Infinix shows off its color-changing phone concept at MWC

andreasc
-
0
Infinix shows off its color-changing phone concept at MWC
[ad_1]

The Mobile World Congress (MWC) is going on right now, and some of our favorite brands but showing off the latest and greatest devices, technology, and concepts. Infinix is a brand it’s not known by too many people, but it made an appearance at the show. According to a new report, Infinix showed off its color-changing concept phone at MWC. And, looks pretty cool.

Not too many people know about Infinix in the West, but it definitely deserves more recognition. The company made the Infinix Note 30 Pro, a very well-reviewed device that we had the honor of reviewing last year. You can check out our Infinix Note 30 Pro review if you want to see why it gained a five-star score.

Infinix shows off its color-changing phone concept at MWC, and it looks pretty cool

Back in 2021, Infinix gave us a look at its color-changing phone concept, and it definitely caught our attention. It was a phone with a monochromatic display on the back. The display was an E-Ink display that could display different patterns.

This time around, Infinix brought us much the same thing; however, it decided to add color. Looking at the demonstration below, we see the back divided into distinct rectangular sections. Each section looks like a giant pixel and can be triggered independently. 

Because of this, the phone can generate patterns on the back. With as large as these sections are, you couldn’t realistically expect them to form a picture. However, they appear to just be a way to decorate the back of the phone. Say, you want to have a blue device, well, you could change the back panel to blue. If you change your mind and want to switch to red, you could do so.

Since we’re only looking at a concept phone in the video above, it’s not reflective of any final product that Infinix could produce. In the video, we see a diamond pattern in the middle that does not change with the rest of the colors. That section is actually fixed and does not change.

If Infinix does pursue an actual product with this technology, we could probably expect it in the next couple of years.


[ad_2]
Source link

Infinix unveils CoolMax tech for gaming phones, could debut with GT Ultra

andreasc
-
0
Infinix unveils CoolMax tech for gaming phones, could debut with GT Ultra
[ad_1]

At the ongoing MWC 2024, Infinix has introduced its new flagship cooling technology called CoolMax. Designed specially for high-end gaming smartphones, the brand’s new tech claims to reduce temperature by over 10 degrees Celsius. In addition, the company has also revealed plans to launch its first dual-core flagship gaming smartphone this year. The handset in question is expected to be called the Infinix GT Ultra and could utilize the new CoolMax cooling technology.

CoolMax tech is touted to reduce temperatures by 10 degrees Celsius

Infinix’s CoolMax cooling technology utilizes Thermal-Electric Cooling and the Peltier effect to reduce the heating on gaming smartphones. The tech integrates both a cooling fan and thermoelectric cooling in a phone to achieve this feat. Both the Thermal-Electric Cooling and Peltier effect tech dynamic duo work together to keep the SoC temperature in check. Notably, the brand claims this cooling approach is capable of slashing temperatures by up to 10 degrees Celsius.

Furthermore, Infinix’s CoolMax cooling technology works in tandem with its AI algorithm. The AI algorithm dynamically adjusts large cores for heavy tasks and switches to the smaller/medium cores for lighter operations.

“This AI-driven optimization ensures the chipset operates at peak efficiency without constantly running at maximum performance, leading to reduced heat generation and lower temperature levels. The integration of AI not only enhances gaming experiences but also contributes to energy savings and effective thermal management”, stated the brand in the press release.

Infinix’s gaming phone with CoolMax tech and Dimensity 9300 SoC achieves an AnTuTu benchmark score of over 2 million

Infinix said that it tested the CoolMax tech on a concept gaming smartphone powered by the MediaTek Dimensity 9300 SoC. The device managed to achieve a whopping AnTuTu benchmark score of over 2 million points, 22,156,639 to be precise. Infinix says that it pulled off this major score thanks to its CoolMax cooling system.

Infinix Coolmax concept phone antutu score

The concept gaming phone also flaunts a Pixelworks visual processor, which works alongside the Immortalis-G720 GPU to amplify frames. Notably, this device is capable of offering 180Hz at FHD+ resolution and 144Hz at QHD+.

Infinix is likely to offer its upcoming gaming smartphone with the Dimensity 9300 SoC, CoolMax tech, G720 GPU, and AI enhancements. While it’s not officially revealed, the handset could be called the Infinix GT Ultra. We will know for sure in the near future, so stay tuned for regular updates.


