player appeared first on VMware Security Blog.

VMware’s Carbon Black Managed Detection and Response (MDR) team began seeing a surge of TrueBot activity in May 2023. TrueBot, otherwise known as Silence.Downloader has been seen since at least 2017. TrueBot is under active development by Silence, with recent versions using a Netwrix vulnerability for delivery. In this article, we will break down what … Continued

The post Carbon Black’s TrueBot Detection appeared first on VMware Security Blog.

Command-and-control (C2) frameworks serve as a means to remotely manage and access compromised devices. They allow for the creation of various payload types, called implants, that are dropped on victim machines by attackers, enabling them to retain access and control over the infected victim.  While legitimate penetration testing utilizes C2 frameworks to evaluate system security … Continued

The post It’s Raining Implants: How to Generate C2 Framework Implants At Scale appeared first on VMware Security Blog.

Bring Your Own Vulnerable Driver (BYOVD) techniques are not new; they can be traced back at least as far as 2012 and the Shamoon wiper that targeted Saudi Aramco. The attack used RawDisk driver, which could manipulate hard drives from user space without any special permissions. This access enabled the malicious actor to erase data … Continued

The post Bring Your Own Backdoor: How Vulnerable Drivers Let Hackers In appeared first on VMware Security Blog.

This is a developing situation and this blog post will be updated as needed.  Reports of malicious code associated with the 3CX desktop application – part of the 3CX VoIP (Voice over Internet Protocol) platform – began on March 22, 2023. On March 30, 2023, 3CX confirmed the compromise, noting the affected 3CX desktop app … Continued

The post Investigating 3CX Desktop Application Attacks: What You Need to Know appeared first on VMware Security Blog.

PoshC2 is a proxy-aware cross-platform C2 framework that natively supports Docker.  Once configured and executed, it generates over 100 modifications of fresh implants, written in PowerShell, C#, and Python. The framework has a modular architecture to enable users to add their own modules and tools. No wonder, that nowadays PoshC2 is one of the most … Continued

The post How to Detect PoshC2 PowerShell Implants appeared first on VMware Security Blog.