Login
Ofcom, the UK's Online Safety Act regulator, has fined online message board 4chan Β£20,000 ($26,680) for failing to protect children from harmful content.β¦
The Dutch government has placed Nexperia - a Chinese-owned semiconductor company that previously operated Britain's Newport Wafer Fab β under special administrative measures, citing serious governance failures that threaten European tech security.β¦
We were testing a black-box service for a client with an interesting software platform. They'd provided an SDK with minimal documentationβjust enough to show basic usage, but none of the underlying service definitions. The SDK binary was obfuscated, and the gRPC endpoints it connected to had reflection disabled.
After spending too much time piecing together service names from SDK string dumps and network traces, we built grpc-scan to automate what we were doing manually: exploiting how gRPC implementations handle invalid requests to enumerate services without any prior knowledge.
Unlike REST APIs where you can throw curl at an endpoint and see what sticks, gRPC operates over HTTP/2 using binary Protocol Buffers. Every request needs:
Miss any of these and you get nothing useful. There's no OPTIONS request, typically limited documentation, no guessing /api/v1/users might exist. You either have the proto files or you're blind.
Most teams rely on server reflectionβa gRPC feature that lets clients query available services. But reflection is usually disabled in production. Itβs an information disclosure risk, yet developers rarely provide alternative documentation.
But gRPC have varying error messages which inadvertently leak service existence through different error codes:
# Calling non-existent\`unknown service FakeService``real service, wrong method``unknown method FakeMethod for service UserService``real service and method``missing authentication token`
These distinct responses let us map the attack surface. The tool automates this process, testing thousands of potential service/method combinations based on various naming patterns we've observed.
The enumeration engine does a few things
1. Even when reflection is "disabled," servers often still respond to reflection requests with errors that confirm the protocol exists. We use this for fingerprinting.
2. For a base word like "User", we generate likely services
FreshRSS UserUserServiceUsersUserAPIuser.Userapi.v1.Usercom.company.UserEach pattern tested with common method names: Get, List, Create, Update, Delete, Search, Find, etc.
3. Different gRPC implementations return subtly different error codes:
UNIMPLEMENTED vs NOT_FOUND for missing servicesINVALID_ARGUMENT vs INTERNAL for malformed requests4. gRPC's HTTP/2 foundation means we can multiplex hundreds of requests over a single TCP connection. The tool maintains a pool of persistent connections, improving scan speed.
What do we commonly see in pentests using RPC?
Service Sprawl from Migrations
SDK analysis often reveals parallel service implementations, for example
UserService - The original monolith endpointAccountManagementService - New microservice, full authUserDataService - Read-only split-off, inconsistent authUserProfileService - Another team's implementationThese typically emerge from partial migrations where different teams own different pieces. The older services often bypass newer security controls.
Method Proliferation and Auth Drift
Real services accumulate method variants over time, for example
GetUser - Original, added auth in v2GetUserDetails - Different team, no auth checkFetchUserByID - Deprecated but still activeGetUserWithPreferences - Calls GetUser internally, skips authSo newer methods that compose older ones sometimes bypass security checks the original methods later acquired.
Package Namespace Archaeology
Service discovery reveals organizational history
com.startup.api.Users - Original serviceplatform.users.v1.UserAPI - Post-merge standardization attemptinternal.batch.UserBulkService - "Internal only" but on same endpointEach namespace generation typically has different security assumptions. Internal services exposed on the same port as public APIs are surprisingly commonβdevelopers assume network isolation that doesn't exist.
UserService/CreateUser exists, but crafting a valid User message requires either the proto definition or guessing or reverse engineering of the SDK's serialization.Available at https://github.com/Adversis/grpc-scan. Pull requests welcome.
This week's video was recorded on Friday morning Aussie time, and as promised, hackers dumped data the following day. Listening back to parts of the video as I write this on a Sunday morning, pretty much what was predicted happened: data was dumped, it included Qantas, and the injunction did nothing to stop it. I knew that in advance, and I'm also certain Qantas did too, but that hasn't stopped their messaging from implying the contrary:
This wording remains worrying: "we have an ongoing injunction in place to prevent the stolen data being accessed, viewed, released, used, transmitted or published" Clearly, this hasn't "prevented" the release and broad distribution of the data. More: https://t.co/SiuMqDlyHB
β Troy Hunt (@troyhunt) October 12, 2025
I'll save more for the next weekly vid as there's a lot to unpack, suffice to say that since this recording, I've been rather busy with media commentary, including explaining how the data is now out there, it's not just on "the dark web", we don't have it, but the bad guys definitely do.