[ad_2]
Source link

14-Year-Old CMS Editor Flaw Exploited to Hack Govt & Edu Sites

andreasc
-
0
14-Year-Old CMS Editor Flaw Exploited to Hack Govt & Edu Sites
[ad_1]

Hackers have exploited a vulnerability in a 14-year-old Content Management System (CMS) editor, FCKeditor, to launch SEO poisoning attacks against government and educational websites worldwide.

This campaign has compromised numerous sites, redirecting unsuspecting users to malicious or scam websites through open redirects and poisoned search results.

Open redirects are a critical flaw where websites redirect users to external URLs without proper validation, making them a prime target for cybercriminals.

These redirects are particularly dangerous because they originate from legitimate domains, allowing attackers to bypass security filters and trick users into visiting malicious sites.

This technique has been effectively used to perform phishing attacks, distribute malware, and scam users while maintaining the appearance of legitimacy.

You can analyze a malware file, network, module, and registry activity with the ANY.RUN malware sandbox, and the Threat Intelligence Lookup that will let you interact with the OS directly from the browser.

FCKeditor: The Target of Choice

The focal point of this campaign is the outdated FCKeditor plugin, a web text editor popular for editing HTML content directly within web pages.

Despite being rebranded as CKEditor in 2009 with significant improvements, many sites continue to use the deprecated version, especially in the education and government sectors.

Cybersecurity researcher @g0njxa uncovered the campaign after noticing Google Search results for ‘Free V Bucks’ generators hosted on university sites, revealing the extent of the exploitation.

Malicious Google Search results
Malicious Google Search results 

Educational and Government Sites Compromised

The campaign has not spared prestigious institutions and government entities. Among the affected are MIT, Columbia University, Universitat de Barcelona, Auburn University, University of Washington, Purdue, Tulane, Universidad Central del Ecuador, and the University of Hawaiʻi.

Government and corporate sites, including those belonging to Virginia, Austin, Texas, Spain, and Yellow Pages Canada, have also been targeted, utilizing a combination of static HTML pages and redirects to malicious sites.

In SEO poisoning, attackers manipulate search engine results to promote malicious websites.

By leveraging the trust and authority of compromised domains, these actors can poison search engine results, leading unsuspecting users to scam sites, fake news articles, phishing pages, and malicious browser extensions.

This not only endangers users but also tarnishes the reputation of the compromised sites.

FCKeditor Deprecated

The software maker has responded to the open redirects campaign, emphasizing that FCKeditor has been deprecated since 2010 and should no longer be in use.

However, the persistence of this outdated software on critical sites highlights the broader issue of legacy systems and their vulnerabilities.

It’s a stark reminder for organizations to update and patch their systems to protect against such exploits.

The software maker responded to the open redirects campaign report on X, saying that FCKeditor has been deprecated since 2010 and nobody should be using it anymore.
The software maker responded to the open redirects campaign report on X, saying that FCKeditor has been deprecated since 2010 and nobody should use it anymore.

This campaign underscores the importance of maintaining up-to-date software and the need for vigilance against sophisticated cyber threats.

As attackers continue to exploit vulnerabilities in outdated systems, website administrators and users are responsible for ensuring the security of their digital environments.

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are extremely harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


[ad_2]
Source link

Identity theft is number one threat for consumers, says report

andreasc
-
0
Identity theft is number one threat for consumers, says report
[ad_1]

The German Federal Office for Information Security (BSI) has published a report on The State of IT Security in Germany in 2023, and the number one threat for consumers is… identity theft.

The thing is, you can protect your devices and your online privacy as much as possible, but what happens when some organization which you have trusted with your personal information gets breached?

The report states:

“For consumers, the issue of data leaks was prominent in the reporting period (2023). In many cases, these were related to ransomware attacks, in which cybercriminals exfiltrated large amounts of data from organizations in order to later threaten to publish it unless a ransom or hush money was paid.“

In addition to data breaches, there is the danger of information stealers that allow cybercriminals to obtain various types of personal data, such as login details for various online services, and financial information. The stolen data may also include website cookies and biometric data that can be used by criminals to defraud the victim.

