Uncovering New Activity By APT10

Malware, APT, enSilo Breaking Malware, APT10, Threat Intelligence

Article Summary

In April 2019, enSilo detected what it believes to be new activity by Chinese cyber espionage group APT10. The variants discovered by enSilo are previously unknown and deploy malware that is unique to the threat actor. These malware families have a rich history of being used in many targeted attacks against government and

Read More

Threat Hunting using YETI and Elastic Stack

enSilo Breaking Malware

Combining YETI, an open-source threat intelligence project, with Elastic Stack is a great way to simplify and enhance the work performed by researchers and threat hunters.

 

Read More

L0RDIX: Multipurpose Attack Tool

enSilo Breaking Malware

L0rdix, currently available for purchase in underground forums, is aimed at infecting Windows-based machines, combines stealing and cryptocurrency mining methods, can avoid malware analysis tools and is designed to be a universal "go-to" tool for attackers. Indicators suggest the tool is still under development and we expect to encounter more
Read More

Enter The DarkGate: New Cryptocurrency Mining and Ransomware Campaign

enSilo Breaking Malware

An active and stealthy cryptocurrency mining and ransomware campaign infecting targets in Spain and France which leverages multiple bypass techniques to evade detection by traditional AV.

Read More

Melting Down PatchGuard: Leveraging KPTI to Bypass Kernel Patch Protection

cybersecurity, Windows, enSilo Breaking Malware, meltdown, KPTI, PatchGuard

The mitigation for Meltdown created a new part in the kernel which PatchGuard left unprotected, making hooking of system calls and interrupts possible, even with HVCI enabled.

Read More

Turning (Page) Tables: Bypassing Kernel Mitigations to Successfully Escalate Privileges

cybersecurity, enSilo Breaking Malware

On August 8th, at the BSides Conference in Las Vegas, we unveiled a new exploitation technique against the Microsoft Windows operating system. It's a general technique to leverage with kernel vulnerabilities and make privilege escalation easier.

Read More

GlobeImposter Ransomware

enSilo Breaking Malware, Ransomware, GlobeImposter

GlobeImposter Ransomware

Read More

Windows’ PsSetLoadImageNotifyRoutine Callbacks: the Good, the Bad and the Unclear (Part 2)

Windows, documentation, enSilo Breaking Malware

TL;DR: Security vendors and kernel developers beware – a programming error in the Windows kernel could prevent you from identifying which modules have been loaded at runtime. And the fix for it isn’t as foolproof as you would’ve hoped. 

Read More

Windows’ PsSetLoadImageNotifyRoutine Callbacks: the Good, the Bad and the Unclear (Part 1)

Windows, documentation, enSilo Breaking Malware

TL;DR: Security vendors and kernel developers beware – a programming error in the Windows kernel could prevent you from identifying which modules have been loaded at runtime.

Read More

Command Injection/Elevation – Environment Variables Revisited

Vulnerabilities, Windows, code injection, elevation, command injection, UAC, variables, enSilo Breaking Malware

Windows environment variables can be used to run commands and can also be used to bypass UAC, allowing an attacker with limited privileges to take complete control of the system. This code leverages a rather unusual scenario within Windows OS.

This is a continuation of our research as described in a previous post: Elastic Boundaries – Elevating

Read More

Tags