Elektrine
Log in Register

#threatresearch

32 posts· Last used 1d

Pedram @psoheil@c.im
· 1d ago
Akamai security researchers have uncovered an interesting attack technique they call “Bring Your Own EDR.” The research demonstrates how a trusted, privileged EDR component can potentially become an attacker’s tool against the system it was designed to protect. In a SentinelOne case study, researchers found that exposed interfaces could be abused by an administrator to bypass Windows Protected Process Light protections and interact with highly protected processes. By chaining multiple techniques, they demonstrated how legitimate security software could potentially be turned into a powerful attack mechanism. The bigger lesson is important: security software itself is part of the attack surface. EDR solutions operate with extremely high privileges, which makes vulnerabilities, exposed interfaces, weak trust assumptions, and insecure management mechanisms particularly significant. Organizations should consider not only whether their security tools detect threats, but also how well those tools protect themselves from abuse. “Bring Your Own EDR” is an interesting evolution of the traditional BYOVD concept and another reminder that trusted software should never automatically be treated as inherently trustworthy. #Cybersecurity #EDR #EndpointSecurity #ThreatResearch #ZeroTrust #WindowsSecurity #SecurityResearch #InformationSecurity https://www.akamai.com/blog/security-research/bring-your-own-edr-turn-commercial-edr-trojan-horse
0
0
0
0
AA @AAKL@infosec.exchange
· 4d ago
A reexamination of recent OpenAI sins: 1) a cyberattack and 2) attempted theft of data. New. "In May 2026, a malicious package campaign forced RubyGems to suspend new registrations and remove hundreds of packages [1]. Researchers later linked the activity to OpenAI agents, reporting unauthorized code execution and attempted API-key theft [2]. OpenAI acknowledged its agents’ use of RubyGems to retrieve public information [3]. RubyGems could not independently confirm attribution and found no evidence of successful key theft." Picus: Inside the OpenAI-RubyGems Incident: Did AI Agents Attack RubyGems? https://www.picussecurity.com/resource/blog/openai-rubygems-incident-ai-agents #infosec #threatresearch #RubyGems #cyberattack #OpenAI
0
0
0
0
AA @AAKL@infosec.exchange
· 1mo ago
New. "Dropping Elephant is an espionage-focused APT first observed in December 2015. It targets government, defense, energy, research, aviation, financial, technology, pharmaceutical, NGO, and think tank organizations across Asia, Europe, Türkiye, and the United States." Picus: Dropping Elephant (Patchwork): Espionage APT Tactics and Tools https://www.picussecurity.com/resource/blog/dropping-elephant-patchwork-espionage-apt-tactics-and-tools #infosec #threatresearch #espionage #Windows #Android
0
0
0
0
AA @AAKL@infosec.exchange
· 1mo ago
New. Cisco: “Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/ @TalosSecurity@mstdn.social More: "Talos said guardrails 'did not provide much protection', and that it encountered no sophisticated encoding or evasion techniques. Where guardrails did engage, they achieved little, and the pattern held across models and platforms rather than affecting any single vendor." Infosecurity-Magazine: Cisco: Cybercriminals Bypass AI Safety Controls by Splitting Malicious Tasks Across Multiple Sessions https://www.infosecurity-magazine.com/news/talos-attackers-split-tasks-evade/ #infosec #Cisco #threatresearch #cybercrime
0
0
0
0
AA @AAKL@infosec.exchange
· 1mo ago
From yesterday: Pillar: I'll Just Call You: Agent-to-Agent Privilege Boundary Failures in CI/CD on Google's ADK Repository https://www.pillar.security/blog/ill-just-call-you-agent-to-agent-privilege-boundary-failures-in-ci-cd-on-googles-adk-repository More: The Hacker News: Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html @thehackernews@social.tchncs.de #infosec #Google #bots #GitHub #threatresearch
0
0
0
0
AA @AAKL@infosec.exchange
· 1mo ago
New. Socket: Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain @SocketSecurity@fosstodon.org More: The Hacker news: Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html @thehackernews@social.tchncs.de #infosec #npm #threatresearch #JavaScript
0
0
0
0
AA @AAKL@infosec.exchange
· 1mo ago
New. True or false, the easiest thing to do is to blame a foreign country. But it's important to remember that this happened in the embattled state of Minnesota. Things being as they are, nothing should be off the table. "Attribution remains open. Minnesota state and local officials declined to say who was responsible, and TJ Sayers, senior director of threat intelligence at the Center for Internet Security, confirmed the attacks had not been attributed to any party and that it was unclear whether the PLCs CISA warned about were involved." Picus: Minnesota Water Systems Attacks: Internet-Exposed PLCs Under Attack https://www.picussecurity.com/resource/blog/minnesota-water-systems-attacks-internet-exposed-plcs-under-attack #infosec #threatresearch #cyberattack
0
0
0
0
AA @AAKL@infosec.exchange
· 1mo ago
Unit 42 published the related report yesterday: Unit 42: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ @unit42_intel@beta.mstdn.cf #threatresearch Infosecurity-Magazine: Chinese Threat Actor Uses DeepSeek AI to Orchestrate Vulnerability Exploits https://www.infosecurity-magazine.com/news/chinese-hacker-deepseek-ai/ #infosec #DeepSeek #opensource #Telegram
0
0
0
0
AA @AAKL@infosec.exchange
· 1mo ago
New. Cisco: Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/ @TalosSecurity@mstdn.social Group-IB (co-written by a marketer): Ransomware in 2026: Same Business, New Rules https://www.group-ib.com/blog/ransomware-2026-rules/ Warning: Recorded Future sells everything and the kitchen sink to third parties, including Google. No consent, no options. Recorded Future: TAG-195 Upgrades MaaS Ecosystem with Modular Tools https://www.recordedfuture.com/research/tag-195-evolves-maas-ecosystem Microsoft: Email threat landscape: Q2 2026 trends and insights https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/ Proofpoint; TA488 Targets Zimbra Mailservers with Half-Click Exploits https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits --- Rapid7: What Happened Between OpenAI and Hugging Face? https://www.rapid7.com/blog/post/ai-openai-hugging-face-what-happened/ @Rapid7Official@infosec.exchange Picus: "OpenAI was doing something reasonable and responsible. It was measuring how good its frontier models are at offensive cyber operations, so it could understand the risk." Picus: The Day an AI Cheated on Its Exam by Hacking Another Company https://www.picussecurity.com/resource/blog/the-day-an-ai-cheated-on-its-exam-by-hacking-another-company --- Posted yesterday: Huntress: Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat @huntress@infosec.exchange Fortinet: Inside a TrickBot Variant Using DNS Tunneling for C2 https://www.fortinet.com/blog/threat-research/inside-a-trickbot-variant-using-dns-tunneling-for-c2 @fortinet@infosec.exchange #infosec #threatresearch #ransomware #Windows #Microsoft #Claude #phishing #OpenAI #Zimbra
0
0
0
0
Jamf Threat Labs @jamfthreatlabs@bird.makeup
· 2mo ago
Meet CrashStealer. This one takes delivery more seriously than most, a signed and Apple-notarized dropper that's pulling its second stage payload down through GitHub. The payload is a native C++ stealer with client-side AES-GCM encryption and layered anti-analysis. Check out our writeup for additional details and indicators of compromise. https://www.jamf.com/blog/crashstealer-macos-infostealer-analysis/ #infostealer #malware #macos #threatresearch
1107
0
20
0
AA @AAKL@infosec.exchange
· 2mo ago
New. "Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025." Cisco: UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/ @TalosSecurity@mstdn.social #infosec #threatresearch #Python
0
0
0
0