Cybercriminals are also getting better at using these data. For example, the report mentions that on one of the largest underground marketplaces for identity data, cybercriminals offered interested parties a browser plug-in that made it possible to import stolen credentials directly into the web browser, allowing criminals to assume the victim’s digital identity with just a few clicks.

We’ve previously talked about the dangers of data brokers that, by trading and buying, are accumulating massive troves of personal data. Now, with the mass availability of Artificial Intelligence tools, it becomes so much easier to correlate all these data sets and piece together a complete profile of everyone affected.

As you can see, it’s usually not the victim’s fault that their data become available to cybercriminals. In many cases, there isn’t even that much that they could have done about it. Some services simply are not available in the offline world anymore, and we have no choice than to trust an organization with our information.

So, all we can do is make sure we come prepared to act when a data breach affects us, and keep an eye on how much we share and how much others will be able to find out about us.

What to do in the event of a data breach

  • Check the vendor’s advice. Every breach is different, so check with the vendor to find out what’s happened, and follow any specific advice they offer.
  • Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
  • Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
  • Watch out for fake vendors. The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify any contacts using a different communication channel.
  • Take your time. Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
  • Set up identity monitoring. Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

If you want to find out how much of your own data is currently exposed online, you can try our free Digital Footprint scan. Fill in the email address you’re curious about (it’s best to submit the one you most frequently use) and we’ll send you a report.

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using Malwarebytes Identity Theft Protection.


[ad_2]
Source link

Samsung shows off Cling Band, a smartphone you can wear

andreasc
-
0
Samsung shows off Cling Band, a smartphone you can wear
[ad_1]

Samsung always showcases some innovative display concepts and prototypes at major global tech events. The company brought a handful of such futuristic display products to the Mobile World Congress (MWC) 2024. The most eye-catching of the lot was the Cling Band, a bending smartphone that you can wear on your wrist.

Samsung hints at the future of phones with its Cling Band

AH Samsung Cling band image 1

The Samsung Cling Band is sort of a smartphone and smartwatch combined into one device. It features a flexible OLED display as big as a regular smartphone. But it is so flexible that you can wrap it around your wrist, making a watch with a huge display. The company has used a ridged structure on its body, including the backside, to make the whole thing bend such that it forms a domed bridge on your wrist.

The concept product shown at the MWC 2024 in Barcelona featured a USB Type-C port and a speaker grille at the bottom. We could also see a single camera and a heart rate sensor on the back. The addition of a heart rate sensor makes it ideal to wear as a watch to track heart rate and other health metrics. Of course, it would be uncomfortable to wear a bulky device on the wrist for a long time, but we are talking about a concept device here.

Samsung is showcasing its flexible OLED technology more than the device itself. However, the Cling Band could be a product for the future. As we push to make our smartwatch screens bigger, it might not be out of the possibility to see a device that can double up as a smartphone and a watch in a few years. Motorola also showcased a similar device at the MWC 2024, so there is interest in this tech from multiple players.

Samsung mounted an OLED screen onto headphones, earbuds, and speakers

Samsung’s display booth at the MWC 2024 also featured more such innovative concepts. The Korean firm mounted OLED screens onto the charging case for TWS earbuds, over-ear headphones, smart speakers, smart car keys, golf ball markers, and other devices. These displays can show the battery level of the device, media playback controls, and other information. The OLED golf ball marker can connect with other devices to show the incline and distance to the hole. It remains to be seen which of these futuristic products sees the light of day first.


[ad_2]
Source link

smart glasses, fitness ring, and more

andreasc
-
0
smart glasses, fitness ring, and more
[ad_1]

Within the wearable space, there are reports that Apple is currently examining new designs for its products. According to Mark Gurman’s Power On newsletter, some of the possible concepts Apple is studying include smart glasses, integrating cameras into AirPods, and developing a smart ring

Concepts: Apple smart glasses and camera-embedded AirPods

The rumored smart glasses are likely to mimic Amazon Echo Frames and Meta Ray-Bans with intelligent sound features and AI functions. These represent an interim step before more ambitious augmented reality glasses could take over. The smart glasses being more accessible than Apple’s Vision Pro is a profitable route for the company.

One of the more interesting projects described in the Newsletter is the reimagined AirPods. The new design embeds low-resolution camera sensors inside the earbuds. This project began last year and aims to make AI and health seamlessly fit into people’s lives using multimodal voice-and-image AI systems. Such a system can recognize objects for the user in their field of vision, similar to Meta x Ray-Ban glasses.

