Another Google app bites the dust in the US

andreasc
-
0
Another Google app bites the dust in the US
[ad_1]

Google’s library of defunct apps and services is getting bigger each year. The search giant revealed at the beginning of 2024 that it will shut down the GPay app in the United States.

That means that starting June 4, GPay is no longer available in the United States. If you’re trying login, you’ll be met with a message that informs you about the changes: “The Google Pay US app is no longer available. You can still tap to pay using the Google Wallet.”

The message is also meant to provide GPay users with an alternative in case they didn’t know already. Google Wallet is now the company’s main mobile payment app, at least until the company changes its mind and decides to discontinue the app and/or the payment system.

Beside GPay no longer working in the United States, Google also removed peer-to-peer payments. As per 9to5google’s report, users can still use the Google Pay website to view and transfer their balance to a bank account after June.

The changes made by Google this month will mostly affect those with multiple accounts who used GPay for its peer-to-peer functionality. The rest will probably don’t feel its absence that much since they can just switch to Google Wallet (if they didn’t already).

[ad_2]
Source link

ALPHV Ransomware Deployment Started With RDP Access & ScreenConnect

andreasc
-
0
ALPHV Ransomware Deployment Started With RDP Access & ScreenConnect
[ad_1]

Ransomware is used by hackers to abuse victims’ data, locking it until a ransom is paid.

This method of cyber attack is profitable as it takes advantage of data’s proximity and vitality to individuals and companies, so they have no choice but to pay for quick returns.

An invasion started with an email containing a forked IcedID variant that emphasized payload delivery.

After gaining initial access, the intruder installed ScreenConnect on the computer for remote control, abusively utilized Cobalt Strike beacons, and deployed CSharp Streamer RAT to gain credentials and move laterally within domain controllers and servers.

During the identification phase, sensitive information was placed in ‘confucius_cpp,’ a special program of which rclone showed the extraction.

With ANYRUN You can Analyze any URL, Files & Email for Malicious Activity : Start your Analysis

For eight days, they performed a systematic deployment of ScreenConnect installers across hosts using WMI before finally delivering ALPHV ransomware payloads after deleting backups.

ALPHV Ransomware Deployment

The malicious spam electronic mail, which tricked the prey into downloading and unzipping a folder with a readme and Visual Basic Script (VBS), served as the initial access vector.

Activating VBS executed an embedded, obfuscated IcedID loader DLL that dropped and ran another IcedID DLL payload, completing the infection chain, reads the DFIR report.

This is consistent with a known malicious activity where the same technique was employed to distribute an IcedID fork that deals with payload deployment instead of banking activities.

The threat actor deployed ScreenConnect remote access tools using disguised installation programs that operated through wmiexec and RDP sessions.

Several techniques were employed to extract Cobalt Strike beacons, including bitsadmin, certutil, and PowerShell.

CSharp Streamer RAT kept persistence via scheduled tasks in LSASS credential dumping, lateral movement, and C2 communications.

IcedID ensured its persistence by using scheduled tasks, while ScreenConnect was made persistent across reboots.

During lateral movement into winlogon.exe and rundll32.exe, process injection was observed. Renamed installers were deleted by the actor.

Lateral movement (Source – The Fire Report)

Key activities involved LSASS credential dumping, which was validated through memory analysis, and dcsync was performed from the beachhead to a domain controller for credential harvesting.

This was followed by the threat actor conducting initial recognition using native Windows utilities launched through IcedID and subsequently exploiting ScreenConnect for more reconnaissance commands.

SoftPerfect netscan for network scanning took place on different days, targeting IP ranges plus ports of RPC, SMB, RDP, and Veeam backups.

ScreenConnect installers were then laterally copied via SMB and became deployed with wmiexec.py to get remote control. The attacker extensively used RDP for lateral movement including proxying through CSharp Streamer.

Before exfiltration, a custom tool called confucius_cpp enumerated systems by LDAP query, accessed shares based on keywords, and compressed sensitive information. The attacker also opened documents using the Firefox installation.