The worldβs largest and most disruptive botnet is now drawing a majority of its firepower from compromised Internet-of-Things (IoT) devices hosted on U.S. Internet providers like AT&T, Comcast and Verizon, new evidence suggests. Experts say the heavy concentration of infected devices at U.S. providers is complicating efforts to limit collateral damage from the botnetβs attacks, which shattered previous records this week with a brief traffic flood that clocked in at nearly 30 trillion bits of data per second.
Since its debut more than a year ago, the Aisuru botnet has steadily outcompeted virtually all other IoT-based botnets in the wild, with recent attacks siphoning Internet bandwidth from an estimated 300,000 compromised hosts worldwide.
The hacked systems that get subsumed into the botnet are mostly consumer-grade routers, security cameras, digital video recorders and other devices operating with insecure and outdated firmware, and/or factory-default settings. Aisuruβs owners are continuously scanning the Internet for these vulnerable devices and enslaving them for use in distributed denial-of-service (DDoS) attacks that can overwhelm targeted servers with crippling amounts of junk traffic.
As Aisuruβs size has mushroomed, so has its punch. In May 2025, KrebsOnSecurity was hit with a near-record 6.35 terabits per second (Tbps) attack from Aisuru, which was then the largest assault that Googleβs DDoS protection service Project Shield had ever mitigated. Days later, Aisuru shattered that record with a data blast in excess of 11 Tbps.
By late September, Aisuru was publicly flexing DDoS capabilities topping 22 Tbps. Then on October 6, its operators heaved a whopping 29.6 terabits of junk data packets each second at a targeted host. Hardly anyone noticed because it appears to have been a brief test or demonstration of Aisuruβs capabilities: The traffic flood lasted less only a few seconds and was pointed at an Internet server that was specifically designed to measure large-scale DDoS attacks.
A measurement of an Oct. 6 DDoS believed to have been launched through multiple botnets operated by the owners of the Aisuru botnet. Image: DDoS Analyzer Community on Telegram.
Aisuruβs overlords arenβt just showing off. Their botnet is being blamed for a series of increasingly massive and disruptive attacks. Although recent assaults from Aisuru have targeted mostly ISPs that serve online gaming communities like Minecraft, those digital sieges often result in widespread collateral Internet disruption.
For the past several weeks, ISPs hosting some of the Internetβs top gaming destinations have been hit with a relentless volley of gargantuan attacks that experts say are well beyond the DDoS mitigation capabilities of most organizations connected to the Internet today.
Steven Ferguson is principal security engineer at Global Secure Layer (GSL), an ISP in Brisbane, Australia. GSL hosts TCPShield, which offers free or low-cost DDoS protection to more than 50,000 Minecraft servers worldwide. Ferguson told KrebsOnSecurity that on October 8, TCPShield was walloped with a blitz from Aisuru that flooded its network with more than 15 terabits of junk data per second.
Ferguson said that after the attack subsided, TCPShield was told by its upstream provider OVH that they were no longer welcome as a customer.
βThis was causing serious congestion on their Miami external ports for several weeks, shown publicly via their weather map,β he said, explaining that TCPShield is now solely protected by GSL.
Traces from the recent spate of crippling Aisuru attacks on gaming servers can be still seen at the website blockgametracker.gg, which indexes the uptime and downtime of the top Minecraft hosts. In the following example from a series of data deluges on the evening of September 28, we can see an Aisuru botnet campaign briefly knocked TCPShield offline.
An Aisuru botnet attack on TCPShield (AS64199) on Sept. 28Β can be seen in the giant downward spike in the middle of this uptime graphic. Image: grafana.blockgametracker.gg.
Paging through the same uptime graphs for other network operators listed shows almost all of them suffered brief but repeated outages around the same time. Here is the same uptime tracking for Minecraft servers on the network provider Cosmic (AS30456), and it shows multiple large dips that correspond to game server outages caused by Aisuru.
Multiple DDoS attacks from Aisuru can be seen against the Minecraft host Cosmic on Sept. 28. The sharp downward spikes correspond to brief but enormous attacks from Aisuru. Image: grafana.blockgametracker.gg.
