wireshark

Wireshark release 4.6.8 fixes 28 vulnerabilities and 25 bugs.

Wireshark 4.6.8 patches 28 security bugs, nine in file parsers Wireshark 4.6.8 fixes 28 security bugs in the protocol analyzer, and nine of them fire when someone opens a saved capture file. Those nine sit in file parsers, the code that reads a capture off disk before any dissection begins: pcapng, Endace ERF, Tektronix K12xx, BUSMASTER, Catapult DCT2000, Gammu DCT3, 3gpp phone logs, TTX Logger, and, on Windows only, Ixia IxVeriWave and Vector Informatik BLF. An attacker never has to touch your network for these. They only have to get you the file. The full set runs from advisory wnpa-sec-2026-64 to wnpa-sec-2026-91, and dissectors account for most of it. A dissector is the per-protocol code that turns raw bytes into the labeled fields in the packet detail pane, and this release fixes crashes in RDP, SSH, Kerberos, H.245, ESS, X.509IF, RRC, and UMTS FP, plus two separate advisories each for CMS and C12.22 and four covering Bluetooth ATT, HFP, BR/EDR FHS, and AVRCP. One more lands in the reassembly engine, which every dissector relies on to stitch fragmented data back together. Two crash sharkd rather than the GUI, so anything scripted on top of that utility is exposed on the same input. Several fixes came out of the project’s own fuzz jobs, so the count reflects testing volume as much as anything else. The prior release, 4.6.7, carried 12 advisories. Memory-safety fixes without advisory numbers Not everything dangerous in this release got a wnpa identifier. The bug list includes a stack buffer overflow in the K12/RF5 writer, a stack over-read in the Sniffer REC_HEADER2 error path, an out-of-bounds read in androiddump from a signed btsnoop length, an out-of-bounds read in the BLF writer on truncated VLAN-tagged frames, and stack exhaustion from deeply nested NetLog JSON and from recursion in the DLMS/COSEM compact-array parser. If you track exposure by advisory count, you will undercount this release. Eight 5G fields were decoded wrong Wireshark misdecoded the S-NSSAI location validity information, NSAG information, UE security capability, Registration wait range, and Extended CAG information elements in 5G NAS, along with the SOR transparent container, its SOR-CMCI field, and the service level AA container in 5GSM. Nothing crashed. The screen just showed the wrong values, which is the harder failure to notice, because a mobile core engineer reading a UE security capability field has no reason to doubt it. An extcap path moved in 4.6.0 and the notes say so now On UN*X systems, Wireshark looks for extcap binaries under /usr/libexec/wireshark/extcap instead of /usr/lib64/wireshark/extcap or similar. Third-party extcaps may need packaging changes, and WIRESHARK_EXTCAP_DIR overrides the location. Distributions without a libexec directory, such as Alpine Linux, keep the old path. This took effect in 4.6.0, eight point releases back, and appears in the release notes for the first time here. Windows users get two nuisance fixes as well: Capture File Properties has been slow enough to hang the application since 4.6.6, and toggling the TCP preference “Analyze TCP sequence numbers” segfaulted.

Wireshark release 4.6.7 fixes 12 vulnerabilities and 16 bugs.

Wireshark 4.6.7 patches a dozen security flaws Network analysts who open packet captures in Wireshark push untrusted data through a large set of protocol dissectors, and each parser is a spot where a malformed frame can trip up the software. The 4.6.7 maintenance release closes twelve of those weak points. The fixes reach from cellular signaling parsers to the code that reads capture files off disk. The security fixes Most of the patched advisories describe crashes. A crafted packet or capture file could push a dissector into reading past its buffer or touching bad memory, ending the session. The affected parsers include Catapult DCT2000, SSH, IEEE 802.11, Z39.50, and UMTS FP, along with the pcapng file reader and the DBS Etherwatch file parser. A few of the flaws work by other means. The FMP/NOTIFY dissector could enter a large loop on certain input, and a separate advisory collects several dissectors that could spin in infinite loops. The BLF file parser carried an information disclosure bug, where data outside the intended bounds could leak into the decoded output. The TLS ECH decryption path and the Ciscodump extcap helper each had their own crash. Bugs beyond the security list The release also repairs sixteen non-security bugs. One that will matter to anyone building on Wireshark is a use-after-free in the Ethernet POWERLINK dissector that triggered on a profile-loading error path. Another is a heap-buffer-overflow in the Android Logcat parser. Several fixes touch everyday annoyances. Wireshark could show its interface in German when the system language was set to Dutch. An IPv6 ping from Debian and other systems was being decoded as HiPerConTracer traffic. The HEVC video dissector flagged some packets as malformed because a bit offset went un-advanced. A heap corruption error could crash the program when it loaded the last saved recent_common file. A new Windows toolchain and protocol updates The Windows installers are now built with Visual Studio 2026. This release adds no new protocol dissectors. It does update a long roster of existing ones, among them DNS, DCERPC, SSH, IEEE 802.11, MEGACO, and H.265. Capture file handling gained updates for Android Logcat, BLF, DBS Etherwatch, Netlog, and pcapng. File format decoding stayed the same in this cycle. Where extcap helpers now live One entry in this release is a documentation catch-up for plugin authors. On UN*X systems, Wireshark searches for extcap binaries under the libexec directory by default, for example /usr/libexec/wireshark/extcap. This is the customary home for helper binaries, which skip the multiarch handling that libraries require. The bundled extcap tools already install in the new spot. Third-party extcaps may need packaging changes to match. The move happened back in version 4.6.0. The notes for that version omitted it, and 4.6.7 sets it down in writing. The location can be overridden with the WIRESHARK_EXTCAP_DIR environment variable. Some distributions, such as Alpine Linux, lack a libexec directory, and on those the binaries stay where they were.

Wireshark release 4.6.6 fixes 1 vulnerability and 11 bugs.

Wireshark release 4.6.5 fixes 43 vulnerabilities (38 CVEs) and 35 bugs.

Introduction This diary provides indicators from the SmartApeSG (ZPHP, HANEYMANEY) campaign I saw on Tuesday, 2026-03-24. SmartApeSG is one of many campaigns that use the ClickFix technique. This past week, I've seen NetSupport RAT as follow-up malware from Remcos RAT pushed by this campaign. But this time, I also saw indicators for StealC malware and Sectop RAT (ArecheClient2) after NetSupport RAT appeared on my infected lab host. Not all of the follow-up malware appears shortly after the initial Remcos RAT malware. Here's the timeline for malware from my SmartApeSG activity on Tuesday 2026-03-24: 17:11 UTC - Ran ClickFix script from SmartApeSG fake CAPTCHA page 17:12 UTC - Remcos RAT post-infection traffic starts 17:16 UTC - NetSupport RAT post-infection traffic starts 18:18 UTC - StealC post-infection traffic starts 19:36 UTC - Sectop RAT post-infection traffic starts While the NetSupport RAT activity happened approximately 4 minutes after the Remcos RAT activity, the StealC traffic didn't happen until approximately 1 hour after the NetSupport RAT activity started. And the traffic for Sectop RAT happened approximately 1 hour and 18 minutes after the StealC activity started. Images from the infection Shown above: Page from a legitimate but compromised website with injected script for the fake CAPTCHA page. Shown above: Fake CAPTCHA page with ClickFix instructions. This image shows the malicious script injected into a user's clipboard. Shown above: Traffic from the infection filtered in Wireshark. Indicators of Compromise Associated domains and IP addresses: fresicrto[.]top - Domain for server hosting fake CAPTCHA page urotypos[.]com - Called by ClickFix instructions, this domain is for a server hosting the initial malware 95.142.45[.]231:443 - Remcos RAT C2 server 185.163.47[.]220:443 - NetSupport RAT C2 server 89.46.38[.]100:80 - StealC C2 server 195.85.115[.]11:9000 - Sectop RAT (ArechClient2) C2 server Example of HTA file retrieved by ClickFix script: SHA256 hash: 212d8007a7ce374d38949cf54d80133bd69338131670282008940f1995d7a720 File size: 47,714 bytes File type: HTML document text, ASCII text, with very long lines (6272) Retrieved from: hxxps[:]//urotypos[.]com/cd/temp Saved location: C:\Users\[username]\AppData\Local\post.hta Note: ClickFix script deletes the file after retrieving and running it Example of ZIP archive for Remcos RAT retrieved by the above HTA file: SHA256 hash: a6a748c0606fb9600fdf04763523b7da20b382b054b875fdd1ef1c36fc16079a File size: 85,328,653 bytes File type: Zip archive data, at least v2.0 to extract, compression method=deflate Retrieved from: hxxps[:]//urotypos[.]com/ls/production Saved location: C:\Users\[username]\AppData\Local\361118191\361118191.pdf ZIP archive containing NetSupport RAT package: SHA256 hash: 6e26ff49387088178319e116700b123d27216d98ba3ae1ce492544cb9acd38f0 File size: 9,171,647 bytes File type: Zip archive data, at least v2.0 to extract, compression method=deflate File name: UpdateInstaller.zip Note: I created this zip archive from the extracted files under C:\ProgramData\UpdateInstaller\ RAR archive for StealC package: SHA256 hash: a7b9be1211c6de76bab31dbcd3a1c99861cf18e3230ea9f634e07d22c179d1ca File size: 6,178,471 bytes File type: RAR archive data, v5 Saved location: C:\Users\Public\Music\finalmesh.zip RAR archive for Sectop RAT (ArechClient2) package: SHA256 hash: c90435370728d48cba1c00d92cc3bf99e85f01aa52ecd6c6df2e8137db964796 File size: 6,908,049 bytes File type: RAR archive data, v5 Saved location: C:\ProgramData\drag2pdf.zip Final words The archive files for Remcos RAT, StealC and Sectop RAT are packages that use legitimate EXE files to side-load malicious DLLs (a technique called DLL side-loading). The NetSupport RAT package is a legitimate tool that's configured to use an attacker-controlled server. As always, the files, URLs and domains for SmartApeSG activity change on a near-daily basis. And names of the HTA file and ZIP archive for Remcos RAT are different for each infection. The indicators described in this article may no longer be current as you read this. However, this activity confirms that the SmartApeSG campaign can push a variety of malware after an initial infection. --- Bradley Duncan brad [at] malware-traffic-analysis.net