C&C (Source – The Fire Report)

The threat actor leveraged multiple tools during the intrusion:- 

  • IcedID for initial access communicating with modalefastnow[.]com
  • Cobalt Strike beacons across hosts connecting to tracked C2 infrastructure
  • CSharp Streamer RAT at 109.236.80.191 using WebSockets over rotating ports
  • ScreenConnect remote access tools deployed via renamed binaries executed through wmiexec.py

While Firefox was used for document preview and downloading rclone, which was executed through a VBS script for data exfiltration. 

The final payload was ALPHV ransomware, staged on the backup server then deployed across hosts via xcopy and WMI-initiated execution after deleting backups. 

Note (Source – The Fire Report)

A ransom note referencing the group’s Twitter was left post-encryption.

Looking for Full Data Breach Protection? Try Cynet's All-in-One Cybersecurity Platform for MSPs: Try Free Demo 


[ad_2]
Source link

Huawei intros new metal unibody tablet, the MatePad SE 11

andreasc
-
0
Huawei intros new metal unibody tablet, the MatePad SE 11
[ad_1]

Huawei has announced a new tablet with a metal unibody design, the MatePad SE 11. This device is kind of a successor to the original MatePad SE which arrived back in 2022.

The Huawei MatePad SE 11 is now official, with rather thin bezels

As you can see in the provided images, the device doesn’t have thick bezels, not at all. They’re just thin enough to make it look very modern and yet thick enough to offer you a proper grip. There are also no display camera holes or anything like that.

There is a single camera on the back, though thanks to the design of the camera island, it seems like there are two. The device has a flat frame all around, the same goes for its front and back sides.

It is worth noting that this tablet also comes with stylus support. It supports the Huawei M-Pen lite for writing, drawing, and note-taking. Gravity and ambient light sensors are included in the tablet too.

An 11-inch display is included in this mid-range tablet

There is an 11-inch display on the front. This is a fullHD+ (1920 x 1200) LCD display, and it has a 16:10 aspect ratio. The screen-to-body ratio of this tablet is 85%, which is great for a tablet, actually. The display has a peak brightness of 400 nits.

The Kirin 710A and Snapdragon 680 fuel this tablet, it all depends on the region you live in. It’s clear this is a budget tablet. HarmonyOS 2.0 comes pre-installed on it, and it enables various features, such as multi-window, multi-screen collaboration, and so on.

It comes in 4GB, 6GB, and 8GB RAM options, with 64GB and 128GB of storage. It all depends on the model you choose. A 7,700mAh battery is included in the package, while 22.5W charging is supported.

It has four speakers, and Huawei Listen 9.0 support

There are four speakers on the tablet, and Huawei Listen 9.0 is supported. Bluetooth 5.1 support is also included, and the same goes for dual-band Wi-Fi ac. A single 8-megapixel camera sits on the back, while a 5-megapixel camera is included on the front.

The Huawei MatePad SE 11 measures 252.3 x 163.8 x 6.9mm, while it weighs 475 grams. The device comes in Crystal Blue and Nebula Gray colors. We still don’t know its price tag.


[ad_2]
Source link

Which is better for you, a Forex app or a desktop platform?

andreasc
-
0
Which is better for you, a Forex app or a desktop platform?
[ad_1]

Forex trading has become increasingly popular, with millions of traders participating daily. As technology continues to advance, traders now have the option to trade forex on their mobile devices through forex apps or on their desktops through forex platforms. Both options have advantages and disadvantages, and traders must understand these differences before choosing which platform to trade on.

What is a Forex App

A forex app, also known as a foreign exchange app, is a mobile application that allows users to access real-time foreign exchange rates, trade currencies, analyze market trends, and manage their forex trading accounts on the go. These apps typically provide a range of tools and features for traders to stay informed and make informed decisions while trading in the forex market.

What is a Forex Desktop Platform

A Forex desktop platform is a software application installed on a computer or laptop to facilitate online trading in the foreign exchange market. These platforms provide traders access to real-time market data, charts, technical analysis tools, and trading capabilities. Users can execute trades, set up automated trading strategies, manage positions, and track their portfolios all from a single interface on their desktop.