Ferguson said heβs been tracking Aisuru for about three months, and recently he noticed the botnetβs composition shifted heavily toward infected systems at ISPs in the United States. Ferguson shared logs from an attack on October 8 that indexed traffic by the total volume sent through each network provider, and the logs showed that 11 of the top 20 traffic sources were U.S. based ISPs.
AT&T customers were by far the biggest U.S. contributors to that attack, followed by botted systems on Charter Communications, Comcast, T-Mobile and Verizon, Ferguson found. He said the volume of data packets per second coming from infected IoT hosts on these ISPs is often so high that it has started to affect the quality of service that ISPs are able to provide to adjacent (non-botted) customers.
βThe impact extends beyond victim networks,β Ferguson said. βFor instance we have seen 500 gigabits of traffic via Comcastβs network alone. This amount of egress leaving their network, especially being so US-East concentrated, will result in congestion towards other services or content trying to be reached while an attack is ongoing.β
Roland Dobbins is principal engineer at Netscout. Dobbins said Ferguson is spot on, noting that while most ISPs have effective mitigations in place to handle large incoming DDoS attacks, many are far less prepared to manage the inevitable service degradation caused by large numbers of their customers suddenly using some or all available bandwidth to attack others.
βThe outbound and cross-bound DDoS attacks can be just as disruptive as the inbound stuff,β Dobbin said. βWeβre now in a situation where ISPs are routinely seeing terabit-per-second plus outbound attacks from their networks that can cause operational problems.β
βThe crying need for effective and universal outbound DDoS attack suppression is something that is really being highlighted by these recent attacks,β Dobbins continued. βA lot of network operators are learning that lesson now, and thereβs going to be a period ahead where thereβs some scrambling and potential disruption going on.β
KrebsOnSecurity sought comment from the ISPs named in Fergusonβs report. Charter Communications pointed to a recent blog post on protecting its network, stating that Charter actively monitors for both inbound and outbound attacks, and that it takes proactive action wherever possible.
βIn addition to our own extensive network security, we also aim to reduce the risk of customer connected devices contributing to attacks through our Advanced WiFi solution that includes Security Shield, and we make Security Suite available to our Internet customers,β Charter wrote in an emailed response to questions. βWith the ever-growing number of devices connecting to networks, we encourage customers to purchase trusted devices with secure development and manufacturing practices, use anti-virus and security tools on their connected devices, and regularly download security patches.β
A spokesperson for Comcast responded, βCurrently our network is not experiencing impacts and we are able to handle the traffic.β
Aisuru is built on the bones of malicious code that was leaked in 2016Β by the original creators of the Mirai IoT botnet. Like Aisuru, Mirai quickly outcompeted all other DDoS botnets in its heyday, and obliterated previous DDoS attack records with a 620 gigabit-per-second siege that sidelined this website for nearly four days in 2016.
The Mirai botmasters likewise used their crime machine to attack mostly Minecraft servers, but with the goal of forcing Minecraft server owners to purchase a DDoS protection service that they controlled. In addition, they rented out slices of the Mirai botnet to paying customers, some of whom used it to mask the sources of other types of cybercrime, such as click fraud.
A depiction of the outages caused by the Mirai botnet attacks against the internet infrastructure firm Dyn on October 21, 2016. Source: Downdetector.com.
Dobbins said Aisuruβs owners also appear to be renting out their botnet as a distributed proxy network that cybercriminal customers anywhere in the world can use to anonymize their malicious traffic and make it appear to be coming from regular residential users in the U.S.
βThe people who operate this botnet are also selling (it as) residential proxies,β he said. βAnd thatβs being used to reflect application layer attacks through the proxies on the bots as well.β
The Aisuru botnet harkens back to its predecessor Mirai in another intriguing way. One of its owners is using the Telegram handle β9gigsofram,β which corresponds to the nickname used by the co-owner of a Minecraft server protection service called Proxypipe that was heavily targeted in 2016 by the original Mirai botmasters.
Robert Coelho co-ran Proxypipe back then along with his business partner Erik β9gigsoframβ Buckingham, and has spent the past nine years fine-tuning various DDoS mitigation companies that cater to Minecraft server operators and other gaming enthusiasts. Coelho said he has no idea why one of Aisuruβs botmasters chose Buckinghamβs nickname, but added that it might say something about how long this person has been involved in the DDoS-for-hire industry.