Introduction This diary describes a Remcos RAT infection that I generated in my lab on Thursday, 2026-03-11. This infection was from the SmartApeSG campaign that used a ClickFix-style fake CAPTCHA page. My previous in-depth diary about a SmartApeSG (ZPHP, HANEYMANEY) was in November 2025, when I saw NetSupport Manager RAT. Since then, I've fairly consistently seen what appears to be Remcos RAT from this campaign. Finding SmartApeSG Activity As previously noted, I find SmartApeSG indicators from the Monitor SG account on Mastodon, and I use URLscan to pivot on those indicators to find compromised websites with injected SmartApeSG script. Details Below is an image of HTML in a page from a legitimate but compromised website that shows the injected SmartApeSG script. Shown above: Page from a legitimate but compromised site that highlights the injected SmartApeSG script. The injected SmartApeSG script generates a fake CAPTCHA-style "verify you are human" page, which displays ClickFix-style instructions after checking a box on the page. A screenshot from this infection is shown below, and it notes the ClickFix-style script injected into the user's clipboard. Users are instructed to open a run window, paste the script into it, and hit the Enter key. Shown above: Fake CAPTCHA page generated by a legitimate but compromised site, showing the ClickFix-style command. I used Fiddler to reveal URLS from the HTTPS traffic, and I recorded the traffic and viewed it in Wireshark. Traffic from the infection chain is shown in the image below. Shown above: Traffic from the infection in Fiddler and Wireshark. After running the ClickFix-style instructions, the malware was sent as a ZIP archive and saved to disk with a .pdf file extension. This appears to be Remcos RAT in a malicious package that uses DLL side-loading to run the malware. This infection was made persistent with an update to the Windows Registry. Shown above: Malware from the infection persistent on an infected Windows host. Indicators of Compromise Injected SmartApeSG script injected into page from legitimate but compromised site: hxxps[:]//cpajoliette[.]com/d.js Traffic to domain hosting the fake CAPTCHA page: hxxps[:]//retrypoti[.]top/endpoint/signin-cache.js hxxps[:]//retrypoti[.]top/endpoint/login-asset.php?Iah0QU0N hxxps[:]//retrypoti[.]top/endpoint/handler-css.js?00109a4cb788daa811 Traffic generated by running the ClickFix-style script: hxxp[:]//forcebiturg[.]com/boot <-- 302 redirect to HTTPS URL hxxps[:]//forcebiturg[.]com/boot <-- returned HTA file hxxp[:]//forcebiturg[.]com/proc <-- 302 redirect to HTTPS URL hxxps[:]//forcebiturg[.]com/proc <-- returned ZIP archive archive with files for Remcos RAT Post-infection traffic for Remcos RAT: 193.178.170[.]155:443 - TLSv1.3 traffic using self-signed certificate Example of ZIP archive for Remcos RAT: SHA256 hash: b170ffc8612618c822eb03030a8a62d4be8d6a77a11e4e41bb075393ca504ab7 File size: 92,273,195 bytes File type: Zip archive data, at least v2.0 to extract, compression method=deflate Example of saved file location: C:\Users\[username]\AppData\Local\Temp\594653818\594653818.pdf Of note, the files, URLs and domains for SmartApeSG activity change on a near-daily basis, and the indicators described in this article are likely no longer current. However, the overall patterns of activity for SmartApeSG have remained fairly consistent over the past several months. --- Bradley Duncan brad [at] malware-traffic-analysis.net

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Cybersecurity researchers have disclosed details of a new Russian cyber campaign that has targeted Ukrainian entities with two previously undocumented malware families named BadPaw and MeowMeow. "The attack chain initiates with a phishing email containing a link to a ZIP archive. Once extracted, an initial HTA file displays a lure document written in Ukrainian concerning border crossing appeals to deceive the victim," ClearSky said in a report published this week. In parallel, the attack chain leads to the deployment of a .NET-based loader called BadPaw, which then establishes communication with a remote server to fetch and deploy a sophisticated backdoor called MeowMeow. The campaign has been attributed with moderate confidence to the Russian state-sponsored threat actor known as APT28, based on the targeting footprint, the geopolitical nature of the lures used, and overlaps with techniques observed in previous Russian cyber operations. The starting point of the attack sequence is a phishing email sent from ukr[.]net, likely in an attempt to establish credibility and secure the trust of targeted victims. Present in the message is a link to a purported ZIP file, causing the user to be redirected to a URL that loads an "exceptionally small image," effectively acting as a tracking pixel to signal the operators that the link was clicked. Once this step is complete, the victim is redirected to a secondary URL from where the archive is downloaded. The ZIP file includes an HTML Application (HTA) that, once launched, drops a decoy document as a distraction mechanism, while it executes follow-on stages in the background. "The dropped decoy document serves as a social engineering tactic, presenting a confirmation of receipt for a government appeal regarding a Ukrainian border crossing," ClearSky said. "This lure is intended to maintain the veneer of legitimacy." The HTA file also carries out checks to avoid running within sandbox environments. It does this by querying the Windows Registry key "KLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate" to estimate the "age" of the operating system. The malware is designed to abort execution if the system was installed less than ten days prior. Should the system meet the environment criteria, the malware locates the downloaded ZIP archive and extracts two files from it – a Visual Basic Script (VBScript) and a PNG image – and saves them to disk under different names. It also creates a scheduled task to execute the VBScript as a way of ensuring persistence on the infected system. The primary responsibility of the VBScript is to extract malicious code embedded within the PNG image, an obfuscated loader referred to as BadPaw that's capable of contacting a command-and-control (C2) server to download additional components, including an executable named MeowMeow. "Consistent with the 'BadPaw' tradecraft, if this file is executed independently of the full attack chain, it initiates a dummy code sequence," the Israeli cybersecurity company explained. "This decoy execution displays a graphical user interface (GUI) featuring a picture of a cat, aligning with the visual theme of the initial image file from which the primary malware was extracted." "When the 'MeowMeow' button within the decoy GUI is clicked, the application simply displays a 'Meow Meow Meow' message, performing no further malicious actions. This serves as a secondary functional decoy to mislead manual analysis." The backdoor's malicious code is activated only when it's executed with a certain parameter ("-v") that's provided by the initial infection chain, and after checking that it's running on an actual endpoint as opposed to a sandbox, and no forensic and monitoring tools like Wireshark, Procmon, Ollydbg, and Fiddler are running in the background. At its core, MeowMeow is equipped to remotely execute PowerShell commands on the compromised host and support file system operations, such as the ability to read, write, and delete data. ClearSky said it identified Russian language strings in the source code, reinforcing the assessment that the activity is the work of a Russian-speaking threat actor. "The presence of these Russian-language strings suggests two possibilities: the threat actor committed an operational security (OPSEC) error by failing to localize the code for the Ukrainian target environment, or they inadvertently left Russian development artifacts within the code during the malware's production phase," it said.

A newly identified malware campaign leveraging a Ukrainian email service to build credibility has been uncovered by cybersecurity researchers. The operation begins with an email sent from an address hosted on ukr[.]net, a popular Ukrainian provider previously abused by the Russian-linked threat actor APT28 in past campaigns. According to an advisory by researchers at ClearSky, who have named the malware "BadPaw," the attack is triggered when a recipient clicks a link claiming to host a ZIP archive. Instead of initiating a direct download, the victim is redirected to a domain that loads a tracking pixel, allowing the attacker to confirm engagement. A second redirect then delivers the ZIP file. Although the archive appears to contain a standard HTML file, ClearSky researchers found it is actually an HTA application in disguise. Once executed, the file displays a decoy document referencing a Ukrainian government border crossing appeal, while malicious processes run in the background. Before proceeding, the malware checks a Windows Registry key to determine the system's installation date. If the operating system is less than ten days old, execution stops, a tactic designed to avoid sandbox environments used by security analysts. If conditions are met, the malware searches for the original ZIP file and extracts additional components. Persistence is achieved through a scheduled task that runs a VBS script, which uses steganography to extract hidden executable code from an image file. Only nine antivirus engines detected the payload at the time of analysis. Multi-Layered Backdoor and Attribution Once activated with a specific parameter, BadPaw connects to a command-and-control (C2) server. The staged communication process includes: Retrieving a numeric response from the /getcalendar endpoint Accessing a landing page titled "Telemetry UP!" via /eventmanager Downloading ASCII-encoded payload data embedded within HTML The decoded data ultimately deploys a backdoor named "MeowMeowProgram[.]exe," which provides remote shell access and file system control. The MeowMeow backdoor incorporates four defensive layers, including runtime parameter requirements, .NET Reactor obfuscation, sandbox detection and monitoring for forensic tools such as Wireshark, Procmon, Ollydbg and Fiddler. If executed incorrectly, it displays a benign graphical interface featuring a cat image. Clicking the "MeowMeow" button simply generates a harmless message. ClearSky also identified Russian-language strings embedded in the code. One translated line reads: "Time to reach working/operational condition: (\d+) seconds." According to ClearSky, these artifacts may indicate a Russian-speaking developer or an operational oversight in failing to localize the malware for Ukrainian targets.

Wireshark release 4.6.4 fixes 3 vulnerabilities and 15 bugs.