Various brokerages and trading platforms offer forex desktop platforms, and they come in different versions with varying features and functionalities. Common examples of popular Forex desktop platforms include MetaTrader 4 (MT4) and MetaTrader 5 (MT5). Both beginner and experienced traders widely use these platforms for their ease of use, robust capabilities, and reliability in executing trades in the Forex market.

What Are Some Advantages of a Forex App

One of the main advantages of using a Forex trading app is its convenience and flexibility. With a Forex app, traders can access the market anytime and anywhere, as long as they have an internet connection. This situation means that traders can trade on the go, allowing them to take advantage of trading opportunities even when not at their desktops. In addition, forex apps are typically more user-friendly and intuitive, making them easier for traders new to the market to navigate.

A Forex app connects to the internet through the device’s network connection, such as Wi-Fi or mobile data. When the app is launched on a smartphone, tablet, or other mobile device, it will automatically attempt to establish a connection to the internet through the device’s network settings. Once the connection is established, the Forex app can access real-time market data, execute trades, and provide traders with the latest information and tools to make informed decisions.

Forex apps typically require an active internet connection to function correctly, as they need to constantly receive and transmit data to and from the broker’s servers to update prices, charts, account information, and trade-related activities. Traders must have a stable and reliable internet connection when using Forex apps to access up-to-date market information and execute trades without interruptions.

What are Some Disadvantages of using a Forex App?

Some disadvantages of using a Forex app could offset the benefits of trading on the go. Mobile devices have smaller screens than desktop computers, making it challenging to analyze complex market data and charts.

Forex apps may not have all the features and tools available on desktop platforms, which can limit the capabilities of traders, especially for advanced analysis and trading strategies. Mobile internet connections may be less stable and reliable than a wired connections, leading to potential disruptions in data updates or trade execution.

Trading on a Forex app can drain a mobile device’s battery quickly, especially if the app requires continuous data updates and monitoring. Mobile devices are more susceptible to risks such as malware and hacking, which could compromise the trader’s personal and financial information.

Forex apps may have limited customization options compared to desktop platforms, making it challenging for traders to tailor the interface and tools to their needs. Trading on a mobile app may be less efficient for traders who need to multitask or monitor multiple markets simultaneously, as it may require switching between different screens or apps.

What are the Advantages of a Desk Top Platform

On the other hand, a Forex desktop platform offers a more comprehensive and robust trading experience. Desktop platforms usually have more advanced charting tools, analysis features, and order management capabilities, which can benefit experienced traders who require more complex trading tools. In addition, desktop platforms typically offer better security and stability than mobile apps, as they are less susceptible to crashes or technical glitches.

Furthermore, desktop platforms often provide a larger screen space, allowing for better visibility and analysis of market trends. Traders can open multiple windows simultaneously, making monitoring several currency pairs easier and making informed trading decisions. In contrast, forex apps may have screen size and functionality limitations, making it harder for traders to perform technical analysis and conduct thorough research.

Desktop platforms typically offer a more comprehensive range of advanced analysis tools, indicators, and order types not always available on mobile apps. Desktop trading platforms often provide a broader range of technical indicators than mobile forex apps. Some of the advanced technical indicators that are commonly available on desktop platforms but may be limited or not available on mobile apps include:

These levels identify potential support and resistance levels based on Fibonacci ratios calculated from previous price movements. For example, a desktop app might have Bollinger Bands. This technical indicator is a popular volatility indicator that consists of a simple moving average and two standard deviation bands used to identify price volatility and potential trend reversals.

To analyze trading volume patterns, desktop platforms may have more advanced volume indicators such as accumulation/distribution. Desktop platforms might offer the MACD (Moving Average Convergence Divergence). This trend-following momentum indicator shows the relationship between two moving averages of an asset’s price, helping traders identify potential trend reversals.

Desktop platforms often have faster execution speeds than mobile apps, providing traders with quicker access to market data and the ability to execute trades more efficiently.

Desktop platforms usually offer customization options, allowing traders to tailor the interface, charts, and tools to their preferences and trading strategies. Desktop platforms are less likely to experience connectivity issues or interruptions than mobile apps, providing a more stable trading experience.