The AirPods with built-in cameras demonstrate a direction toward stealthy yet potent AI-integrated wearable gear. As far as embedded AI cameras go, smart glasses could have better capture quality and longer battery life, though, at the same time, they would be more conspicuous.

Apple fitness ring with health-sensing features

Furthermore, Apple is also mulling over a smart ring design that might offer health-sensing capabilities to customers unwilling to wear bulkier devices like the Apple Watch. 9to5Mac expands on the topic and suggests that Smart glasses, in a similar vein, will help ease the flow in Apple’s ecosystem, liberating users from constant interactions with handheld devices. Although undisclosed, there are more innovative ideas on the company’s drawing board. And we will be hearing about those soon.

These initiatives are only commencing now, therefore, it would be too early to predict where Apple is going with its wearable tech portfolio. For now, these projects are internal developments with no market releases expected in the near future. These revolutionary wearables will remain speculative until Apple suggests otherwise.


[ad_2]
Source link

ResurrecAds Attack Hijacks Brand Names, Spreads Spam Via ‘SubdoMailing’

andreasc
-
0
ResurrecAds Attack Hijacks Brand Names, Spreads Spam Via ‘SubdoMailing’
[ad_1]

Hackers hijacked subdomains of major brands like eBay and CBS to send spam emails disguised as legitimate messages – Learn how to protect yourself from these deceptive phishing attempts.

Guardio Labs is monitoring a campaign called SubdoMailing, which has been circulating spam and phishing emails since September 2022. The campaign, attributed to a threat actor called ResurrecAds, manipulates the digital advertising ecosystem by resuscitating dead domains associated with big brands – A malicious practice also known as Brand Hijacking.

The scam was detected after Guardio Labs’ email protection systems discovered unusual patterns in email metadata mainly related to SMTP servers that are authenticated as legitimate senders. This led Guardio to launch an investigation into the SMTP protocol, domain hunting, and DNS scanning tools. 

The ResurrecAds incident mirrors a prior case where, in November 2022, cybersecurity researchers at Cyjax uncovered 42,000 phishing domains posing as well-known brands, distributing malware for ad revenue.

The team discovered an unprecedented subdomain hijacking operation, where thousands of hijacked sub-domains were used to send spammy and malicious emails, falsely authorized under international brands. The campaign uses the trust in these domains to circulate spam and phishing emails, bypassing security measures.

The emails can also circumvent the Sender Policy Framework (SPF), an email authentication method, and pass DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC) checks to prevent messages from being marked as spam.

ResurrecAds Attack Hijacks Brand Names, Spreads Spam Via 'SubdoMailing'

Guardio researchers discovered over 8,000 domains from renowned brands/institutions (MSN, VMware, McAfee, The Economist, Cornell University, CBS, Marvel, eBay). Researchers dubbed this activity “SubdoMailing,” which exploits users’ trust to circulate spammy phishing emails.

They called it a classic subdomain hijacking scheme because it involves scanning and enumerating domains for forgotten subdomains, registering them, and using SPF records to send malicious emails. This can lead to unauthorized access to SMTP servers and valuable assets for hackers.

The sample email researchers analyzed was disguised as an image to bypass spam filters, trigger click-redirects through various domains, targeting device type and location to display content tailored to maximize profit. This unique scheme raises questions about how it bypasses authentication and security checks with major email providers.

The evidence suggests a single threat actor, “ResurrecAds,” is responsible for a large-scale operation scanning the internet for “vulnerable domains, identifying opportunities, purchasing domains, securing hosts and IP addresses, and orchestrating email dissemination,” researchers noted.

Their strategy involves reviving domains affiliated with big brands, exploiting legitimate services and brands, and circumventing email protection measures, demonstrating their sophisticated technical sophistication.

ResurrecAds Attack Hijacks Brand Names, Spreads Spam Via 'SubdoMailing'
One of the examples of an abandoned domain being abused in the scam (Credit: Guardio Labs)

The study revealed thousands of active cases of CNAME-takeover and SPF-takeover, which involve stealing abandoned domains of old email/marketing services. These attacks have been ongoing for at least two years, allowing attackers to easily inject their IPs into the domain’s SPF records using the main domain name as the sender.

