https://www.trustwave.com/en-us/ SpiderLabs is Trustwave’s elite team of ethical hackers, forensic investigators and security researchers. Tue, 21 Mar 2023 01:36:52 +0000 Tue, 21 Mar 2023 01:36:52 +0000 en-us https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/onenote-spear-phishing-campaign/ While the malware payload can change, the techniques have generally been the same. The recent uptrend of the OneNote spear phishing campaign that SpiderLabs has observed since December 2022 has led us to additional investigations on this threat. Thu, 09 Mar 2023 00:00:00 GMT Trustwave-31526 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/a-noteworthy-threat-how-cybercriminals-are-abusing-onenote-part-1/ Threat actors are taking advantage of Microsoft OneNote's ability to embed files and use social engineering techniques, such as phishing emails and lures inside the OneNote document, to get unsuspecting users to download and open malicious files. Wed, 08 Mar 2023 00:00:00 GMT Trustwave-31511 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/a-noteworthy-threat-how-cybercriminals-are-abusing-onenote-part-2/ We examined how threat actors abuse a OneNote document to install an infostealer. Part 2 of this series discusses an AsyncRAT infection chain while detailing important parts of the code. We’ll also quickly analyze other notable malware strains such as Qakbot and RemcosRAT. Wed, 08 Mar 2023 00:00:00 GMT Trustwave-31524 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/network-map-nmap-meets-chatgpt/ We’ve now seen a number of different use cases for ChatGPT from marketing, sales, software development and others including from the security field. This platform continues to dominate most of the headlines and impress based on how it’s able to handle questions and topics from various backgrounds. Thu, 16 Feb 2023 00:00:00 GMT Trustwave-31424 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/html-smuggling-the-hidden-threat-in-your-inbox/ Last October, Trustwave SpiderLabs blogged about the use and prevalence of HTML email attachments to deliver malware and phishing for credentials. Thu, 09 Feb 2023 00:00:00 GMT Trustwave-31364 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/money-lover-app-vulnerability-exposes-personal-info/ An information disclosure vulnerability has been identified in Money Lover, a finance tracking application created by Finsify and available on Android, iOS, Microsoft Store, with a web interface. Tue, 07 Feb 2023 00:00:00 GMT Trustwave-31355 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vulnerability-causing-deletion-of-all-users-in-crushftp-admin-area/ During a recent penetration test, Trustwave SpiderLabs researchers discovered a weak input validation vulnerability in the CrushFTP application which caused the deletion of all users. Thu, 02 Feb 2023 00:00:00 GMT Trustwave-31334 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2022-43704-capture-replay-vulnerability-in-sinilink-xy-wft1-thermostat/ Trustwave SpiderLabs has found a vulnerability in the Sinilink XY-WFT1 Remote WiFi home Thermostat. When running firmware V1.3.6, it allows an attacker to replay the same data or similar data, possibly allowing an attacker to control the device attached to the relay without requiring authentication. Thu, 12 Jan 2023 00:00:00 GMT Trustwave-31261 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/2022-year-in-review-ransomware/ With 2022 having just ended, let's take a look back at the year in ransomware. With the average cost of an attack ranging from $570,00 to $812,360 for just the ransom, according to Cloudally, it should be no surprise that it continued to be one of the most prominent attacks utilized by malicious groups. We'll be doing a quick overview of a few of the most active groups within the space over the past year, and any developments that those groups have made in the past 12 months. Thu, 05 Jan 2023 00:00:00 GMT Trustwave-31226 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/malicious-macros-adapt-to-use-microsoft-publisher-to-push-ekipa-rat/ After Microsoft announced this year that macros from the Internet will be blocked by default in Office , many threat actors have switched to different file types such as Windows Shortcut (LNK), ISO or ZIP files, to distribute their malware. Wed, 21 Dec 2022 00:00:00 GMT Trustwave-31206 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chatgpt-emerging-ai-threat-landscape/ ChatGPT has been available to the public since November 30, 2022. Since then, it has made headlines – from being temporarily banned from Stack Overflow because... Tue, 20 Dec 2022 00:00:00 GMT Trustwave-31169 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/meta-phish-facebook-infrastructure-used-in-phishing-attack-chain/ Meta has two of the largest social media platforms today, Facebook and Instagram. These platforms became the modern gateway for people not just to socialize and eavesdrop on the lives of famous personalities, but more importantly, to stay connected with their friends and loved ones. Thu, 15 Dec 2022 00:00:00 GMT Trustwave-31140 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trustwave-action-response-zero-day-vulnerability-in-citrix-adc-cve-2022-27518/ On Tuesday, December 13, a joint announcement from the United States NSA and Citrix announced a zero-day vulnerability in Citrix ADC. The vulnerability (CVE-2022-27518) is a critical unauthenticated Remote Code Execution (RCE) issue currently rated as CVSS 9.8. Thu, 15 Dec 2022 00:00:00 GMT Trustwave-31142 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/going-mobile-bec-attacks-are-moving-beyond-email/ Recently, we’ve noticed an increase in user reports of SMS-based Business Email Compromise (BEC) messages. This seems to be part of a wider trend as phishing scams via text messages surge. Thu, 08 Dec 2022 00:00:00 GMT Trustwave-31080 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ Cybercriminals have long used Microsoft documents to pass along malware and they are always experimenting with new ways to deliver malicious packages. As defenders, Trustwave SpiderLabs’ researchers are always looking out for new or unusual file types, and through this ongoing research, we uncovered threat actors using a OneNote document to move Formbook malware, an information stealing trojan sold on an underground hacking forum since mid-2016 as malware-as-a-service. Formbook malware can steal data from various web browsers and from other applications. This malware also has keylogging functionality and can take screenshots. Thu, 08 Dec 2022 00:00:00 GMT Trustwave-31085 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tis-the-season-for-online-shopping-and-phishing-scams/ The 2022 holiday shopping season is here. Retailers’ discounts are kicking off early, and shoppers are eager to spend, especially with big price markdowns to come as the season progresses. And with the COVID-19 pandemic still a concern to shoppers, more people are expected to shop online this season. Thu, 01 Dec 2022 00:00:00 GMT Trustwave-31049 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/bypassing-2fa-authentication-with-evilginx2/ Due to the increasing number of cyberattacks, particularly zero days, organizations are scrambling to obtain the best security services available. While even the smallest organization might feel that implementing Two-Factor Authentication (2FA) will keep its data secure, a targeted attack from a nefarious threat actor could lure an employee into clicking and opening a malicious document. Thu, 01 Dec 2022 00:00:00 GMT Trustwave-31057 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/killnet-claims-attacks-against-starlink-whitehousegov-and-united-kingdom-websites/ Pro-Russian threat actor group Killnet claims to have launched DDoS attacks against Starlink and the United States’ government website whitehouse.gov. Starlink is a satellite internet service company operated by SpaceX. Wed, 23 Nov 2022 00:00:00 GMT Trustwave-30994 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/evolution-of-the-soc-from-the-dark-ages-to-enlightenment-shifting-to-an-agile-threat-informed-cyber-defense-program/ How important is the Security Operations Center (SOC) to a business and a security leader's overall success? Tue, 22 Nov 2022 00:00:00 GMT Trustwave-30987 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/automating-rds-security-via-boto3-aws-api/ When it comes to security in AWS, there is the shared responsibility model for AWS services, which is divided into AWS responsibility ‘security of the cloud’ and customer responsibility ‘security in the cloud’. For more detail on this please check the shared-responsibility-model. Fri, 18 Nov 2022 00:00:00 GMT Trustwave-30967 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/development-of-the-ukrainian-cyber-counter-offensive/ Russia’s military incursion against Ukraine began on February 24, 2022, with a massive ground attack supported by several cyber incidents. This activity set the stage for what would become an active hybrid war fought in two domains: cyber and ground warfare. Thu, 10 Nov 2022 00:00:00 GMT Trustwave-30913 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/denial-of-service-and-rce-in-openssl-30-cve-2022-3786-and-cve-2022-3602/ On November 1 the OpenSSL Project released patches addressing the previously rated "Critical" vulnerability that was pre-announced last week. The "Critical" rating has been downgraded to "High." Fri, 04 Nov 2022 00:00:00 GMT Trustwave-30875 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/insta-phish-a-gram/ Following Trustwave SpiderLabs’ blog on social media-themed phishing on Facebook, comes another flavor of ‘infringement’ phishing. In this case, the targets, still under the umbrella of Meta, are Instagram users. Thu, 27 Oct 2022 00:00:00 GMT Trustwave-30814 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/archive-sidestepping-self-unlocking-password-protected-rar/ Trustwave SpiderLabs’ spam traps have identified an increase in threats packaged in password-protected archives with about 96% of these being spammed by the Emotet Botnet. In the first half of 2022, we identified password-protected ZIP files as the third most popular archive format used by cybercriminals to conceal malware. Thu, 20 Oct 2022 00:00:00 GMT Trustwave-30783 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-request-body-parsing-recent-bypass-issues/ ModSecurity is an open-source web application firewall (WAF) engine maintained by Trustwave. This blog post discusses multiple input interpretation weaknesses in the ModSecurity project. Each input interpretation weakness could allow a malicious actor to evade some ModSecurity rules. Thu, 13 Oct 2022 00:00:00 GMT Trustwave-30768