Traders using a desktop platform can use multi-screen setups to monitor multiple markets, charts, and data simultaneously, enabling better decision-making and analysis.

Desktop platforms are generally considered more secure than mobile apps due to heightened security measures and encryption protocols, reducing the risk of unauthorized access to sensitive trading information.

Some Disadvantages of Using a Forex Desktop Platform

Some potential negatives of using a desktop Forex platform compared to a Forex app include accessibility. Desktop platforms are not as portable or convenient as forex apps, as they require users to have access to a computer or laptop with an internet connection. Traders may miss opportunities if they are away from their desktop setup.

Desktop platforms may require higher computing power and internet speed to function smoothly, leading to potential lags, delays, or interruptions in data updates and trade execution.

Users may need to download and install the desktop platform software on their computer, which can be time-consuming and require technical knowledge to set up and configure.

Traders using desktop platforms may be limited to trading on a single device, whereas forex apps offer flexibility to trade on smartphones, tablets, or multiple devices.

Some traders may find the interface of desktop platforms less user-friendly or intuitive than mobile apps, which can affect their overall trading experience and efficiency.

The bottom Line

Both forex apps and desktop platforms have their strengths and weaknesses, and the best platform for trading ultimately depends on the individual trader’s preferences and trading style. A Forex app may be ideal for traders prioritizing convenience and flexibility. However, a desktop platform may be more suitable for those who require advanced trading tools and greater control over their trading activities. Ultimately, traders should consider their trading goals and preferences before deciding which platform to use for their forex trading activities. Traders must weigh the advantages and disadvantages of using a desktop platform versus a forex app based on their trading preferences, needs, and lifestyle to determine which platform best suits their trading style.

Traders can simultaneously use a Forex app and desktop platform to enhance their trading experience and flexibility. By using both platforms, traders can take advantage of the benefits offered by each platform and adapt their trading activities based on their preferences and needs.
By utilizing a Forex app and a desktop platform, traders can optimize their trading activities, stay connected to the market at all times, and enhance their trading capabilities for better decision-making and efficiency.


[ad_2]
Source link

WhatsApp’s Communities feature is coming to Messenger

andreasc
-
0
WhatsApp’s Communities feature is coming to Messenger
[ad_1]

Meta is silently rolling out Communities, a feature that WhatsApp received back in 2022, to Messenger. The feature makes it easier for organizations, schools and other private groups to chat on Messenger in an organized fashion.

Although Meta hasn’t issued an official announcement for the new feature, the company confirmed to TechCrunch that Messenger users are now getting Communities.

What’s important to understand is that you won’t be needing an associated Facebook Group to be able to connect with others. Unlike Community Chats that were added to Messenger two years ago, you don’t need to be connected to a Facebook Group to create a dedicated space for communication in real time.

According to Meta, Messenger users can now create a dedicated community to connect with people with shared interests. Unlike WhatsApp, which requires users to have someone’s phone number to invite them to a Community, Messenger Communities are connected to Facebook’s social graph.

Basically, this means that in order to create a Community, Messenger users can simply invite Facebook friends and friends of friends to grow their communities. These Communities on Messenger have been mainly designed for public conversation, Meta claims.

TechCrunch reports that the new Communities feature is now rolling out to all users globally, but it might not be available to everyone at the same time, so be patient if you don’t see Communities in your app yet.


[ad_2]
Source link

Duckduckgo Launches Anonymous AI Chatbots

andreasc
-
0
Duckduckgo Launches Anonymous AI Chatbots
[ad_1]

DuckDuckGo has unveiled a new feature, AI Chat, which offers users an anonymous way to access popular AI chatbots.

This innovative service includes models like OpenAI’s GPT 3.5 Turbo, Anthropic’s Claude 3 Haiku, and two open-source models, Meta Llama 3 and Mistral’s Mixtral 8x7B.

A New Era of Private AI Interaction

DuckDuckGo’s AI Chat is designed to provide a private and anonymous experience for users who want to interact with AI chatbots.

This optional feature is free to use within a daily limit and can be easily switched off if desired.