Week in review: Self-spreading npm malware hits developers, Cisco SD-WAN 0-day exploited since 2023 Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Identity verification systems are struggling with synthetic fraud Fake and expired IDs keep showing up in routine customer transactions, from alcohol purchases to credit card applications. The problem shows up most often in industries that depend on fast onboarding and remote transactions, where identity checks rely heavily on scanned documents and automated workflows. Enterprises are racing to secure agentic AI deployments AI assistants are tied into ticketing systems, source code repositories, chat platforms, and cloud dashboards across many enterprises. In some environments, these systems can open pull requests, query internal databases, book services, and trigger automated workflows with limited human involvement. The State of AI Security 2026 from Cisco places this level of access inside a growing pattern of AI-driven operations that connect directly to core business systems. The hidden security cost of treating labs like data centers In this Help Net Security interview, Rich Kellen, VP, CISO at IFF, explains why security teams should not treat OT labs like IT environments. He discusses how compromise can damage scientific integrity and create safety risks that backups cannot fix. AI is becoming part of everyday criminal workflows Underground forums include long threads about chatbots drafting phishing emails, generating code snippets, and coaching social engineering calls. A new study examined conversations captured between January 1, 2025 and July 31, 2025 across dozens of cybercrime forums to map how AI tools are entering day to day criminal operations. AI-driven DAST reduces manual setup and surfaces exploitable vulnerabilities In this Help Net Security interview, Joni Klippert, CEO at StackHawk, discusses what defines DAST coverage in 2026 and why scan completion does not equal security. She explains how AI-driven DAST testing automates attack surface discovery, supports business-logic testing in pre-production, and reduces the manual setup that has limited adoption. Klippert also describes how organizations can implement runtime testing without instrumenting production systems. Review: Digital Forensics, Investigation, and Response, 5th Edition Digital Forensics, Investigation, and Response, 5th Edition presents a structured survey of the digital forensics discipline. The book spans foundational principles, platform specific analysis, specialized branches, and incident response integration. Open-source security debt grows across commercial software Open source code sits inside nearly every commercial application, and development teams continue to add new dependencies. Black Duck’s 2026 Open Source Security and Risk Analysis Report data shows that nearly all audited codebases contain open source components, with average component counts rising sharply over the past year. The $19.5 million insider risk problem Routine employee activity across corporate systems carries an average annual cost of $19.5 million per organization. That figure comes from the 2026 Cost of Insider Risks Global Report, conducted by the Ponemon Institute and based on data from 354 organizations that experienced one or more material insider related incidents over the past year. Industrial networks continue to leak onto the internet Industrial operators continue to run remote access portals, building automation servers, and other operational technology services on public IP address ranges. Palo Alto Networks, Siemens, and Idaho National Laboratory describe the scope of that exposure in the Intelligence-Driven Active Defense Report 2026. DeVry University’s CISO on higher education cybersecurity risk In this Help Net Security interview, Fred Kwong, VP, CISO at DeVry University, outlines how the university balances academic openness with cyber risk. He describes how systems for students are separated from back end operations to limit exposure. Japanese chip-testing toolmaker Advantest suffers ransomware attack Japanese tech testing company Advantest has suffered a ransomware attack, the company confirmed last Thursday, after detecting unusual activity within its IT environment on February 15, 2026. Fake troubleshooting tip on ClawHub leads to infostealer infection A new malware delivery campaign has hit ClawHub, the official online repository for “skills” that augment the capabilities of the popular OpenClaw AI agent. Unlike previous ones, this campaign does not aim to trick users into downloading a bogus, malicious skill. Self-spreading npm malware targets developers in new supply chain attack Security researchers have uncovered another supply chain attack targeting developers: 19 typosquatting npm packages published on npmjs.com that steal credentials, infect projects, and propagate themselves across developer environments. CISA flags exploited FileZen command injection bug, patch now! (CVE-2026-25108) CISA has added CVE-2026-25108, an OS command injection vulnerability in Soliton Systems’ FileZen secure file transfer solution, to its Known Exploited Vulnerabilities (KEV) catalog. The vendor has confirmed active exploitation, stating it has received multiple reports of damage caused by attackers abusing the flaw. SolarWinds Serv-U hit by four critical RCE-level vulnerabilities SolarWinds has fixed four critical vulnerabilities in its popular Serv-U file transfer solution, which is used by businesses and organizations of all sizes. If exploited, the flaws may allow attackers to create a system admin user and/or execute code as a privileged account. Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127) A “highly sophisticated” cyber threat actor has been exploiting a zero-day authentication bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), Cisco has announced. Scattered Lapsus$ Hunters seeks women for vishing attacks The Scattered Lapsus$ Hunters (SLH) hacking collective has launched a recruitment push aimed specifically at women, offering cash payments for participating in voice-phishing (vishing) attacks. A few days ago, threat intelligence firm Dataminr detected posts on a public Telegram channel advertising roles for female callers willing to conduct social-engineering phone operations. IronCurtain: An open-source, safeguard layer for autonomous AI assistants Veteran security engineer Niels Provos is working on a new technical approach designed to stop autonomous AI agents from taking actions you haven’t specifically authorized. Why SOCs are moving toward autonomous security operations in 2026 The modern security operations center faces a crisis of scale that human effort cannot fix. With alert volumes exponentially growing and threat actors automating their attacks, organizations must pivot to autonomous SOC strategies. This shift to AI-driven defense is the only way to survive the operational realities of 2026. Binding Operational Directive 26-02 sets deadlines for edge device replacement In this Help Net Security video, Jen Sovada, General Manager, Public Sector at Claroty, explains CISA’s Binding Operational Directive 26-02 and what it means for federal agencies. The directive requires agencies to inventory, report, decommission, and replace unsupported edge devices such as firewalls, routers, switches, load balancers, and wireless access points. Police seize 100,000 stolen Facebook credentials in cybercrime raid Officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group that used phishing to seize Facebook accounts and extract BLIK payment codes from victims. Spanish police arrest suspected Anonymous members over DDoS attacks on government sites Spanish police (Guardia Civil) arrested four members of the hacktivist group Anonymous Fénix over DDoS attacks targeting ministries, political parties and public institutions. Police identified the organization’s leadership, including its administrator and moderator, who were arrested in May 2025 in Alcalá de Henares (Madrid) and Oviedo (Asturias). Security and complexity slow the next phase of enterprise AI agent adoption Enterprise AI agents are embedded in routine business processes, particularly inside engineering and IT operations. Many organizations report active production deployments, and agent development ranks high on strategic agendas. A new study from Docker, The State of Agentic AI Report, examines how enterprises are deploying agentic systems and the challenges emerging as deployments scale. Microsoft extends security patching for three Windows products at a price Support is ending for three Windows products released in 2016, with deadlines beginning in October 2026. Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB will reach end of support on October 13, 2026, followed by Windows Server 2016 on January 12, 2027. International operation dismantles fraud network, €400,000 seized A coordinated international operation supported by Eurojust dismantled a fraudulent call centre operating from three offices and targeting citizens throughout Europe. Authorities arrested 11 suspects and seized more than €400,000 in cash. Teenagers charged over public bike service breach that exposed 4.62 million records Two South Korean teenagers have been charged in connection with a cyberattack that compromised the personal data of 4.62 million users of Seoul’s public bike service, Ttareungyi. The compromised data included user IDs, mobile phone numbers, addresses, dates of birth, gender, and weight. Airline brands become launchpads for phishing, crypto fraud Airline brands sit at the center of peak travel booking cycles, loyalty programs, and high value transactions. Criminal groups continue to register thousands of lookalike domains tied to these brands, targeting travelers, employees, and business partners. Recent threat intelligence from BforeAI’s PreCrime Labs identifies sustained impersonation activity across the global commercial airline sector. Cyber valuations climb as capital concentrates, AI security expands Venture funding in cybersecurity continued to concentrate in large private rounds at the end of 2025, driving valuations higher across stages. Data from DataTribe shows total capital invested approached $150 billion for the year, with a disproportionate share flowing into fewer than 100 deals. Ex-L3Harris executive sentenced to 87 months for selling stolen cyber-exploit trade secrets Peter Williams, a former executive of Trenchant, L3Harris’ cyber division, has been sentenced to 87 months in prison by a federal judge in Washington, D.C., after pleading guilty to stealing and selling sensitive cyber-exploit trade secrets to a Russian broker. Anthropic’s Remote Control feature brings Claude Code to mobile devices Anthropic has introduced a new Claude Code feature called Remote Control, allowing developers to continue a local coding session from a phone, tablet, or any web browser. The feature is rolling out as a research preview to Max users. Samsung’s Galaxy S26 turns privacy into a visible and invisible feature The Samsung Galaxy S26 series is out, offering plenty of security features that protect personal data while providing users with transparency and control over how their information is used. The feature that grabbed the spotlight is the built-in Privacy Display on the Galaxy S26 Ultra model, designed to help keep on-screen activity out of view in public places. Telegram rises to top spot in job scam activity Encrypted messaging platforms are becoming a primary channel for Authorised Push Payment (APP) fraud, with Telegram representing a growing share of reported cases, according to the Revolut report. NATO greenlights iPhone and iPad for classified information handling Apple confirmed that the iPhone and iPad have been approved for use with classified information in NATO restricted environments. The devices will no longer require special software or settings to handle NATO restricted-level information. Microsoft taps ASUS and Dell for the Windows 365 Cloud PC strategy Microsoft is adding two new Windows 365 Cloud PC devices, the ASUS NUC 16 for Windows 365 and the Dell Pro Desktop for Windows 365, expanding hardware options for its cloud-based desktop service. Both devices are scheduled for release in the third quarter of 2026, with distribution varying by region and model. Meta tightens grip on scam advertisers Meta is stepping up the fight against scams on its platforms by filing multiple lawsuits targeting companies and individuals in Brazil, China, and Vietnam who used deceptive tactics to run scam ads. The company said it has taken technical enforcement actions in these cases, including suspending payment methods used in the scams, disabling accounts linked to those operations, and blocking domains associated with scam sites. Coroot: Open-source observability and APM tool Coroot is an open-source observability and application performance monitoring tool. The core software, published in Go and accompanied by companion repositories such as coroot-node-agent, focuses on collecting telemetry data across systems. It uses extended Berkeley Packet Filter (eBPF) technology to gather metrics and trace inter-service communications without manual instrumentation of application code. Perplexity AI lands on Samsung’s next Galaxy lineup Samsung will add Perplexity to its upcoming Galaxy S26 devices as part of its Galaxy AI multi-agent ecosystem expansion. Users will be able to access Perplexity through quick-access controls, such as pressing and holding the side button, or by using the voice wake phrase “Hey, Plex.” WhatsApp is adding another lock to your account Meta has released WhatsApp Beta for Android 2.26.7.8 through the Google Play Beta Program. The update includes references to password-protected accounts, indicating plans to introduce an additional layer of protection beyond the app’s current authentication options. Windows 365 for Agents brings managed cloud PCs to autonomous workflows Microsoft’s Windows 365 for Agents is a cloud platform that gives AI agents secure access to cloud PCs. It lets builders run copilots, agents, and automated workflows in Windows environments without managing infrastructure. The platform includes security, policy controls, scalability, and visibility so agents can browse websites, process data, and complete tasks inside a managed cloud PC. Microsoft expands Sovereign Cloud security with governance, local productivity and AI Microsoft expands Microsoft Sovereign Cloud with new disconnected and AI capabilities that help organizations run critical infrastructure, productivity services and large AI models inside sovereign boundaries while keeping governance and operational continuity across connected and disconnected environments. Edge systems take the brunt of internet-wide exploitation attempts Internet-facing VPNs, routers, and remote access services absorbed sustained exploitation attempts throughout the second half of 2025, with nearly 3 billion malicious sessions recorded over 162 days. The concentration on edge infrastructure aligns with how attackers pursue initial access across the public internet. Microsoft adds domain libraries and Copilot integration to the quantum development kit The Microsoft Quantum Development Kit (QDK) is an open-source toolkit that runs on laptops and in common development environments. It includes code, simulators, libraries, and workflows that work with Visual Studio Code and GitHub Copilot. Integration with these tools gives developers features for writing, testing, debugging, and submitting quantum code. Apple blocks 18+ app downloads in select markets Apple has introduced expanded age assurance tools to help developers comply with regulations taking effect in Brazil, Australia, Singapore, Utah, and Louisiana. The updates, available in beta, expand the Declared Age Range API and related App Store systems. Reddit fined $19.5 million for failing to protect children’s personal data The UK’s Information Commissioner’s Office (ICO) has fined Reddit $19.5 million after finding that the company failed to use children’s personal information lawfully, exposing them to inappropriate and harmful content. Hottest cybersecurity open-source tools of the month: February 2026 This month’s roundup features exceptional open-source cybersecurity tools that are gaining attention for strengthening security across various environments. Wireshark 4.6.4 resolves dissector flaws, plugin compatibility issue Packet inspection remains a routine activity across enterprise networks, incident response workflows, and malware investigations. Continuous use places long-term stability and parsing accuracy at the center of daily operations. Wireshark version 4.6.4 addresses two vulnerabilities affecting protocol dissectors and resolves a plugin compatibility issue within the 4.6 release series. Fraudsters integrate ChatGPT into global scam campaigns AI models are being folded into fraud and influence operations that follow long standing tactics. A February 2026 update to OpenAI’s Disrupting Malicious Uses of Our Models report details how ChatGPT and related API access were used in romance scams, fake legal services, coordinated influence campaigns, and a state linked harassment effort. AWS Security Hub Extended brings enterprise security under one roof AWS Security Hub Extended is a plan within Security Hub that simplifies how customers procure, deploy, and integrate a full-stack enterprise security solution across endpoint, identity, email, network, data, browser, cloud, AI, and security operations. The CISO role keeps getting heavier Personal liability is becoming a routine part of the CISO job. In Splunk’s 2026 CISO Report, titled From Risk to Resilience in the AI Era, 78% of CISOs said they are concerned about their own liability for security incidents, up from 56% last year. The role carries personal exposure alongside operational accountability, and that shift is influencing how security leaders approach risk, documentation, and board communication. Android app uses Bluetooth signals to detect nearby smart glasses Smart glasses with built-in cameras are showing up in more public spaces, and a growing number of people want a way to know when one is nearby. An Android app called Nearby Glasses, developed by Yves Jeanrenaud, attempts to fill that gap by scanning Bluetooth Low Energy traffic for manufacturer identifiers associated with known smart glasses makers. Ransomware activity peaks outside business hours Intrusions continue to center on credential access and timed execution outside standard business hours. The Sophos Active Adversary Report 2026 analyzes 661 incident response and managed detection and response cases handled between November 1, 2024 and October 31, 2025, spanning organizations in 70 countries. Android 17 second beta expands privacy controls for contacts, SMS and local networks Google’s second beta of Android 17 continues updates to platform behavior and introduces new APIs focused on protecting sensitive data. Europol goes after The Com’s ransomware and extortion networks Law enforcement agencies across 28 countries have spent the past year building cases against a loosely organized collective known as The Com, a decentralized network of mostly teenagers and young adults linked to high-profile ransomware attacks, financial extortion, and the coercion of vulnerable children. Cybersecurity jobs available right now: February 24, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the month: February 2026 Here’s a look at the most interesting products from the past month, featuring releases from Aikido Security, Avast, Armis, Black Duck, Compliance Scorecard, Fingerprint, Gremlin, Impart Security, Portnox, Redpanda, Socure, SpecterOps, Veza, and Virtana.