βThe Aisuru attacks on the gaming networks these past seven day have been absolutely huge, and you can see tons of providers going down multiple times a day,β Coelho said.
Coelho said the 15 Tbps attack this week against TCPShield was likely only a portion of the total attack volume hurled by Aisuru at the time, because much of it would have been shoved through networks that simply couldnβt process that volume of traffic all at once. Such outsized attacks, he said, are becoming increasingly difficult and expensive to mitigate.
βItβs definitely at the point now where you need to be spending at least a million dollars a month just to have the network capacity to be able to deal with these attacks,β he said.
Aisuru has long been rumored to use multiple zero-day vulnerabilities in IoT devices to aid its rapid growth over the past year. XLab, the Chinese security company that was the first to profile Aisuruβs rise in 2024, warned last month that one of the Aisuru botmasters had compromised the firmware distribution website for Totolink, a maker of low-cost routers and other networking gear.
βMultiple sources indicate the group allegedly compromised a router firmware update server in April and distributed malicious scripts to expand the botnet,β XLab wrote on September 15. βThe node count is currently reported to be around 300,000.β
A malicious script implanted into a Totolink update server in April 2025. Image: XLab.
Aisuruβs operators received an unexpected boost to their crime machine in August when the U.S. Department JusticeΒ charged the alleged proprietor of Rapper Bot, a DDoS-for-hire botnet that competed directly with Aisuru for control over the global pool of vulnerable IoT systems.
Once Rapper Bot was dismantled, Aisuruβs curators moved quickly to commandeer vulnerable IoT devices that were suddenly set adrift by the governmentβs takedown, Dobbins said.
βFolks were arrested and Rapper Bot control servers were seized and thatβs great, but unfortunately the botnetβs attack assets were then pieced out by the remaining botnets,β he said. βThe problem is, even if those infected IoT devices are rebooted and cleaned up, they will still get re-compromised by something else generally within minutes of being plugged back in.β
A screenshot shared by XLabs showing the Aisuru botmasters recently celebrating a record-breaking 7.7 Tbps DDoS. The user at the top has adopted the name βEthan J. Foltzβ in a mocking tribute to the alleged Rapper Bot operator who was arrested and charged in August 2025.
XLabβs September blog post cited multiple unnamed sources saying Aisuru is operated by three cybercriminals: βSnow,β whoβs responsible for botnet development; βTom,β tasked with finding new vulnerabilities; and βForky,β responsible for botnet sales.
KrebsOnSecurity interviewed Forky in our May 2025 story about the record 6.3 Tbps attack from Aisuru. That story identified Forky as a 21-year-old man from Sao Paulo, Brazil who has been extremely active in the DDoS-for-hire scene since at least 2022. The FBI has seized Forkyβs DDoS-for-hire domains several times over the years.
Like the original Mirai botmasters, Forky also operates a DDoS mitigation service called Botshield. Forky declined to discuss the makeup of his ISPβs clientele, or to clarify whether Botshield was more of a hosting provider or a DDoS mitigation firm. However, Forky has posted on Telegram about Botshield successfully mitigating large DDoS attacks launched against other DDoS-for-hire services.
In our previous interview, Forky acknowledged being involved in the development and marketing of Aisuru, but denied participating in attacks launched by the botnet.
Reached for comment earlier this month, Forky continued to maintain his innocence, claiming that he also is still trying to figure out who the current Aisuru botnet operators are in real life (Forky said the same thing in our May interview).
But after a week of promising juicy details, Forky came up empty-handed once again. Suspecting that Forky was merely being coy, I asked him how someone so connected to the DDoS-for-hire world could still be mystified on this point, and suggested that his inability or unwillingness to blame anyone else for Aisuru would not exactly help his case.
At this, Forky verbally bristled at being pressed for more details, and abruptly terminated our interview.
βIβm not here to be threatened with ignorance because you are stressed,β Forky replied. βTheyβre blaming me for those new attacks. Pretty much the whole world (is) due to your blog.β
Article tags
by Harshil Patel and Prabudh Chakravorty
*EDITORβS NOTE: Special thank you to the GitHub team for working with us on this research. All malicious GitHub repositories mentioned in the following research have been reported to GitHub and taken down.
