Renata Cardoso

Threat actors are targeting internet-exposed MSSQL servers via SA account brute forcing to deploy XMRig miners using xp_cmdshell and multi-layered persistence.

Threat actors are utilizing a Black Basta-style playbook involving email bombing and Microsoft Teams vishing to deliver Xray-core implants via DLL sideloading.

Gunra is a sophisticated RaaS variant derived from Conti source code that utilizes Fortinet exploits and multi-threaded encryption to target global critical infrastructure.

Lazarus Group exploited a zero-day vulnerability in the Windows AppLocker driver (CVE-2024-21338) to deploy an updated FudModule rootkit for kernel-level security disruption.

Nightmare Eclipse released ShieldBreak, a zero-day exploit bypassing previous patches to achieve SYSTEM privileges by exploiting a race condition in the Microsoft Malware Protection Engine.

Direwolf is an emerging ransomware group using custom Golang-based malware and double-extortion tactics to target global organizations, particularly in the manufacturing and technology sectors.

Adversaries are leveraging NTFS Alternate Data Streams (ADS) to execute malware, which causes Windows to store Prefetch artifacts within secondary streams, effectively hiding execution evidence from standard forensic tools. https://attack.mitre.org/techniques/T1564/004/

The PhantomEnigma campaign leverages compromised Brazilian .gov.br infrastructure to deliver a modular Node.js backdoor aimed at banking credential theft.

An unprivileged user can exploit a logic flaw in the Windows Installer service to delete arbitrary folders as SYSTEM and subsequently execute code by planting malicious rollback scripts.

Educational writeup documenting various SQL Injection (SQLi) techniques, including UNION-based, blind, error-based, and out-of-band exfiltration targeting common SGBDs.