Wireshark 4.6.4 resolves dissector flaws, plugin compatibility issue Packet inspection remains a routine activity across enterprise networks, incident response workflows, and malware investigations. Continuous use places long-term stability and parsing accuracy at the center of daily operations. Wireshark version 4.6.4 addresses two vulnerabilities affecting protocol dissectors and resolves a plugin compatibility issue within the 4.6 release series. Dissector vulnerabilities resolved The update fixes a crash in the HTTP3 dissector and an infinite loop in the MEGACO dissector. Both flaws could interrupt analysis activity during packet inspection. The release removes these conditions through changes to dissector handling within the affected protocols. Plugin compatibility restored Version 4.6.4 resolves a compatibility issue affecting plugins built for Wireshark 4.6.0. An API and ABI change introduced in version 4.6.1 created integration problems for those plugins. The update restores expected interoperability for extensions compiled against the earlier release. Stability updates within the 4.6 series Wireshark continues to receive maintenance updates across its stable branches. Version 4.6.4 focuses on parser stability and extension compatibility within existing deployments that rely on custom dissectors and plugin-based workflows. Wireshark source code and installation packages are available here. Must read: 40 open-source tools redefining how security teams secure the stack Firmware scanning time, cost, and where teams run EMBA Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

Wireshark release 4.6.3 fixes 4 vulnerabilities and 9 bugs.

Wireshark release 4.6.2 fixes 2 vulnerabilities and 5 bugs.

Wireshark release 4.6.1 fixes 2 vulnerabilities and 20 bugs.

Chain of security weaknesses found in smart air compressor model Contractors and workshops often rely on air compressors to power their tools and keep projects running. But when those compressors are connected to the internet, convenience can introduce new risks. Researchers at George Mason University found that the California Air Tools CAT-10020SMHAD smart air compressor contains a chain of security vulnerabilities that could allow an attacker to disrupt operations or tamper with usage data. California Air Tools CAT-10020SMHAD smart air compressor with MDR2i wireless controller From utility to attack surface Compressed air is often called the fourth utility in manufacturing, alongside electricity, water, and natural gas. It powers refrigeration, pneumatic transport, and power generation. Because compressed air supports safety-sensitive operations, any disruption or tampering can cause line stoppages, pneumatic brake failures, or loss of pressure control that can damage equipment and endanger workers. The California Air Tools CAT-10020SMHAD model includes a wireless controller called the MDR2i, which lets operators monitor pressure and control the compressor over Wi-Fi and install firmware updates through a web interface. Researchers used this model to represent a class of connected industrial devices that combine mechanical reliability with digital control. Its analysis focused on how the controller handled authentication and remote access. To evaluate this, the researchers built a small test cell with a conveyor and pneumatic actuators that sorted packages. The compressor supplied air to this setup so the team could see how attacks affected production. Building the threat model Before launching attacks, the team built a threat model following ISA/IEC 62443 and NIST SP 800-82 standards. These frameworks guide how to analyze industrial control systems. They assumed an attacker with limited resources but local network access, someone on the same Wi-Fi or LAN segment as the compressor. Physical access was not required. The analysis focused on preserving air supply availability, data integrity, and the confidentiality and authenticity of control commands. This formal structure let the researchers map how each part of the device could be misused, from its wireless network to its firmware update mechanism. Testing the device The team tested the compressor in a lab network that mimicked an industrial environment using a Kali Linux laptop with a Wi-Fi adapter for wireless monitoring and packet injection. They used Kismet and Wireshark for network discovery, traffic analysis, and packet capture. Burp Suite Professional intercepted and modified HTTP requests to the controller API, while custom Python scripts automated brute force and denial of service tests. Initial testing revealed a weakness. The MDR2i controller’s Wi-Fi access point mode used a hardcoded password, “CATMDR2i,” printed in the user manual and unchangeable. Once connected, an attacker could reach the web interface without authentication. In station mode the controller could be discovered with a basic network scan. The web console used plain HTTP so credentials and commands were sent in plaintext. Any device on the same network could intercept or alter that traffic. Breaking the control plane Beyond the unprotected network channel, the web interface itself had weak access control. The system included three roles: Operator, Manufacturer, and CPC, but all relied on shared, hardcoded four-digit PINs. There was no option to change them. The researchers confirmed they could brute-force these PINs in seconds since the login page lacked any limit on failed attempts. More concerning, the web API allowed direct commands without authentication. Attackers could send HTTP requests to start or stop the compressor, change pressure thresholds, or trigger reboots. These actions did not need valid credentials and gave an attacker complete operational control of the compressor. What happens when air stops The team measured what happened when attackers used those unauthenticated endpoints. One test repeatedly sent reset commands, forcing the compressor into an endless reboot cycle. Another modified the pressure thresholds so that the compressor never turned on. Both attacks caused the pneumatic actuators in the test cell to stop working, halting the simulated production process. Other attacks focused on data integrity. By manipulating calibration and zero-point settings, the researchers made the compressor report false pressure readings. On the monitoring screen, the digital twin showed stable pressure, while the analog gauge told a different story. That mismatch could cause automated systems to misjudge the process state, potentially damaging equipment or producing defects. Fixing what went wrong After demonstrating the attacks, the team proposed ways to prevent them. The recommendations follow well-known industrial cybersecurity principles but are often skipped in lower-cost IIoT devices. Each compressor should ship with unique credentials, and users should be forced to change them on first use. The web interface should use HTTPS to protect traffic. All API calls that modify device state must require authentication and enforce user permissions. Firmware updates should include cryptographic signature checks and, ideally, hardware-based trust elements to prevent tampering. They also suggested separating control functions, such as start and stop, from maintenance functions like sensor calibration. These should not share the same network channel. Such separation would prevent simple network attackers from reaching sensitive configuration areas. The supply chain problem The researchers traced the vulnerabilities back to how the device was built. The CAT-10020SMHAD was assembled from parts made by several companies. One focused on the compressor hardware, another on the controller electronics, and another on distribution. Each handled its own area, but none took ownership of cybersecurity. Reporting the flaws exposed how fragmented the supply chain was. Emails and calls bounced between companies, and no dedicated security contact existed. The delay showed how weak coordination can slow down vulnerability response. They noted five main gaps that explain why such weaknesses appear: Procurement documents rarely define cybersecurity requirements. Expertise is spread across organizations with different priorities. Responsibility for security is unclear. Communication channels for disclosures are poor. Market pressure to release new connected products often compresses testing timelines. The study also linked these issues to emerging regulations. The European Union’s Cyber Resilience Act, set to take effect in 2027, will require the types of controls the paper recommends. Until then, the responsibility rests with manufacturers to adopt secure-by-design principles voluntarily.