Digital banking has made our lives easier, but itβs also handed cybercriminals a golden opportunity. Banking trojans are the invisible pickpockets of the digital age, silently stealing credentials while you browse your bank account or check your crypto wallet. Today, weβre breaking down a particularly nasty variant called Astaroth, and itβs doing something clever: abusing GitHub to stay resilient.
McAfeeβs Threat Research team recently uncovered a new Astaroth campaign thatβs taken infrastructure abuse to a new level. Instead of relying solely on traditional command-and-control (C2) servers that can be taken down, these attackers are leveraging GitHub repositories to host malware configurations. When law enforcement or security researchers shut down their C2 infrastructure, Astaroth simply pulls fresh configurations from GitHub and keeps running. Think of it like a criminal who keeps backup keys to your house hidden around the neighborhood. Even if you change your locks, theyβve got another way in.
Astaroth is capable of targeting many South American countries like Brazil, Mexico, Uruguay, Argentina, Paraguay, Chile, Bolivia, Peru, Ecuador, Colombia, Venezuela, and Panama. It can also target Portugal and Italy.Β
But in the recent campaign, it seems to be largely focused on Brazil.Β
Figure 1: Geographical PrevalenceΒ
Β
Astaroth is a password-stealing malware family that targets South America. The malware leverages GitHub to host configuration files, treating the platform as resilient backup infrastructure when primary C2 servers become inaccessible. McAfee reported the findings to GitHub and worked with their security research team to remove the malicious repositories, temporarily disrupting operations.Β
Β
Figure 2 : Infection chainΒ
Β
The attack starts with an e-mail to the victim which contains a link to a site that downloads a zip file. Emails with themes such as DocuSign and resumes are used to lure the victims into downloading a zip file.Β
Figure 3: Phishing Email
Figure 4: Phishing Email
Figure 5: Phishing Email
Β
JavaScript DownloaderΒ
The downloaded zip file contains a LNK file, which has obfuscated javascript command run using mshta.exe.Β
Β
This command simply fetches more javascript code from the following URL:Β
Β
To impede analysis, all the links are geo-restricted, such that they can only be accessed from the targeted geography.Β
The downloaded javascript then downloads a set of files in ProgramData from a randomly selected server:Β
Figure 6: Downloaded Files
Here,Β Β
βCorsair.Yoga.06342.8476.366.logβ isΒ AutoIT compiled script, βCorsair.Yoga.06342.8476.366.exeβ is AutoIT interpreter,Β
βstack.tmpβ is an encrypted payload (Astaroth),Β
Β and βdump.logβ is an encrypted malware configuration.Β
AutoIt script is executed by javascript, which builds and loads a shellcode in the memory of AutoIT process.Β
Β
Figure 7: AutoIt script building shellcode
The shellcode has 3 entrypoints and $LOADOFFSET is the one using which it loads a DLL in memory.Β
To run the shellcode the script hooks Kernel32: LocalCompact, and makes it jump to the entrypoint.Β
Figure 8: Hooking LocalCompact APIΒ
Β
Shellcodeβs $LOADOFFSET starts by resolving a set of APIs that are used for loading a DLL in memory. The API addresses are stored in a jump table at the very beginning of the shellcode memory.Β
Figure 9: APIs resolved by shellcodeΒ
Β
Here shellcode is made to load a DLL file(Delphi) and this DLL decrypts and injects the final payload into newly created RegSvc.exe process.Β
Β
The payload, Astaroth malware is written in Delphi and uses various anti-analysis techniques and shuts down the system if it detects that it is being analyzed.Β
It checks for the following tools in the system:Β
Figure 10: List of analysis toolsΒ
Β
It also makes sure that system locale is not related to the United States or English.Β
Every second it checks for program windows like browsers, if that window is in foreground and has a banking related site opened then it hooks keyboard events to get keystrokes.Β
Figure 11: Hooking keyboard eventsΒ
Programs are targeted if they have a window class name containing chrome, ieframe, mozilla, xoff, xdesk, xtrava or sunawtframe.