“Given these sophisticated tactics, we’re clearly facing a formidable operation characterized by significant expenditure and substantial revenue.”

Researchers have launched a “SubdoMailing” checker website, enabling domain administrators and site owners to quickly identify and address any abuse detected, ensuring domain security.

  1. Brand Protection is Essential for Cybersecurity
  2. How to Increase Your Business’s Online Brand Awareness
  3. Memcyco Introduces Real-Time Solution to Combat Brandjacking
  4. Check Point Research: Microsoft the Most Phished Brand in Q2 2023
  5. Microsoft, PayPal, Facebook most targeted brands in phishing scams

[ad_2]
Source link

Next-gen OPPO Find flagships will go global: Official

andreasc
-
0
Next-gen OPPO Find flagships will go global: Official
[ad_1]

Next-gen OPPO Find flagships will go global, the company has confirmed. When I say “go global”, I mean come in global variants, and launch at least in Europe. At least that’s the information the company shared.

Next-gen OPPO Find flagships will go global, the company has confirmed

This comes from the company executives who confirmed the news during MWC 2024, GSM Arena reports. This unfortunately means that the OPPO Find X7 Ultra won’t get a global variant, unfortunately.

The OPPO Find X7 Ultra is one of the best smartphones we’ve used to date. It has been highly praised since its launch for a good reason. It’s a real shame it did not launch globally. Now we basically know that it won’t arrive in a global variant at all.

That being said, the exact words that OPPO executives used were “upcoming gen of Find series”. We’re not sure if they meant the OPPO Find X8 series or the OPPO Find N4 series. If we had to guess, I’d say that the OPPO Find X8 series.

Why? Well, the OPPO Find N3 did arrive in a global variant. It launched instead of the OnePlus Open in a number of markets, and we’ve reviewed that model with global software. It arrived to the Phillippines, for example.

The company’s execs were almost certainly talking about the OPPO Find X8 series

So, considering that there is already a global variant of the Find N3, it’s safe to assume that the Find N4 will arrive to global markets too. That’s probably not what the executives meant. I’m pretty sure they were referring to the OPPO Find X8 series.

The bad news is, however, that the OPPO Find X8 series is not expected to launch until January next year. So we’re in for quite a wait. You can still try to import the OPPO Find X7 Ultra, though, as it works perfectly fine once you install the Google Play Store.

There are some limitations that come with the software made for China, but not nearly as much as on some other devices


[ad_2]
Source link

FTC fined Avast $16.5 million for selling user data

andreasc
-
0
FTC fined Avast $16.5 million for selling user data
[ad_1]

The Federal Trade Commission (FTC) has slapped antivirus maker Avast with a fine of $16.5 million for selling customer data to third parties without their consent. The Commission has also banned the firm from selling user information for advertising purposes. The cybersecurity software company has already shut down its subsidiary, called Jumpshot, which harvested and sold user data.

Avast fined $16.5 million for selling user data to third parties

The news of Avast selling the browser history of its customers broke out in January 2020. The company harvested the data of its users through Jumpshot and sold it to advertisers. A public and media backlash ensued and the firm responded by promptly shutting down its subsidiary. While Avast claimed all data was “de-identified” before selling to third parties, reports suggest it could be linked back to people’s real identities in some instances.

Investigations revealed that the antivirus company harvested and sold user data from at least 2014 to 2020. Jumpshot reportedly collected data from as many as 100 million devices and sold it to more than 100 third parties operating as digital advertisers, marketing and data analytics companies, and data brokers. Information sold included users’ web searches, the web pages they visited, and every click on the website.

According to the FTC, Jumpshot signed contracts with advertising firms to provide an “All Clicks Feed” for Avast users. It permitted the firms to “associate Avast’s data with data brokers’ sources of data, on an individual user basis.” This enabled advertisers to track users more precisely by combining data from two sources. Effectively, they could show more tailored ads and other products to those users.

It was a massive breach of privacy and trust from a company entrusted to protect people online. “Avast promised users that its products would protect the privacy of their browsing data but delivered the opposite,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, in an official press release from the Commission. “Avast’s bait-and-switch surveillance tactics compromised consumers’ privacy and broke the law.”