The company emphasizes that all chats are private, anonymized, and not used for any AI model training.

According to the Spreadprivacy blog, Users can access DuckDuckGo AI Chat through various entry points, including duck.ai, duckduckgo.com/chat, the Chat tab on search results pages, or via the !ai and !chat bang shortcuts.

All these routes lead to the same destination, ensuring a seamless user experience.

Analyze any MaliciousURL, Files & Emails & Configuration With ANY RUN : Start your Analysis

Why AI Chat?

DuckDuckGo’s mission is to demonstrate that online privacy can be easily maintained.

The company believes people should be able to use the internet and digital tools without sacrificing their privacy.

This philosophy has driven the development of products that add a layer of privacy to everyday online activities, from search and browsing to email and now generative AI with AI Chat.

According to recent Pew research, many U.S. adults have concerns about AI’s impact on privacy, even as they recognize its potential benefits in other areas.

DuckDuckGo AI Chat aims to address these concerns by offering a private and anonymous way to use AI chatbots.

Enhancing the Search Experience

DuckDuckGo takes a thoughtful approach to integrating AI features in the competitive landscape of generative AI.

Before rolling out, the company carefully considers how these features can enhance the search and browsing experience.

AI Chat and search are seen as complementary tools that can help users find information more effectively, especially when exploring new topics.

For instance, users might start with AI Chat to ask a few questions and then switch to traditional search to find reviews, prices, or other primary sources.

Conversely, they might begin with a search and then use AI Chat for follow-up queries.

This flexibility allows users to choose the method that best suits their needs.

How It Works and Ensures Privacy

Users can select their preferred chat model and interact like any other chat interface when they land on the AI Chat page.

All chats are completely anonymous, with DuckDuckGo removing users’ IP addresses and using its own instead.

This ensures that requests appear from DuckDuckGo, not the individual user.

DuckDuckGo does not save or store any chats. While the underlying model providers may temporarily store chats to ensure system functionality, they cannot trace them back to individual users.

Agreements with model providers ensure that any saved chats are deleted within 30 days and are not used for model training.

AI Chat is free to use within a daily limit, maintaining strict user anonymity.

DuckDuckGo plans to keep the current level of access free while exploring a paid plan for higher usage limits and more advanced chat models.

DuckDuckGo is already working on improvements to AI Chat, including new capabilities like custom system prompts and general user experience enhancements.

The company also plans to add more chat models, potentially including DuckDuckGo– or user-hosted options.

Users are encouraged to provide feedback on desired features via the Share Feedback button on the AI Chat screen.

To experience DuckDuckGo AI Chat, visit duck.ai or duckduckgo.com/chat.

You can also find it on your search results page under the Chat tab or initiate a chat using the !ai or !chat bang shortcuts.

If AI Chat isn’t for you, it can be easily disabled in the Search settings menu.

Looking for Full Data Breach Protection? Try Cynet's All-in-One Cybersecurity Platform for MSPs: Try Free Demo


[ad_2]
Source link

Wild rumor says Galaxy S26 Ultra could include advanced facial scanning

andreasc
-
0
Wild rumor says Galaxy S26 Ultra could include advanced facial scanning
[ad_1]

A new rumor that surfaced claims that the Galaxy S26 Ultra could end up including advanced facial scanning. Yes, we’re talking about Face ID-like facial scanning, like the one Apple offers on iPhones.

The Galaxy S26 Ultra tipped to include advanced facial scanning

This information comes from Sawyer Galox, but do take it with a grain of salt. He was actually resharing a tweet from Haizaki Ryouhei, who claims that the tech will be included in the Galaxy S25 Ultra.

Sawyer Galox denied that, while he added it’s “impossible” for that to happen. However, he did add that “it will be in the Galaxy S26 Ultra”. He seemed rather confident that it will happen, not that it could happen.

The tipster added that “Samsung is slowly innovating to imitate Apple”. He also claims that Samsung is making moves to save money, which he also took as a similarity to the Cupertino giant.