Cybersecurity jobs available right now: October 28, 2025 Analyst, Cybersecurity Threat Intelligence Brookfield Renewable | Canada | On-site – No longer accepting applications As a Cybersecurity Threat Intelligence Analyst, you will run monthly vulnerability scans across IT and OT environments, track remediation progress, and report results. You will collect and analyze phishing and security awareness metrics, conduct threat intelligence research using tools like Dark Owl, OpenCTI, and Shodan, and produce actionable reports. You will analyze incidents, document lessons learned, and manage key cybersecurity and technology risk systems. Application Security Engineer Binance | UAE | Remote – No longer accepting applications As an Application Security Engineer, you will strengthen and maintain the security posture of Binance’s DeFi and Web3 affiliates. You will respond to security issues from penetration tests, bug bounties, and assessments, analyze findings, and implement code-level fixes. You will collaborate on system architecture to improve security, integrate blockchain security solutions, and leverage AI tools to automate security detection throughout the SDLC and CI pipelines. BISO Barclays Investment Bank | Ireland | Hybrid – No longer accepting applications As a BISO, you will conduct risk assessments to identify and prioritize cybersecurity threats affecting the bank’s operations and data, guide mitigation strategies, and communicate findings to senior stakeholders. You will collaborate with business units to develop and implement security policies aligned with the bank’s risk management framework. You will also manage the implementation, testing, and monitoring of security controls to ensure their effectiveness and reduce risk. Get weekly updates on new cybersecurity job openings. Subscribe here! Cloud Security Engineer Deltatre | Italy | Hybrid – No longer accepting applications As a Cloud Security Engineer, you will define and enforce cloud security best practices, including IAM governance, secure configurations, and logging standards. You will implement security controls within Kubernetes environments, automate compliance and guardrails using CNAPP, and support incident response, forensics, threat analysis, and penetration test follow-ups to strengthen cloud security operations. Cybersecurity, Critical Infrastructure and Artificial Intelligence Regulation Principal Inspector Commission for Railway Regulation | Ireland | Hybrid – No longer accepting applications As a Cybersecurity, Critical Infrastructure and Artificial Intelligence Regulation Principal Inspector, you will establish and develop a new division overseeing entities in the rail transport sector under CER, NIS2, and AIA regulations. You will lead supervision and oversight activities, develop policies and procedures for the division, and ensure the Commission has the necessary technical expertise in network systems, resilience, and AI. You will also manage staff by setting goals, reviewing performance, and overseeing training and development. Cybersecurity Risk Officer Rockwell Land Corporation | Philippines | On-site – No longer accepting applications As an Cybersecurity Risk Officer, you will implement and maintain risk management frameworks and policies. You will perform vulnerability scans, penetration tests, and risk assessments while maintaining the risk register and tracking remediation. You will manage risk acceptance processes, monitor third-party compliance with standards like ISO 27001 and SOC 2, and ensure cybersecurity controls align with BC/DR plans. Cyber Security Engineer Skai | Israel | Hybrid – No longer accepting applications As a Cyber Security Engineer, you will develop and maintain automation scripts in Python to enhance SOC efficiency and incident response workflows. Perform initial triage and assessment of security incidents, identifying threats and recommending mitigation strategies. Conduct static and dynamic analysis to uncover malicious behaviours, code, and techniques. Apply forensic methodologies to extract, analyze, and interpret digital evidence to support investigations and attribution. Cyber Security Engineer Symbos CX | Philippines | Hybrid – No longer accepting applications As a Cyber Security Engineer, you will design and deploy security technologies such as firewalls, IDS/IPS, endpoint protection, and SIEM systems, integrating them across cloud and on-premises environments. You will perform regular security assessments, coordinate remediation efforts, and continuously monitor networks and systems to detect and respond to threats. You will also investigate incidents, conduct root cause analyses, and implement corrective actions to reduce risk. Cyber Security Expert Boerse Stuttgart Digital | Germany | Hybrid – No longer accepting applications As a Cyber Security Expert, you will assess, improve, and monitor cybersecurity infrastructure and architecture. Detect, analyze, and mitigate cyber threats and vulnerabilities. Secure cloud environments and integrate security into DevSecOps pipelines. Conduct risk assessments, threat modeling, and prioritize mitigation measures. Cyber Security Senior Analyst – Pentesting Societe Generale Global Solution Centre | India | Hybrid – No longer accepting applications As a Cyber Security Senior Analyst – Pentesting, you will support daily security operations while working independently and with team members. You will lead a specific function or process, mentor team members, and solve complex technical problems. You will assist in improving processes, provide regular functional updates to management, and help prioritize and deliver on team objectives. Cyber Security Senior Specialist SYNLAB International | Germany | Hybrid – No longer accepting applications As a Cyber Security Senior Specialist, you will lead incident response efforts, including rapid assessment, containment, and recovery. You will oversee real-time security monitoring, perform threat detection and hunting, and analyze threat intelligence to strengthen defenses. You will also enhance product security by designing, testing, and implementing robust protective measures. DevSecOps Engineer MSC Mediterranean Shipping Company | Italy | On-site – No longer accepting applications As a DevSecOps Engineer, you will assess team security postures, provide guidance, and track improvements. You will implement and manage automated security tools like SCA and SAST, design and maintain CI/CD pipelines, and support applications and cloud environments. You will collaborate with development, operations, and security teams and help resolve issues identified through penetration testing. Director of Security Hatch | Australia | Hybrid – View job details As a Director of Security, you will define, own and execute the company’s security strategy and roadmap, aligned with GFG’s security strategy and overall business objectives. Lead incident response playbooks, coordinate post-incident reviews, and implement improvements to minimise impact and protect assets. Conduct risk assessments and vulnerability management to reduce risk exposure through timely identification and mitigation. Director of Information Security Pattern Energy | USA | Hybrid – No longer accepting applications As a Director of Information Security, you will be responsible for establishing, leading, and maintaining the organization’s cybersecurity and information security programs to ensure alignment with business objectives, regulatory compliance, and security best practices. IAM and DLP Security Specialist SKF Group | France | On-site – No longer accepting applications As an IAM and DLP Security Specialist, you will design and manage IAM policies, oversee identity lifecycle processes, and implement role-based access controls. You will develop and enforce DLP policies, deploy enterprise-wide DLP solutions, and monitor alerts to prevent data loss. You will collaborate with stakeholders to classify data, ensure compliance with regulations such as GDPR and ISO 27001, and support audits through proper documentation and reporting. Information Security Auditor Thredd | United Kingdom | Hybrid – No longer accepting applications As an Information Security Auditor, you will conduct risk assessments to identify and mitigate risks in governance, data security, and compliance. You will respond to third-party information requests, ensuring alignment with regulatory and contractual requirements. You will audit security controls and systems for compliance with standards such as ISO 27001, SOC 2, and PCI DSS. You will also assess governance frameworks, recommend improvements, and monitor adherence to ensure ongoing compliance. Information Security Manager Solicitors Regulation Authority | United Kingdom | Hybrid – No longer accepting applications As an Information Security Manager, you will be a subject matter expert, providing strategic advice and operational support to ensure robust information security practices are embedded across the organisation. You’ll work closely with IT Security, Risk, and Governance colleagues to assess and manage risks, investigate incidents, and deliver assurance activities. You’ll also lead internal audits, maintain compliance with PCI DSS, and manage external certification processes. Manager – Forensics & Incident Response Emirates NBD | UAE | On-site – No longer accepting applications As a Manager – Forensics & Incident Response, you will ensure effective threat analysis and coordinated remediation efforts. You will integrate incident learnings into SOC operations for proactive threat mitigation, manage and refine incident response processes, and maintain strong cyber hygiene to achieve the unit’s goals. Manager, Security Engineering Headway | USA | Remote – No longer accepting applications As a Manager, Security Engineering, you will lead application and product security efforts at scale. You’ll develop security features, tools, and programs that help teams ship secure code and protect sensitive data across the software lifecycle. You’ll also build and grow your team through strategic planning, hiring, development, and leading high-impact initiatives. Manager Cyber Security Operations Sydney Trains | Australia | Hybrid – No longer accepting applications As a Manager of Cyber Security Operations, you will oversee operational security monitoring tools and implement security procedures for OT and ICS. You will lead a high-performing team responsible for cybersecurity monitoring, incident management, vulnerability and threat management, vendor and contract management, and policy and compliance. Program Cybersecurity Manager Alstom | France | On-site – No longer accepting applications As a Program Cybersecurity Manager, you will conduct system-level risk analyses to define security measures for design and deployment. You will specify subsystem security requirements, contribute to tender responses by outlining cybersecurity strategies, and support project teams in system implementation. Security Triage Analyst II Snowflake | USA | Remote – No longer accepting applications As a Security Triage Analyst II, you will triage alerts for insider threats, product security issues, and other security events. You will assess incident scope and impact within SLAs, escalate validated threats or take remediation actions, follow incident response playbooks, and support major security incidents. Senior Cybersecurity Engineer – Offensive CAAT Pension Plan | Canada | Hybrid – No longer accepting applications As a Senior Cybersecurity Engineer – Offensive, you will lead offensive security testing for AI/ML pipelines, low code/no code platforms, and cloud environments, identifying and exploiting vulnerabilities to strengthen defenses. Integrate security into development processes, collaborating with teams to ensure secure coding and configuration, and proactively address risks in web, mobile, and API applications. Oversee incident response and threat management, leveraging SIEM tools and real-time intelligence to detect, contain, and remediate cyber threats. SOC Cyber Threat Hunter StratasCorp Technologies | USA | On-site – No longer accepting applications As a SOC Cyber Threat Hunter, you will monitor real-time alert, session, and packet capture data. You will use tools such as Wireshark, WinDump, TCPDump, and SIEM systems to detect threats on MSC networks. You will triage alerts, assess threat scope, correlate data, and analyze IDS/IPS activity. You will also update and reconfigure security devices with the latest signatures and techniques to detect and prevent emerging threats. Web2 & Mobile Security Researcher Certora | Israel | Hybrid – No longer accepting applications As a Web2 & Mobile Security Researcher, you will analyze web and mobile applications, perform code reviews to find vulnerabilities, and assess interactions with Web3 infrastructures, wallets, SDKs, and smart contracts. You will produce research, create proof-of-concepts, and work with developers to ensure secure design and implementation.

Wireshark 4.6.0 brings major updates for packet analysis and decryption If you’ve ever used Wireshark to dig into network traffic you know how vital even small upgrades can be. With version 4.6.0 the team behind the open-source network protocol analyzer has added a number of features that could change how you analyse traffic, decode protocols and handle captures across platforms. Mac and Windows users get notable upgrades The 4.6.0 release introduces a handful of platform-specific improvements that make day-to-day packet work easier. On macOS, Wireshark can now dissect process information, packet metadata, flow IDs and drop data provided by tcpdump. Windows users get updated dependencies: Npcap 1.83 replaces 1.79, and the Qt framework jumps to 6.9.3 for better performance and compatibility. The macOS installer is now a single universal package for Intel and Apple Silicon, reducing confusion over which version to grab. At the same time, support for older Windows capture drivers like WinPcap and AirPcap has been removed, steering users toward newer driver stacks that are actively maintained. Capturing data gets smoother For those who rely on live captures, the update makes it possible to compress traffic as it’s written to disk. Previously, compression only worked when Wireshark rotated to a new file during a long capture. This small change can make a difference for analysts collecting large data sets. Time stamps in JSON and other machine-readable outputs are now always written in ISO 8601 UTC format. That may sound minor, but it helps eliminate mismatched or ambiguous times in logs, which can cause real confusion during investigations. Custom columns have also been refined. Users can display data in the same format as the Packet Details pane, and numeric columns now sort numerically rather than alphabetically. Deeper decoding for encrypted and emerging protocols Wireshark’s strength has always been its wide range of supported protocols, and 4.6.0 extends that reach further. It can now decrypt NTP packets using Network Time Security, a feature welcomed by anyone troubleshooting time synchronization. MACsec decryption has been expanded too, with support for Security Association Keys unwrapped by the MKA dissector or through lists of pre-shared keys. The release also adds support for new and evolving formats, including RIFF, TTL files, Binary HTTP, DECT-2020 (New Radio) and GSMA Remote SIM Provisioning. These additions make Wireshark better suited for environments that mix traditional IP networks with telecom or IoT traffic. Interface tweaks that save time Wireshark 4.6.0 brings new quality-of-life touches for people who spend hours in packet traces. A new “Plots” dialog replaces the older I/O Graphs tool, giving users scatter plots, multiple plot views and automatic scrolling for live updates. Packet lists can now be copied as neatly formatted HTML, which simplifies sharing results in reports or documentation. Theme control has been improved too. On Windows and macOS, users can set the color scheme independently of the system default, provided Wireshark is built with Qt 6.8 or later. Linux users gain wider support for Berkeley Packet Filter extensions like “inbound,” “outbound” and “ifindex,” which were previously rejected. Dropping legacy components As part of a wider cleanup, Wireshark has retired some older parts of its code and build system. Besides the removal of WinPcap and AirPcap, support for early versions of the libnl library has ended. The CMake option ENABLE_STATIC is also deprecated in favor of BUILD_SHARED_LIBS. These changes are meant to simplify builds and focus attention on active components. Version 4.6.0 is available now for Windows, macOS and Linux. Before upgrading, users should confirm that their capture drivers and scripts align with the new formats and dependencies. Must read: 35 open-source security tools to power your red team, SOC, and cloud security GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

Cybersecurity researchers are calling attention to a new campaign that delivers the Astaroth banking trojan that employs GitHub as a backbone for its operations to stay resilient in the face of infrastructure takedowns. "Instead of relying solely on traditional command-and-control (C2) servers that can be taken down, these attackers are leveraging GitHub repositories to host malware configurations," McAfee Labs researchers Harshil Patel and Prabudh Chakravorty said in a report. "When law enforcement or security researchers shut down their C2 infrastructure, Astaroth simply pulls fresh configurations from GitHub and keeps running." The activity, per the cybersecurity company, is primarily focused on Brazil, although the banking malware is known to target various countries in Latin America, including Mexico, Uruguay, Argentina, Paraguay, Chile, Bolivia, Peru, Ecuador, Colombia, Venezuela, and Panama. This is not the first time Astaroth campaigns have trained their sights on Brazil. In July and October 2024, both Google and Trend Micro warned of threat clusters dubbed PINEAPPLE and Water Makara that used phishing emails to distribute the malware. The latest attack chain is no different in that it also begins with a DocuSign-themed phishing email containing a link that downloads a zipped Windows shortcut (.lnk) file, which, when opened, installs Astaroth on the compromised host. The LNK file incorporates obfuscated JavaScript that's responsible for fetching additional JavaScript from an external server. The newly fetched JavaScript code, for its part, downloads a number of files from one of the randomly selected hard-coded servers. This includes an AutoIt script that's executed by the JavaScript payload, following which it loads and runs shellcode, which, in turn, loads a Delphi-based DLL to decrypt and inject the Astaroth malware into a newly created RegSvc.exe process. Astaroth is a Delphi malware designed to monitor victims' visits to banking or cryptocurrency websites and steal their credentials using keylogging. The captured information is transmitted to the attackers using the Ngrok reverse proxy. It accomplishes this by checking the active browser program window every second and whether it has a banking-related site opened. If these conditions are met, the malware hooks keyboard events to record keystrokes. Some of the targeted websites are listed below - caixa.gov[.]br safra.com[.]br itau.com[.]br bancooriginal.com[.]br santandernet.com[.]br btgpactual[.]com etherscan[.]io binance[.]com bitcointrade.com[.]br metamask[.]io foxbit.com[.]br localbitcoins[.]com Astaroth also comes fitted with capabilities to resist analysis and shuts down automatically if it detects emulator, debugger, and analysis tools like QEMU Guest Agent, HookExplorer, IDA Pro, ImmunityDebugger, PE Tools, WinDbg, and Wireshark, among others. Persistence on the host is set up by dropping an LNK file in the Windows Startup folder that runs the AutoIT script to launch the malware automatically upon a system reboot. What's more, not only is the initial URL accessed by the JavaScript within the LNK file geofenced, the malware also makes sure that the machine's system locale is not set to English or the U.S. "Astaroth uses GitHub to update its configuration when the C2 servers become inaccessible, by hosting images on GitHub, which uses steganography to hide this information in plain sight," McAfee said. In doing so, the malware leverages a legitimate platform to host configuration files and turn it into a resilient backup infrastructure when primary C2 servers become inaccessible. The company noted that it worked with the Microsoft-owned subsidiary to remove the GitHub repositories, temporarily neutralizing the operations.