Many banking-related sites are targeted, some of which are mentioned below:
caixa.gov.brΒ
safra.com.brΒ
Itau.com.brΒ
bancooriginal.com.brΒ
santandernet.com.brΒ
btgpactual.comΒ
Β
We also observed some cryptocurrency-related sites being targeted:Β
etherscan.ioΒ
binance.comΒ
bitcointrade.com.brΒ
metamask.ioΒ
foxbit.com.brΒ
localbitcoins.comΒ
Β
The stolen banking credentials and other information are sent to C2 server using a custom binary protocol.Β
Figure 12: C2 communicationΒ Β
Β
Figure 13: C2 infrastructureΒ
Malware config is stored in dump.log encrypted, following is the information stored in it:Β
Figure 14: Malware configurationΒ
Β
Every 2 hours the configuration is updated by fetching an image file from config update URLs and extracting the hidden configuration from the image.Β
hxxps://bit[.]ly/4gf4E7H β> hxxps://raw.githubusercontent[.]com//dridex2024//razeronline//refs/heads/main/razerlimpa[.]pngΒ
Image file keeps the configuration hidden by storing it in the following format:
We found more such GitHub repositories having image files with above pattern and reported them to GitHub, which they have taken down.Β
For persistence, Astaroth drops a LNK file in startup folder which runs the AutoIT script to launch the malware when the system starts.Β Β
McAfee has extensive coverage for Astaroth:Β
Trojan:Shortcut/SuspiciousLNK.OSRTΒ
Trojan:Shortcut/Astaroth.OJSΒ
Trojan:Script/Astaroth.DLΒ
Trojan:Script/Astaroth.AIΒ
Trojan:Script/AutoITLoader.LC!2Β
Trojan:Shortcut/Astaroth.STUPΒ
| IOCΒ | Hash / URLΒ |
| EmailΒ |
7418ffa31f8a51a04274fc8f610fa4d5aa5758746617020ee57493546ae35b70 7609973939b46fe13266eacd1f06b533f8991337d6334c15ab78e28fa3b320be 11f0d7e18f9a2913d2480b6a6955ebc92e40434ad11bed62d1ff81ddd3dda945Β |
| ZIP URLΒ | https://91.220.167.72.host.secureserver[.]net/peHg4yDUYgzNeAvm5.zipΒ |
| LNKΒ | 34207fbffcb38ed51cd469d082c0c518b696bac4eb61e5b191a141b5459669dfΒ |
| JS DownloaderΒ | 28515ea1ed7befb39f428f046ba034d92d44a075cc7a6f252d6faf681bdba39cΒ |
| Download serverΒ |
clafenval.medicarium[.]help sprudiz.medicinatramp[.]click frecil.medicinatramp[.]beauty stroal.medicoassocidos[.]beauty strosonvaz.medicoassocidos[.]help gluminal188.trovaodoceara[.]sbs scrivinlinfer.medicinatramp[.]icu trisinsil.medicesterium[.]help brusar.trovaodoceara[.]autos gramgunvel.medicoassocidos[.]beauty blojannindor0.trovaodoceara[.]motorcyclesΒ |
| AutoIT compiled scriptΒ | a235d2e44ea87e5764c66247e80a1c518c38a7395291ce7037f877a968c7b42bΒ |
| Injector dllΒ | db9d00f30e7df4d0cf10cee8c49ee59a6b2e518107fd6504475e99bbcf6cce34Β |
| payloadΒ | 251cde68c30c7d303221207370c314362f4adccdd5db4533a67bedc2dc1e6195Β |
| Startup LNKΒ | 049849998f2d4dd1e629d46446699f15332daa54530a5dad5f35cc8904adea43Β |
| C2 serverΒ |
1.tcp.sa.ngrok[.]io:20262 1.tcp.us-cal-1.ngrok[.]io:24521 5.tcp.ngrok[.]io:22934 7.tcp.ngrok[.]io:22426 9.tcp.ngrok[.]io:23955 9.tcp.ngrok[.]io:24080Β |
| Config update URLΒ |
https://bit[.]ly/49mKne9 https://bit[.]ly/4gf4E7HΒ https://raw.githubusercontent[.]com/dridex2024/razeronline/refs/heads/main/razerlimpa.pngΒ |
| GitHub Repositories hosting config imagesΒ |
https://github[.]com/dridex2024/razeronlineΒ
https://github[.]com/Config2023/01atk-83567zΒ https://github[.]com/S20x/m25Β https://github[.]com/Tami1010/baseΒ https://github[.]com/balancinho1/balacoΒ https://github[.]com/fernandolopes201/675878fvfsv2231im2Β https://github[.]com/polarbearfish/fishbomΒ https://github[.]com/polarbearultra/amendointorradoΒ https://github[.]com/projetonovo52/masterΒ https://github[.]com/vaicurintha/golΒ |
Β
The post Astaroth: Banking Trojan Abusing GitHub for Resilience appeared first on McAfee Blog.