Despite what one source says, the Galaxy S25 Ultra will not include that tech

It remains to be seen if the tipster will be right, we’ll have to wait quite a bit to find out. One thing is for sure, the Galaxy S25 Ultra will not offer advanced facial scanning. We’ve already seen plenty of information regarding that phone, and advanced facial scanning was not mentioned once. It also has a single display camera hole, so… it’s not happening.

The Galaxy S25 series is expected to launch in early 2025. Based on what happened this year, it will become official in January, but it remains to be seen. Samsung is no stranger to switching up its release timeframes.

We’re once again getting three ‘Galaxy S’ series phones. Before that happens, however, Samsung’s focus is on the second Unpacked event of 2024. That event will allegedly happen on July 10, and the Galaxy Z Fold 6 and Flip 6 will launch during it. In addition to those phones, the Galaxy Ring and Galaxy Watch 7 series are also coming.


[ad_2]
Source link

Best of Computex 2024: Intel Xeon 6 Series

andreasc
-
0
Best of Computex 2024: Intel Xeon 6 Series
[ad_1]

Intel debuts new Xeon 6 series processors, including an impressive 288-core option

While others announced consumer processors at Computex, Intel announced new processors for high-end servers and workstations – the Xeon 6 series. These new processors use Xe2 GPU architecture for Lunar Lake CPUs, and Intel says that these products and technologies are designed for the next generation of artificial intelligence PCs.

This new family of processors from Intel includes Efficient-Core and Performance-Core options. Intel has developed the Xeon 6 series for a wide range of use cases and workloads. The E-Core options are codenamed Sierra Forest, while the P-Core options are code-named Granite Rapids, with the latter launching in the third quarter of 2024.

The Intel Xeon 6 series has earned a Best of Computex 2024 award from Android Headlines for its extremely powerful options, including a 144-core option, which is currently the most core of any processor.

Intel’s Xeon 6700 series has up to 288 E-Cores

Just looking at the specs of some of the Xeon 6 series chipsets, it’s a bit insane. But you have to remember, these are not made for laptops, but servers and workstations that have much heavier loads. One of the models in this series, the Xeon 6700 series, has an option that you can get with 144 E-Cores or Efficiency Cores. That means that these cores aren’t the absolute fastest in the world, but they do support up to 350W per CPU.

But that’s not the most cores that Intel has, there is also the Xeon 6900 series models that come with up to 288 E-Cores or 128 P-Cores and will require AP platforms that support up to 500W per CPU. The 6900 will be available next year, with the 6700 launching later this year.

When comparing how much faster and higher performing these chipsets are compared to the previous gen, Xeon 6 is about 2x higher performance on AI reference, up to 2.3x higher performance on OpenFOAM Workloads, and up to 2x average higher performance for general computing, on the P-Core models.

However, the E-Cores also get some pretty nice bumps, with up to 2.6x higher server-side perf/watt java throughput with SLA and up to 3.4x higher performance per watt for the next-gen firewall.

These are some really impressive processors from Intel, showing that they aren’t falling behind but rather leading the pack. That’s why we have awarded the Intel Xeon 6 series a Best of Computex 2024 award.


[ad_2]
Source link

WhatsApp working on a small, yet very useful new feature for Community groups

andreasc
-
0
WhatsApp working on a small, yet very useful new feature for Community groups
[ad_1]
This is just a heads up that if you’re using WhatsApp, there’s a high chance that you’ll be getting a new feature in the future that will make it possible to have cover photos attached to upcoming events in Community groups.

The information comes directly from WABetaInfo, which also reports that this new feature is being rolled out to the beta version of WhatsApp, although it appears to be in the very early stages of development.

Because the new feature is not yet ready for testing, it’s unlikely that those enrolled in the WhatsApp beta program will get it even after updating to the latest version of the app.

However, a preview of the feature is provided by WABetaInfo, so here is how it works. If you’re the event organizer in a Community group, you’ll be able to set a cover for it.

It’s important to mention that you have to be the admin of that group in order to be able to set a cover for an upcoming event. It makes it easier to be reminded of an upcoming event and offers a much more appealing overall experience for members of Community groups.

