An active and stealthy cryptocurrency mining and ransomware campaign infecting targets in Spain and France
enSilo Breaking Malware, cybersecurity, Windows, meltdown, KPTI, PatchGuard
The mitigation for Meltdown created a new part in the kernel which PatchGuard left unprotected, making
enSilo Breaking Malware, cybersecurity, enSilo Corporate and Product
On August 8th, at the BSides Conference in Las Vegas, we unveiled a new exploitation technique against the
enSilo Breaking Malware, GlobeImposter, Ransomware, enSilo Corporate and Product
GlobeImposter Ransomware
documentation, enSilo Breaking Malware, Windows, enSilo Corporate and Product
TL;DR: Security vendors and kernel developers beware – a programming error in the Windows kernel could
documentation, enSilo Breaking Malware, Windows, enSilo Corporate and Product
TL;DR: Security vendors and kernel developers beware – a programming error in the Windows kernel could
Vulnerabilities, command injection, elevation, variables, enSilo Breaking Malware, UAC, Windows, code injection, enSilo Corporate and Product
Windows environment variables can be used to run commands and can also be used to bypass UAC, allowing an
Injection Techniques, AtomBombing, CFG, code injection, Control Flow Guard, Windows, enSilo Breaking Malware, enSilo Corporate and Product
TL;DR: We show AtomBombing modifications to enable us to inject code into CFG-protected processes.
Injection Techniques, APC, AtomBombing, code injection, Research, Windows, enSilo Breaking Malware, Malware, enSilo Corporate and Product
TL;DR Here’s a new code injection technique, dubbed AtomBombing, which exploits Windows atom tables and Async
Vulnerabilities, bypass UAC, elevation, environment variable, path redirect, variable expansion, enSilo Breaking Malware, UAC, Windows, code injection, enSilo Corporate and Product
Even though any process is provided with variables from its environment, they are often overlooked by
Tags
- enSilo Corporate and Product (215)
- Weekly Security News (96)
- Windows (50)
- Malware (42)
- cybersecurity (26)
- Industry (23)
- Research (22)
- enSilo Breaking Malware (22)
- Business (14)
- Ransomware (13)
- code injection (9)
- Vulnerabilities (7)
- AtomBombing (6)
- WannaCry (6)
- POS malware (5)
- RAT (5)
- NSA (4)
- exploit (4)
- APT (3)
- Endpoint Protection (3)
- Mac OS X (3)
- Moker (3)
- NotPetya (3)
- Process Doppelganging (3)
- UAC (3)
- Web Malware (3)
- documentation (3)
- hooking (3)
- vulnerability (3)
- Android (2)
- ArdBot (2)
- CFG (2)
- Control Flow Guard (2)
- Emotet Botnet (2)
- Fileless Malware (2)
- Furtim (2)
- Gartner (2)
- GlobeImposter (2)
- Injection Techniques (2)
- Windows XP (2)
- av (2)
- elevation (2)
- meltdown (2)
- tools (2)
- APC (1)
- Bad Rabbit (1)
- CVS (1)
- CryFile (1)
- Detours (1)
- ESTEEMAUDIT (1)
- Equifax (1)
- FindADetour (1)
- GOZI (1)
- HIPAA (1)
- Hancitor (1)
- KPTI (1)
- Linux (1)
- Lockerpin.A (1)
- MSSP (1)
- ModPOS (1)
- NtSetInformationVirtualMemory (1)
- PCI DSS (1)
- Patch (1)
- PatchGuard (1)
- SCADA (1)
- Scarab (1)
- Unix (1)
- Verizon (1)
- Windows 10 (1)
- anti-virus (1)
- avulnerabilitychecker (1)
- bypass UAC (1)
- command injection (1)
- environment variable (1)
- excel-scriptlet (1)
- hospitality (1)
- media (1)
- path redirect (1)
- spectre (1)
- variable expansion (1)
- variables (1)
Subscribe
Subscribe to enSilo's Blog
and Stay on Top of the
Latest Security Research
and Industry News