Wireshark release 4.4.10 fixes 6 bugs and 1 vulnerability (in the MONGO dissector).

Brazilian users have emerged as the target of a new self-propagating malware dubbed SORVEPOTEL that spreads via the popular messaging app WhatsApp. The campaign, codenamed Water Saci by Trend Micro, weaponizes the trust with the platform to extend its reach across Windows systems, adding the attack is "engineered for speed and propagation" rather than data theft or ransomware. "SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments," researchers Jeffrey Francis Bonaobra, Maristel Policarpio, Sophia Nilette Robles, Cj Arsley Mateo, Jacob Santos, and Paul John Bardon said. "Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more interested in targeting enterprises rather than consumers." Once the attachment is opened, the malware automatically propagates via the desktop web version of WhatsApp, ultimately causing the infected accounts to be banned for engaging in excessive spam. There are no indications that the threat actors have leveraged the access to exfiltrate data or encrypt files. The vast majority of the infections -- 457 of the 477 cases -- are concentrated in Brazil, with entities in government, public service, manufacturing, technology, education, and construction sectors impacted the most. The starting point of the attack is a phishing message sent from an already compromised contact on WhatsApp to lend it a veneer of credibility. The message contains a ZIP attachment that masquerades as a seemingly harmless receipt or health app-related file. That said, there is evidence to suggest that the operators behind the campaign have also used emails to distribute the ZIP files from seemingly legitimate email addresses. Should the recipient fall for the trick and open the attachment, they are lured into opening a Windows shortcut (LNK) file that, when launched, silently triggers the execution of a PowerShell script responsible for retrieving the main payload from an external server (e.g., sorvetenopoate[.]com). The downloaded payload is a batch script designed to establish persistence on the host by copying itself to the Windows Startup folder so that it's automatically launched following a system start. It's also designed to run a PowerShell command that reaches out to a command-and-control (C2) server to fetch further instructions or additional malicious components. Central to SORVEPOTEL operations is the WhatsApp-focused propagation mechanism. If the malware detects that WhatsApp Web is active on the infected system, it proceeds to distribute the malicious ZIP file to all contacts and groups associated with the victim's compromised account, allowing it to spread rapidly. "This automated spreading results in a high volume of spam messages and frequently leads to account suspensions or bans due to violations of WhatsApp's terms of service," Trend Micro said. "The Water Saci campaign demonstrates how threat actors are increasingly leveraging popular communication platforms like WhatsApp to achieve rapid, large-scale malware propagation with minimal user interaction. By combining convincing tried-and-tested phishing tactics, automated session exploitation, and evasion techniques, Water Saci is likely to spread fast." Update Trend Micro has since updated its initial analysis to share details of a PowerShell payload downloaded from the C2 server that's responsible for dropping next-stage shellcode capable of monitoring banking-related activity. "The downloaded payload is a PowerShell script that reflectively loads a .NET DLL that pulls shellcode from the C&C server, injects it into powershell_ise.exe to monitor, and supports propagation (including via WhatsApp) while maintaining contact with multiple C2 servers," the company said. Specifically, the batch file obtains a PowerShell script that's executed directly in memory to launch a .NET DLL binary, which then reaches out to an external server ("zapgrande[.]com") to fetch a malware called Maverick.StageTwo and a downloader DLL associated with hijacking WhatsApp Web that runs only on systems with an active, logged-in WhatsApp session. Prior to fetching these two payload, the DLL implements anti-analysis checks by scanning running processes for names related to debugging or reverse engineering tools such as apimonitor, blurp, fiddler, ghidra, IDA, windbg, wireshark, and x64debug, among others. A .NET executable, Maverick.StageTwo establishes persistence using a batch script and checks active browser window URLs against a hard-coded list of 65 financial institutions in Latin America, particularly those located in Brazil. If the website visited by a victim is a match, the malware proceeds to invoke a core component called Maverick.Agent to establish communication with a C2 server and await further instructions. The commands allow the malware to collect system information, take screenshots, log keystrokes, inject one or more characters into the system, create overlay screens that block keyboard and mouse interactions, gather a list of installed applications, and serve fake banking security alerts or phishing pages to steal user credentials and authentication tokens. Some of the notable targets of the activity include Banco do Brasil, Bradesco, Binance, Caixa Econômica Federal (CEF), Itaú Unibanco, Mercado Pago, Banco do Nordeste, Santander, and Sicredi. The second DLL, on the other hand, leverages browser automation tools like Selenium to control WhatApp Web and send messages containing the malware to other contacts and groups the victim belongs to. (The story has been updated after publication to include additional details from Trend Micro.)