Add a cover photo to an upcoming event, Credits - WABetaInfo - WhatsApp working on a small, yet very useful new feature for Community groups

Add a cover photo to an upcoming event, Credits – WABetaInfo

The new feature masterfully augments some of the previous features specifically designed for Community groups, which WhatsApp is currently working on. For instance, we reported not long ago that WhatsApp plans to add an event reminder feature for Community group chats. Not to mention the ability to actually create events, which was first spotted in Q4 2023.

All these new features and key improvements suggest that WhatsApp has decided to focus many of its resources on Community groups. Let’s see how and when these exciting new features will be implemented.

[ad_2]
Source link

Beware of Fake KMSPico Activators that Deliver Vidar Stealer Malware

andreasc
-
0
Beware of Fake KMSPico Activators that Deliver Vidar Stealer Malware
[ad_1]

Researchers detected an attack involving a fake KMSPico activator tool, which delivered Vidar Stealer through several events.

The attack leveraged Java dependencies and a malicious AutoIt script to disable Windows Defender and decrypt the Vidar payload via the shellcode.

The user performed a web search for KMSPico and browsed to the top result (kmspico[.]ws), which is marketed as a “universal activator” for Windows but appears to no longer be maintained.

The site is hosted behind Cloudflare Turnstile and requires human input to download the final Zip package, a tactic to hide the page and final payload from automated web crawlers.

fake KMSPico activator
fake KMSPico activator

The Malicious Package

The ZIP archive contains Java dependencies and the malicious executable Setuper_KMS-ACTIV.exe.

Analyze any MaliciousURL, Files & Emails & Configuration With ANY RUN : Start your Analysis

Upon launching the executable, javaw.exe starts, disabling behavior monitoring in Windows Defender and dropping the malicious AutoIt script named “x” along with AutoIt named Flour.pif.

AutoIt named Flour.pif.
AutoIt named Flour.pif.

The AutoIt script contains the encrypted Vidar payload that will be injected into the current running AutoIt process.

The shellcode is responsible for decrypting the Vidar payload using the RC4 decryption algorithm, which is obfuscated by a hardcoded key in the malicious AutoIt script.

malicious AutoIt script.
malicious AutoIt script.

The Command and Control Infrastructure

Vidar Stealer uses Telegram for the Dead Drop Resolver (DDR) to store the C2 IP address.

Dead Drop Resolver (DDR) to store the C2 IP address
Dead Drop Resolver (DDR) to store the C2 IP address

Threat actors use a dead drop resolver to host command and control (C2) information on legitimate external web services. They embed and often obfuscate domains or IP addresses within content posted on sites and popular applications such as Telegram and Stealer, thus concealing the C2 infrastructure.

The Response

eSentire’s 24/7 SOC Cyber Analysts team isolated the affected host and notified the customer of suspicious activities, providing additional support and remediation.

This incident reminds us that malware-laden applications, particularly greyware piracy tools, are hidden in plain sight among web search results. It stresses the importance of user awareness to guard against such threats.

Using a fake KMSpico activator tool as a malware delivery vector highlights the importance of avoiding illegal software activators and ensuring that all software is obtained from legitimate sources.

The attack, which leveraged Java dependencies and a malicious AutoIt script to disable Windows Defender, underscores the necessity of maintaining up-to-date security software and implementing additional layers of defense to detect and prevent such malicious activities.

Recommendations

eSentire’s Threat Response Unit (TRU) recommends implementing the following controls to help secure your organization against Vidar Stealer malware:

  1. Confirm that all devices are protected with Endpoint Detection and Response (EDR) solutions.
  2. Implement a Phishing and Security Awareness Training (PSAT) program that educates and informs your employees on emerging threats in the threat landscape.
  3. Encourage employees to use password managers instead of web browsers’ password storage features. Use master passwords where applicable.

Organizations can better protect themselves against the ever-evolving threat landscape by staying vigilant and following these recommendations.

Looking for Full Data Breach Protection? Try Cynet's All-in-One Cybersecurity Platform for MSPs: Try Free Demo 


[ad_2]
Source link
1...156157158...1,480Page 157 of 1,480