⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Researchers at AhnLab describe a campaign that delivers the AtlasRAT remote access Trojan through a fake Flash Player installer. The infection chain starts with a Delphi executable named FlashPlay.Exe and uses fileless techniques to reconstruct payloads entirely in memory.
Researchers at Malwarebytes have uncovered a campaign distributing the remote access Trojan (RAT) AtlasRAT through a fake Adobe Flash Player installer. Despite Adobe ending support for Flash Player on December 31, 2020, and blocking Flash content, users continue to search for Flash to access legacy content, making them vulnerable.
Attackers increasingly exploit standard domain protocols like Kerberos and DNS to evade detection, as these activities blend with legitimate traffic. Kaspersky highlights techniques like Kerberoasting (abusing Kerberos to steal service account credentials) and DNS tunneling (covert data exfiltration via DNS queries), which bypass traditional signature-based tools.
Kaspersky explains that attackers often use standard domain protocols like Kerberos and DNS tunneling to blend in with legitimate traffic. Traditional network security tools struggle because these attacks lack distinct indicators.
Kaspersky KATA detects network anomalies like Kerberoasting and DNS tunneling that are indistinguishable from legitimate traffic.
Unit 42's analysis of XCSSET v40 reveals macOS malware that targets developers via Xcode. The researchers employed advanced pattern matching and AI to decode its logic.