Subire un incidente informatico è come sprofondare in un incubo dal quale pare impossibile svegliarsi. Improvvisamente, i sistemi iniziano a mostrare anomalie, i client segnalano problemi di sicurezza, le mailbox si riempiono di mail sospette e, infine, tutte le informazioni che rappresentano il cuore pulsante dell’azienda sono bloccate e inaccessibili. In questo articolo, ripreso da una lezione di “Forensic Analysis” presso l’Università di Perugia, vedremo come un’organizzazione può passare dall’essere perfettamente operativa al ritrovarsi con i server compromessi, le credenziali esposte e addirittura il proprio software legittimo trasformato in un veicolo di malware per i clienti. Inoltre, sono presenti dei box difensivi che accompagnano ogni fase dell’attacco. L’obiettivo è offrire al lettore non solo una guida tecnica e forense per comprendere l’analisi di un incidente, ma anche spunti pratici di difesa, utili a rafforzare la postura di sicurezza in ambienti reali. Ogni sezione, quindi, non si limita a mostrare “come è avvenuto l’attacco”, ma propone strategie concrete per prevenirlo o mitigarne gli effetti. Indice degli argomenti APTNightmare: l’incubo di subire un attacco informatico Un APTNightmare riassume alla perfezione quello che un’azienda vive quando diventa bersaglio di un gruppo di cyber criminali determinati: un’escalation di eventi che sconvolge infrastrutture, processi e reputazione. Bene, rispondete al telefono che squilla e disdite gli impegni, oggi sarete ingaggiati per risolvere un grave incidente informatico. Incident response: tra finzione e realtà Ovviamente il caso è adattato ai fini narrativi per veicolare i concetti tecnici. In casi reali di compromissione, specialmente se grave, l’Incident Response non si limita a un’analisi forense svolta da remoto. Al contrario, coinvolge un processo molto più articolato che comprende ad esempio: Valutazione dell’impatto e priorità: mentre il team forense si occupa di raccogliere e analizzare gli artefatti, la direzione aziendale e il team IT gestisce la Business Continuity, cercando di mantenere operative le funzioni critiche dell’organizzazione. Confinamento e contenimento: fase in cui si isolano i sistemi compromessi per impedire all’attacco di propagarsi ulteriormente. Remediation: applicazione di patch, modifiche alle configurazioni, cambio password e quant’altro necessario per rimuovere o bloccare l’accesso malevolo. Ripristino: una volta ridotta la minaccia, si agisce per ripristinare i servizi e i sistemi in modo sicuro. Lezioni apprese e miglioramenti: al termine si analizza l’intero processo, traendo insegnamenti e rinforzando le difese per il futuro. Questo giusto per sottolineare che, benché in questa CTF ci concentriamo soprattutto sull’aspetto forense, nella realtà i diversi team (IT, legale, comunicazione, direzione, forense ecc.) agiscono in parallelo e con la massima tempestività, perché in un vero scenario di attacco ogni minuto di ritardo può comportare perdite ingenti o danni irreparabili. La “chiamata alle armi” Ecco un breve racconto romanzato di quello che succedere durante i primi minuti di un attacco informatico in azienda. Responsabile IT (RIT): «Salve, sono Marco Conti, Responsabile IT di CS Corp. Mi scusi se la chiamo a quest’ora, ma abbiamo un’emergenza: i nostri server sembrano essere stati compromessi» Noi: «Capisco, signor Conti. Può darmi qualche dettaglio in più?» RIT: «Certo. Il nostro sistema di monitoraggio e i log di posta evidenziano un traffico insolito da un indirizzo IP interno verso host che non riconosciamo. Non solo: alcuni utenti hanno ricevuto file e allegati “strani”» Noi: «Ha già un’idea di come l’attaccante sia entrato?» RIT: «Non ancora. Stavamo effettuando una migrazione verso Office 365» Noi: «Capisco. Se mi inviate tutti gli artefatti, posso mettermi al lavoro e iniziare subito un’analisi forense approfondita.» RIT: «Glieli mando all’istante. Per cortesia, faccia il possibile per scoprire come ci hanno colpito, quali dati potrebbero essere stati esfiltrati e, soprattutto, come fermare quest’incubo!» Come prima cosa, scarichiamo il file da analizzare: aptnightmare.zip. Il file è protetto da una password, che il nostro cliente ci ha fornito tramite chat criptata: hacktheblue. Quindi estraiamo il contenuto utilizzando il comando: unzip -P hacktheblue aptnightmare.zip All’interno dell’archivio ZIP troviamo quattro file: DiskImage_CEO-US.zip Memory_WebServer.mem traffic.pcapng Ubuntu_5.3.0-70-generic_profile.zip Cominciamo con l’analizzare il file traffic.pcapng. Per questo scopo, utilizzeremo Wireshark, uno strumento di analisi di traffico di rete, ideale per esplorare file PCAP. L’idea è di identificare da quali Indirizzi IP scaturisce il maggior volume di traffico, per individuare quale potrebbero essere l’attaccante e la vittima. Quindi, digitiamo il comando: wireshark traffic.pcapng Esaminando il traffico HTTP filtrato, notiamo che due indirizzi IP interni compaiono costantemente: 192.168.1.3 e 192.168.1.5. Sono loro i principali protagonisti dello scambio di dati (si scambiano migliaia di pacchetti). Questo suggerisce che uno dei due è il server bersaglio e l’altro è la macchina dell’attaccante. Per capire chi è il server web, osserviamo il senso delle comunicazioni HTTP: vediamo numerose richieste GET provenienti da 192.168.1.5 dirette a 192.168.1.3, con risposte dal .1.3. Ciò indica che 192.168.1.3 sta fornendo contenuti (rispondendo alle richieste) e quindi con alta probabilità è il server web infetto, mentre 192.168.1.5 è il client che invia le richieste, ossia l’IP dell’attaccante. Osservando il traffico tra 192.168.1.5 (attaccante) e 192.168.1.3 (server), notiamo molti pacchetti TCP con flag SYN inviati dall’attaccante seguiti da risposte dal server. Questo indica un port scanning, probabilmente di tipo SYN scan (la modalità predefinita di nmap). In un SYN scan, l’attaccante invia un pacchetto TCP SYN a diverse porte del server: se la porta è aperta, il server risponde con SYN+ACK (acknowledgment), se è chiusa, il server risponde con un RST o non risponde affatto. Possiamo usare il seguente filtro in WireShark tcp.flags.syn == 1 && tcp.flags.ack == 1 && ip.src == 192.168.1.3 && ip.dst == 192.168.1.5 Questo mostra i pacchetti dove il server (192.168.1.3) risponde SYN+ACK all’attaccante, segnalando che quella porta sul server è aperta (ha accettato la richiesta di handshake). Tale filtro non è però sufficiente in quanto mostra tutti i tentativi di connessione come una riga distinta, ogni pacchetto (o ritrasmissione) corrispondente a un SYN/ACK inviato dal server. Ciò che a noi interessa è però capire quante porte sono state trovate aperte è il numero di porte uniche (cioè i port number) a cui il server ha risposto con SYN/ACK al primo handshake. In poche parole, dobbiamo eliminare le ripetizioni. Per fare questo utilizziamo il comando: tshark -r traffic.pcapng -Y “ip.src==192.168.1.3 && ip.dst==192.168.1.5 && tcp.flags.syn==1 && tcp.flags.ack==1” -T fields -e tcp.srcport | sort -un dove: -r traffic.pcapng : carica il file PCAP/PCAPNG. -Y “…” è il filtro di visualizzazione (Wireshark Display Filter) che fa sì che tshark processi solo i pacchetti in cui: ip.src==192.168.1.3: il server è la sorgente (sta inviando il SYN/ACK). ip.dst==192.168.1.5: l’attaccante è la destinazione. tcp.flags.syn==1 && tcp.flags.ack==1: stiamo catturando solo i pacchetti che hanno entrambi i bit SYN e ACK impostati (le risposte di un handshake). -T fields -e tcp.srcport : fa sì che tshark stampi solo il campo “porta sorgente” (che, in questo scenario, è la porta del server scansionata). | sort -un: ordina i numeri di porta in modo univoco e crescente, scartando i duplicati. L’output del comando ci restituisce 15 porte aperte. In realtà, esaminando i pacchetti relativi alla porta 5555 possiamo notare che la comunicazione non ha completato il normale handshake (probabilmente perché l’attaccante l’ha usata diversamente) o la comunicazione non è andata a buon fine). Pertanto, escludiamo la porta 5555 dal conteggio degli effettivi servizi aperti enumerati durante la scansione l’attaccante ha trovato 14 porte aperte sul server. Port Scan: cos’è e come difendersi Il port scanning rappresenta una delle prime fasi di ogni attacco informatico: è il momento in cui l’attaccante cerca di “mappare” la rete, scoprendo quali porte e servizi sono esposti. Quando questa attività viene condotta da gruppi criminali o APT, può assumere forme molto più sofisticate di un semplice nmap lanciato da terminale: scansioni lente, distribuite, oppure invisibili ai log tradizionali. Per questo motivo è fondamentale mettere in atto misure difensive mirate, a partire dalla riduzione della superficie di attacco: ogni porta aperta in più è un’opportunità in più per un attaccante. L’uso di firewall host-based, micro-segmentazione e regole “default deny” aiutano a esporre solo i servizi strettamente necessari. Accanto a questo, è altrettanto importante la rilevazione attiva delle scansioni, tramite strumenti come Suricata, Zeek o moduli specifici nei firewall di nuova generazione. Il principio è semplice: se un indirizzo IP tenta di aprire decine di porte in pochi secondi, è probabilmente un tentativo di scansione. In questi casi, possiamo attivare meccanismi di auto-blocco, come Fail2Ban o CrowdSec, che reagiscono in tempo reale mettendo in quarantena l’origine del traffico sospetto. Un’altra strategia efficace è quella di ingannare l’attaccante, reindirizzando i suoi tentativi verso honeypot controllati: sistemi fittizi, creati appositamente per attrarre traffico malevolo e raccogliere indicatori utili all’analisi. Infine, vale la pena ricordare che non tutti gli attacchi arrivano dall’esterno: un dispositivo compromesso internamente potrebbe eseguire una mappatura “laterale”. È quindi fondamentale avere visibilità anche sul traffico interno, tramite log di switch, regole di detection sui dispositivi di rete e controlli sui permessi tra subnet. Addentriamoci ulteriormente nell’enumerazione effettuata dall’attaccante e proviamo a filtrare quali richieste DNS l’attaccante ha effettuato, tramite il comando: dns && (ip.addr == 192.168.1.5) Immediatamente notiamo delle richieste DNS di tipo AXFR,. AXFR è il codice per i trasferimenti di zona DNS (DNS Zone Transfer). Un DNS Zone Transfer è un meccanismo pensato per replicare le informazioni di un server DNS primario su un secondario, trasferendo l’intero file di zona (contenente tutti i record DNS, quindi tutti i sottodomini e relativi indirizzi). Questa operazione dovrebbe essere limitata ai soli server autorizzati; se è aperta a chiunque, costituisce una grave miss-configurazione. L’attaccante ha quindi inviato una richiesta AXFR al server DNS dell’azienda e ha ottenuto indietro tutta la zona DNS contenente i sottodomini dell’organizzazione. Dall’analisi del pacchetto di risposta alla richiesta AXFR (trasferimento di zona) possiamo contare nove sottodomini (cs-corp), adesso in possesso dell’attaccante. Prevenire un attacco di DNS Zone Transfer non autorizzato Il DNS Zone Transfer (AXFR) è una funzionalità prevista dal protocollo DNS per consentire la sincronizzazione tra un server primario e i suoi secondari. Tuttavia, se mal configurato, può diventare una pericolosa fonte di informazioni per un attaccante. È esattamente ciò che è accaduto nel caso analizzato: l’aggressore ha inviato una semplice richiesta AXFR al server DNS dell’organizzazione e ha ottenuto in risposta l’intero contenuto della zona, inclusi tutti i sottodomini interni ed esterni dell’azienda. Parliamo di un vero e proprio elenco dettagliato dei servizi pubblici e (talvolta) interni, come ad esempio mail.cs-corp.cd, sysmon.cs-corp.cd, download.cs-corp.cd e altri. In totale, nove sottodomini sono stati raccolti in pochi secondi, fornendo all’attaccante una mappa completa della superficie di attacco. Per evitare situazioni di questo tipo, è fondamentale che il “trasferimento di zona” sia limitato solo ai server DNS secondari autorizzati. Nella maggior parte dei server DNS (come BIND o Microsoft DNS), esistono impostazioni esplicite per definire quali indirizzi IP possono richiedere un AXFR. Se non si interviene, il server potrebbe rispondere a chiunque, compresi scanner automatici e tool utilizzati da gruppi criminali. Oltre a configurare correttamente il servizio, è buona pratica effettuare test regolari dall’esterno (es. con dig o host) per verificare che le richieste AXFR non ricevano risposta. Anche monitorare i log DNS può aiutare a rilevare tentativi sospetti di trasferimento non autorizzato, magari eseguiti da host esterni in fase di ricognizione. Dopo che l’attaccante ha ottenuto la lista dei sottodomini, è probabile che abbia concentrato i suoi sforzi su uno di essi. Filtriamo in WireShark, come prima cosa, il traffico che prende in considerazione i due IP oggetto dell’analisi ip.addr == 192.168.1.5 && ip.addr == 192.168.1.3 Andiamo sul menu: Statistics > Requests. Difatti, una delle prime richieste è proprio una SQL Injection ai danni del dominio sysmon.cs-corp.cd pagina /index.php parametro fbep= Possiamo quindi concludere di aver individuato il nostro sottodominio vittima: sysmon.cs-corp.cd Sappiamo quindi ora, dalle evidenze raccolte, che l’attaccante ha interagito con la pagina di login (index.php) sul sottodominio sysmon.cs-corp.cd. Avendo individuato le richieste POST su index.php, possiamo esaminarle in dettaglio. In Wireshark, filtriamo il traffico HTTP verso sysmon.cs-corp.cd e osserviamo i codici di risposta: vediamo una serie di richieste POST con risposte di errore (codice 200 con messaggio di login fallito, o 302 che ridirige di nuovo al login). http.host == “sysmon.cs-corp.cd” seguite finalmente da una richiesta POST che riceve un HTTP 302 Redirect verso dashboard.php. http.request.uri == “/dashboard.php” È sufficiente seguire HTTP Stream: Tasto Destro del mouse sulla richiesta > Follow > http Stream admin:Pass@000_ Difendersi da attacchi a siti web con credenziali deboli o brute force Uno dei vettori più comuni, e spesso sottovalutati, per la compromissione di un’applicazione web è l’uso di credenziali deboli o di “default”. In molti casi reali (incluso quello analizzato nella CTF), gli attaccanti non hanno fatto altro che tentare ripetutamente combinazioni di username e password finché non hanno trovato quella giusta: ad esempio, un classico admin:Pass@000_. Questa tecnica, nota come brute-force, può essere grezza o più sofisticata (dizionario, credenziali riutilizzate, tentativi estesi), ma il principio non cambia: se le credenziali sono prevedibili, prima o poi verranno “indovinate”. Per difendersi efficacemente da questi scenari è fondamentale partire dalla scelta e gestione delle password. Le credenziali di amministrazione devono essere lunghe, complesse e uniche. Password “di default” – come admin:admin o password123 – devono essere rimosse immediatamente dopo l’installazione di qualsiasi componente web. Ma non basta contare solo sull’utente: vanno attivate difese proattive contro i tentativi di accesso automatizzati. Sistemi come il blocco temporaneo dell’IP dopo X tentativi falliti, il CAPTCHA nei form di login o strumenti come Fail2Ban possono ridurre drasticamente l’efficacia degli attacchi brute-force. Un’ulteriore misura di sicurezza è l’introduzione della multi-factor authentication (MFA): anche se l’attaccante indovina la password, non potrà accedere senza il secondo fattore (come un codice OTP o una notifica su dispositivo mobile). Torniamo al nostro PCAP e analizziamo le richieste successive al login. Abbiamo visto comparire dashboard.php. Quindi riapplichiamo il filtro di WireShark precedentemente utilizzato: http.request.uri == “/dashboard.php” Ispezionando le richieste POST verso dashboard.php, in una di esse troviamo nel corpo qualcosa di sospetto: un pezzo di codice/testo che assomiglia a un comando shell concatenato. Seguendo il flusso HTTP relativo, individuiamo che l’attaccante ha inviato un payload al server, subito dopo aver effettuato il login. Il payload in questione è quello riportato nell’immagine sottostante. host=%7Cmkfifo+%2Ftmp%2Fmypipe%3Bcat+%2Ftmp%2Fmypipe%7C%2Fbin%2Fbash%7Cnc+-l+-p+5555+%3E%2Ftmp%2Fmypipe Anche se il payload codificato rivela già la Reverse Shell, possiamo ulteriormente decodificarlo, in maniera semplice, utilizzando CyberChef tramite la funzione “URL Decode”, ottenendo: host=|mkfifo /tmp/mypipe;cat /tmp/mypipe|/bin/bash|nc -l -p 5555 >/tmp/mypipe Dove: mkfifo /tmp/mypipe; crea un FIFO (named pipe) chiamato /tmp/mypipe. Un named pipe è un file speciale usato per comunicazione tra processi. cat /tmp/mypipe | /bin/bash | nc -l -p 5555 > /tmp/mypipe. Questa parte concatena tre elementi tramite pipe: cat /tmp/mypipe rimane in ascolto leggendo dal pipe (si blocca in attesa di input). L’output di cat viene passato a /bin/bash, che lo esegue come comandi shell. L’output di Bash viene passato al comando nc (netcat) che ascolta sulla porta 5555 in modalità listener (-l -p 5555) e invia tutto ciò che riceve dalla pipe Bash al client che si connetterà. Infine, tutto ciò che arriva da netcat (cioè i comandi dell’attaccante) viene reindirizzato di nuovo nel pipe /tmp/mypipe, chiudendo il loop. Possiamo concludere che questo comando ha fornito all’attaccante l’Initial Access sulla macchina, la sua shell. Le vulnerabilità In molti scenari avanzati, come quello affrontato nella CTF, l’attaccante sfrutta una debolezza logica o tecnica presente in un’applicazione web accessibile solo dopo l’autenticazione. In questo caso, una volta ottenuto l’accesso tramite credenziali deboli o brute-force, l’attaccante ha probabilmente sfruttato una funzionalità vulnerabile che gli ha permesso di eseguire comandi arbitrari sul server (Remote Code Execution – RCE). Da lì ha stabilito una reverse shell, ottenendo così il primo punto di ingresso (“Initial Access”) nell’infrastruttura. Una difesa efficace parte innanzitutto dalla gestione delle vulnerabilità note. È essenziale adottare politiche di aggiornamento e patching regolari, soprattutto su componenti esposti sul web: framework, CMS, plugin e librerie lato server devono essere costantemente aggiornati. La mancata applicazione delle patch espone l’organizzazione a exploit pubblici già documentati (con tanto di CVE e PoC disponibili), rendendo l’attacco estremamente semplice per qualsiasi attore malevolo. A fianco del patching, è importante: Analizzare anche le aree protette da login: le attività di code review e vulnerability assessment devono includere funzionalità interne e amministrative. Segmentare la rete: un’applicazione web compromessa non dovrebbe poter comunicare direttamente con sistemi sensibili. Monitorare i log di sistema e applicativi per rilevare comandi sospetti come nc, bash, mkfifo, tipici di una reverse shell. Limitare le comunicazioni in uscita dai server web verso Internet, consentendo solo le destinazioni strettamente necessarie. Utilizzare strumenti di rilevamento per individuare comportamenti anomali a livello di processo o connessione di rete.