Compiled Node.js files (.node files) are compiled binary files that allow Node.js applications to interface with native code written in languages like C, C++, or Objective-C as native addon modules.
Unlike JavaScript files which are mostly readable, assuming theyβre not obfuscated and minified, .node files are compiled binaries that can contain machine code and run with the same privileges as the Node.js process that loads them, without the constraints of the JavaScript sandbox. These extensions can directly call system APIs and perform operations that pure JavaScript code cannot, like making system calls.
These addons can use Objective-C++ to leverage native macOS APIs directly from Node.js. This allows arbitrary code execution outside the normal sandboxing that would constrain a typical Electron application.
When an Electron application uses a module that contains a compiled .node file, it automatically loads and executes the binary code within it. Many Electron apps use the ASAR (Atom Shell Archive) file format to package the application's source code. ASAR integrity checking is a security feature that checks the file integrity and prevents tampering with files within the ASAR archive. It is disabled by default.
When ASAR integrity is enabled, your Electron app will verify the header hash of the ASAR archive on runtime. If no hash is present or if there is a mismatch in the hashes, the app will forcefully terminate.
This prevents files from being modified within the ASAR archive. Note that it appears the integrity check is a string that you can regenerate after modifying files, then find and replace in the executable file as well. See more here.
But many applications run from outside the verified archive, under app.asar.unpacked since the compiled .node files (the native modules) cannot be executed directly from within an ASAR archive.
And so even with the proper security features enabled, a local attacker can modify or replace .node files within the unpacked directory - not so different than DLL hijacking on Windows.
We wrote two tools - one to find Electron applications that arenβt hardened against this, and one to simply compile Node.js addons.
.node filesSecurity researchers say they duped pro-Russia cybercriminals into targeting a fake critical infrastructure organization, which the crew later claimed - via their Telegram group - to be a real-world attack.β¦
Microsoft's Threat Intelligence team has sounded the alarm over a new financially-motivated cybercrime spree that is raiding US university payroll systems.β¦
Interesting data point from CISA's latest emergency directive - supply chain attacks have increased 250% from 2021-2024 (62β219 incidents).
Technical breakdown: - Primary attack vector: Third-party vendor compromise (45% of incidents) - Average dwell time in supply chain attacks: 287 days vs 207 days for direct attacks - Detection gap remains significant - Cost differential: $5.12M (supply chain) vs $4.45M (direct attacks)
CISA's directive focuses on: - Zero-trust architecture implementation - SBOM (Software Bill of Materials) requirements - Continuous vendor risk assessment
Massachusetts highlighted as high-risk due to tech sector density and critical infrastructure.
Would be interested in hearing from those implementing SBOM strategies - what tools/frameworks are working?
US authorities have seized the latest incarnation of BreachForums, the cybercriminal bazaar recently reborn under the stewardship of the so-called Scattered Lapsus$ Hunters, with help from French cyber cops and the Paris prosecutor's office.β¦
UK trade union Prospect is notifying members of a breach that involved data such as sexual orientation and disabilities.β¦
CISA's Automated Indicator Sharing (AIS) program is showing concerning metrics on AI-driven phishing campaigns:
Technical Overview: - 300% YoY increase in AI-generated phishing attempts - Attack sophistication score: 3.2 β 8.7 (out of 10) - 85% targeting US infrastructure - ML algorithms analyzing target orgs' communication patterns, employee behavior, business relationships - Real-time generation of unique, personalized vectors
Threat Intelligence: FBI Cyber Division reports campaigns using advanced NLP to create contextually relevant emails that mimic legitimate business comms. Over 200 US organizations compromised in 30 days.
Attack Chain Evolution: Traditional phishing relied on generic templates + basic social engineering. Current wave utilizes ML to generate thousands of unique, personalized emails in real-time, making signature-based detection largely ineffective.
NIST predicts 90% of successful breaches in 2025 will originate from AI-powered campaigns.
Detailed analysis with case studies and mitigation frameworks: https://cyberupdates365.com/ai-phishing-attacks-surge-300-percent-us-cisa-emergency-alert/
Interested in technical discussion on effective countermeasures beyond traditional email filtering.
Poisoning AI models might be way easier than previously thought if an Anthropic study is anything to go on.Β β¦
