🚨 Detection coverage for CVE-2025-21298:
🤝 h/t to our friends at @delivr_to for their excellent detection work: https://t.co/DTPxTbHOVe 💪
🔍 @sublime_sec 's existing rule flags this too: https://t.co/8nlY30SBtL
Scammers are using distribution lists to hide their tracks while blasting a wide range of targets in this new variant of Living Off the Land (LOTL) + callback phishing attacks.
We’ve seen it with trusted brands like Microsoft, Venmo, and PayPal. Learn how the scam works: https://t.co/hl1fzvTw7m
New @sublime_sec rule out for this, utilizing our ability to run YARA rules on attachments: https://t.co/moYEOwtxiK
Looking back, we've seen this technique in use for some time. FWIW, Office does warn you that the document is corrupted, and only to click "yes" if you trust it.
🚨ALERT: Potential ZERO-DAY, Attackers Use Corrupted Files to Evade Detection 🧵 (1/3)
⚠️ The ongoing attack evades #antivirus software, prevents uploads to sandboxes, and bypasses Outlook's spam filters, allowing the malicious emails to reach your inbox
The #ANYRUN team discovered that as part of this #zeroday attack, threat actors attempt to conceal the file type by deliberately corrupting it, making it difficult for certain security tools to detect
📌 Our sandbox solves this problem thanks to interactivity. It launches these broken files in their corresponding programs, which allows it to identify #malicious behavior
See example:
https://t.co/8MFElzg47r
🚫 Although these files operate successfully within the OS, they remain undetected by most security solutions due to the failure to apply proper procedures for their file types
They were uploaded to VirusTotal, but all antivirus solutions returned "clean" or “Item Not Found” as they couldn't analyze the file properly
EML attachments are a clever way to bypass traditional analysis because they automatically get rendered and embedded in the original message, without user interaction, by most mail clients:
https://t.co/89vpok3qqW
h/t @amitchell516
Am I the only one who thinks 7 years of OS updates is just completely unnecessary? It feels like it’s just for marketing.
That would be like the original Pixel running Android 14. Completely impractical, and a terrible experience.
why make employees suffer with these useless assessments, when you could invest in better email security
punishing employees for failing phishing tests is not the answer...
Recently had to do @KnowBe4's "Security Awareness Proficiency Assessment", and I've got to say, I think it's actively harmful to improving security.
Let's look at the questions
If you're running @sublime_sec, you can prevent this at your email perimeter. @delivr_to put out a detection for the WinRAR vuln when the CVE initially dropped: https://t.co/AJovKYMLzW
someone in GN Sensors Early Access just asked if their beefy 16gb ram server would be enough to run a GreyNoise sensor👀
512mb ram to run literally anything from lighttpd to Microsoft Exchange and beyond.
if it can run wireguard and iptables, itll run.
https://t.co/rScxOkQRG7
This is so sick. Email -> Attached EML -> Embedded image -> OCR -> NLU to identify a financial request. Outlook/many clients will render an attached EML in the *original* message, making this an effective evasion technique. We've seen this in the wild recently. h/t @amitchell516