Infect If Needed | A Deeper Dive Into Targeted Backdoor macOS.Macma
SentinelLabs reveals further IoCs, behavior and analysis around suspected APT attack targeting macOS users and Hong Kong pro-democracy activists.
Read More
CVE-2021-43267: Remote Linux Kernel Heap Overflow | TIPC Module Allows Arbitrary Code Execution
SentinelLabs has discovered a heap overflow vulnerability in the TIPC module of the Linux Kernel, which can allow attackers to compromise an entire system.
Read More
Spook Ransomware | Prometheus Derivative Names Those That Pay, Shames Those That Don’t
New ransomware operator publishes victim details even if they pay. Our technical analysis shows how Spook is connected to other well-known malware families.
Read More
AlphaGolang | A Step-by-Step Go Malware Reversing Methodology for IDA Pro
SentinelLabs sets off to dispel the myth that Go malware is hard to reverse engineer. This suite of IDApython scripts will set you well on your way
Read More
Karma Ransomware | An Emerging Threat With A Hint of Nemty Pedigree
Exploring the links between Karma and other well-known malware families such as NEMTY and JSWorm, we find further IoCs and an evolving threat.
Read More
Techniques for String Decryption in macOS Malware with Radare2
In Part 3 of our macOS reversing series, we look at three different macOS malware samples and walk you through how to decipher encrypted strings.
Read More
New Version Of Apostle Ransomware Reemerges In Targeted Attack On Higher Education
Agrius has continued to evolve its toolkit from wiper to ransomware operations, including a recent attack on a higher education facility.
Read More
Defeating macOS Malware Anti-Analysis Tricks with Radare2
Learn how to beat malware authors' control flow and avoid executing unwanted parts of their code to analyze macOS malware in radare2.
Read More
CVE-2021-3437 | HP OMEN Gaming Hub Privilege Escalation Bug Hits Millions of Gaming Devices
A high severity flaw in HP's OMEN Gaming Hub software allows any user to escalate privileges to kernel-level mode.
Read More
Hide and Seek | New Zloader Infection Chain Comes With Improved Stealth and Evasion Mechanisms
A new ZLoader campaign abuses Google Ads to target European banking institutions with signed MSI payloads and more than 300 domains.
Read More