Avast must delete user information transferred to Jumpshot

Along with a $16.5 million fine, the FTC has ordered Avast to delete the web browsing information transferred to Jumpshot. It also must delete any products or algorithms its now-defunct subsidiary derived from that data. Additionally, the firm is banned from selling or licensing any browsing data from its products to advertisers. It needs to obtain affirmative express consent from consumers before selling data from non-Avast products.

The FTC has also ordered Avast to inform consumers affected by its practice about the Comission’s actions. Last but not least, it has to implement a privacy program that addresses the misconduct highlighted by the FTC. In an official statement, Avast said it disagrees with the FTC’s “allegations and characterization of the facts.” However, it is “pleased to resolve this matter” and is committed to “protecting and empowering people’s digital lives.”


[ad_2]
Source link

Heavily Obfuscated PIKABOT Evades EDR Protection

andreasc
-
0
Heavily Obfuscated PIKABOT Evades EDR Protection
[ad_1]

PIKABOT is a polymorphic malware that constantly modifies its code, making it hard to recognize and easily bypasses the Endpoint Detection and Response (EDR) systems. 

Obfuscation, encryption, and anti-analysis techniques help the object avoid these traditional security measures. 

PIKABOT is able to avoid signature-based detection by dynamically changing its structure, which makes it harder for EDR solutions to keep up with their ever-changing behaviors.

Cybersecurity researchers at Elastic Security Labs recently discovered new and upgraded PIKABOT campaigns on February 8th.

A popular loader used by malicious actors to disseminate extra payloads is called PIKABOT.

You can analyze a malware file, network, module, and registry activity with the ANY.RUN malware sandbox, and the Threat Intelligence Lookup that will let you interact with the OS directly from the browser.

PIKABOT Evades EDR Protection

Elastic Security Labs detected a fresh instance of PIKABOT with the updated loader, new unpacking method, and heavy obfuscation for strings decryption as well as other obfuscation changes. 

The update is an indication that a new code base has been laid down for future improvements.

However, these changes are expected to break signatures and previous tools like the previous versions.

PIKABOT execution flow (Source – Elastic)

PIKABOT has been quiet during the New Year but resurfaced in February, with a campaign launched on Feb 8.

ZIP archives in emails contained hyperlinks to download obfuscated Javascript. 

The attacker altered grepWinNP3.exe, which is a legitimate tool, to appear real.

The call stack analysis traced back malicious code entering their Detonate sandbox and Elastic Defend’s call stack. 

Executions begin before offset 0x81aa7 and jump towards memory allocation at offset 0x25d84 as indicated by this last part of the previous sentence. 

There were no normal calls for process creation; instead, there were unbacked memory syscalls via shellcode evading EDR products and bypassing user-mode hooks on WOW64 modules.

In a hard-coded address for PIKABOT loader execution at offset 0x81aa7, researchers found. JMP instructions are used after each assembly line in the code to make analysis difficult because of heavy obfuscation.

This loader uses custom decryption by means of bitwise operations to recover its payload from the .text section. 

However, this can lead to any PE file not being written into a disk and executed in memory.

By doing this, on the host system, the stealth is improved by reducing the digital footprint.

The PIKABOT core is initialized by the stage 2 loader using code and string obfuscation, NTDLL Zw APIs, and advanced anti-debugging.

Moreover, the PIKABOT core makes direct system calls, allowing it to bypass EDR user-land hooking and debugging.

Besides, malware utilizes ZwQuerySystemInformation, ZwQueryInformationProcess, PEB inspection, GetThreadContext methods, and many others as techniques that are undetected by forensic and debugging tools.

The current version of PIKABOT core functions similarly with its previous releases.

However, there are some differences, such as a new obfuscation style, different string decryption processes, use of plain text configuration, and network communication changes (RC4 instead of AES). 

This binary is relatively less obfuscated but still remains familiar. The remaining in-line RC4 functions utilize legitimate strings as keys. 

Obfuscation is done through junk code insertion to confuse an analyst. While the command execution, discovery, and process injection form part of core functionality.

The Twitter user reecDeep, who specializes in malware analysis, noticed that Pikabot malware is being distributed by TA577 through HTML files.

Surprisingly, these files have not been detected by any of the antivirus programs on VirusTotal.

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are extremely harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


[ad_2]
Source link
1...380381382...1,476Page 381 of 1,476