[This is a Guest Diary by Taylor House, an ISC intern as part of the SANS.edu Bachelor's Degree in Applied Cybersecurity (BACS) program [1].] Distributed denial of service (DDoS) attacks are a type of cyber-attack where the threat actor attempts to disrupt a service by flooding the target with a ton of requests to overload system resources and prevent legitimate traffic from reaching it. From March 31st until April 20th of this year, my honeypot went under a constant barrage of TCP SYN packets over port 443. This post seeks to go over this attack and share observations proving how looks can be deceiving. In total, this attack sent 2389339 packets from 6039 hosts. The attack came over a series of three waves, with no relation other than the destination port and the flag that was set. A sample was taken from the first of these waves, and each packet was found to have these properties: A total length of 60 bytes. Targeted port 443 using the TCP protocol. Had the SYN flag and no other flags set. Had a window size of 32768. Had a maximum segment size of 1460 bytes. A trailer in the Ethernet header containing 2 bytes of padding. Figure 1. Wireshark output displaying a sample of packets from wave 1. The First Wave The first wave occurred from March 31st until April 4th, sending 647069 packets from 743 hosts. The top 10 hosts from this wave were: Figure 2. Top 10 hosts from wave 1 by number of packets sent. An overwhelming majority of the hosts (86%) were within the IP address range 103.15.245.0-103.15.247.99. Of those hosts, 36 of them had domain name entries. All these hosts are assigned to Summit Communications, an ISP located in Bangladesh. Of those 36 hosts, Shodan intelligence [2] shows multiple possible vulnerabilities due to outdated software such as: dropband[.]summitiig[.]net is running a web server on Apache version 2.4.18 and may be vulnerable to critical vulnerabilities such as buffer overflow attacks and remote code execution attacks that enable attackers to exert direct control over the system through the web server. [3,4] mrtg[.]summitiig[.]net is running an even older version of Apache, version 2.2.15, and may be vulnerable to vulnerabilities such as buffer overflow and reading process memory. [5,6] Crafted Packets? It is possible that this could be the result of a botnet. However, with only a minority of hosts having domain names or clearly exposed services, another possible explanation is the connections were spoofed. The consistent size and attributes of the packets, including window size and maximum segment size, is a sign this might be happening because of packet crafting using a tool like Scapy. Packet crafting is a process for sending fake packets to a target with custom fields. Suppose I craft a packet to send to my loopback address using the following commands. Padding can be any value, since there are two random bytes that can be found at the end of each packet: packet = IP(src=RandIP(), dst='127.0.0.0')/TCP(sport=RandShort(), dport=443, window=32768, options=[('MSS',1460)])/Padding('\x00\x00') send(packet, iface=?lo?) #Repeat many times? What we find on the other side is the following: Figure 3. Screenshot of the crafted packets captured in Wireshark. Shockingly similar to the observed activity! This proves that packet crafting may have a role to play in this attack. The Second Wave The second wave occurred from April 7th until April 14th, sending 885209 packets from 1054 hosts. The top 10 hosts from this wave were: Figure 4. Top 10 hosts from wave 2 by number of packets sent. This wave had both more hosts and each host sent more packets, demonstrating a slight increase in the rate of packets sent. The majority of hosts (60%) were from the IP range 85.194.196.1-85.194.198.99. All these hosts are assigned to ScopeSky, an ISP located in Iraq. CloudFlare reports a spike in Layer 7 attacks sourcing from ScopeSky’s autonomous systems number for the period of this attack, suggesting that many attacks involving the application layer, like web application firewall bypasses and DdoS attacks are coming from this autonomous systems number over the period relative to previous periods [7]. Figure 5. Application layer attack volume change relative to the previous period from AS50597: ScopeSky [7]. Is this a new botnet? The chance these are the legitimate sources is low. Given that it makes up a third of the address space assigned to ScopeSky, this would be a major incident for the company and would make the news. This proves that threat actors can spoof their traffic to make it look like it is coming from another source, but an 1800% increase is very unrealistic for it to appear like a legitimate threat. The Third Wave The third wave occurred from April 16th until April 20th, sending 857061 packets from 4242 hosts. The top 10 hosts from this wave were: Figure 6. Top 10 hosts from wave 3 by number of packets sent. An overwhelming majority of hosts (96%) came from the ip range 176.241.80.0-176.241.95.99. These ranges are covered by two autonomous systems numbers: AS57588, managed by Hayat for Internet & communication LLC, another ISP in Iraq, and AS57000 LinkiWay DMCC, an Emirati ISP [8,9]. This wave had a lot more hosts, but the number of packets per host were a lot fewer, which may increase the rate of packets being sent, but impacts the overall volume. GreyNoise reports 44 known malicious hosts from this wave [10]. The hosts have been observed doing a variety of suspicious actions such as Telnet/SSH brute forcing attempts, web crawling, default password guessing, and the deployment of various worms such as variants of WannaCry and TrickBot. Looking at Shodan data relevant to the identified ASNs [11,12], There are about 150 systems that have SSH exposed externally, a very poor security practice. The known malicious systems may have been brute forced by the threat actor to gain more systems under their control. Combined with spoofing, this may explain why the total host count is so high relative to the other waves. Is this really a DDoS? While the honeypot received a total of 2389339 packets, this is likely not enough to interrupt a modern service. For DDoS attacks, they are usually represented by the number of packets (or requests when speaking in terms of HTTP) per second. CloudFlare reported that they mitigated a DDoS attack operating at over 71 million requests per second [13]. In this attack, the packet volume was not nearly that high, and the sample we collected from the first wave only achieved 12.1 packets per second. Figure 7. Average packets per second from the packet capture. Even if the rate picked up significantly in the third wave since the number of hosts were higher, it would not ever reach a high enough speed to have a good chance at taking down a service. So, what was the point of this attack if it was not to shut down services? While SYN flags can be used to scan a network for open ports (listening ports would respond with a SYN-ACK), this was a spike relative to my usual traffic, it is unlikely that so many hosts decided to scan the honeypot at the same time. Figure 8. Number of packets received by the honeypot from April 14th to July 14th. There are also tools like nmap that can perform SYN scans with the -sS option, but the packets do not have the same properties as our sample data: Figure 9. Wireshark capture of a nmap SYN scan. Note the window size and length. In summary, if this was a DDoS, it is very unlikely to be effective on any modern system. A scan using TCP SYN flags is also very unlikely, leaving few explanations for this attack. Lessons Learned We can draw a few conclusions from analyzing each wave of this attack. First, packet crafting may have been in use to mask the attacker’s real IP address, Secondly, a legitimate SYN flood attack seems very unlikely here, since the packet volume and rate were both far too low. Finally, traffic came from unlikely sources without making the news or showing up on threat intelligence aside from a very small minority of traffic, strongly indicating that the traffic is not legitimate. Another possibility is that all of this traffic was a smokescreen for another attack. An analyst can waste a lot of time looking at network logs that seem related while the real attack may be taking place using another method that seems unrelated. The demonstration of Scapy shows that it is quite easy to spoof network traffic and send it to a target host to create very noisy network logs. You could even create a list of IP addresses like the hosts found in the waves to create the light correlations described in my findings. In short, this makes an excellent distraction. As for what the plan for attack was, the honeypot did not log any attacks of significance, other than what is typical of the daily traffic. On April 1st, there were some hosts that were also logged in the first wave attempting to access the following URLs from the web honeypot: / /.git/config /.git/index /.env To wrap up, the packet volume was not enough for this attack to be considered an effective DDoS attack, it also does not seem to be an access attack on web services, but the small SYN flood made an excellent distraction if the threat actor wished to perform a more complex attack. Understanding what volume a SYN flood becomes a threat is important to avoid getting caught in a distraction as an analyst. --- Taylor House Apprentice Handler, Internet Storm Center

Wireshark release 4.4.9 fixes 5 bugs.

Wireshark release 4.4.8 fixes 9 bugs.