𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮

Producer of 3rd Party ClamAV signatures.

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

@smica83 @abuse_ch @nextronresearch @cod3nym @cyb3rops Just added detection to phish.ndb ( Sanesecurity: ClamAV 3rd party signatures ). Thanks for the heads up.

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

#qnap #CVE-2024-3094 #XZBackdoor #xzutils QNAP users should be OK.
https://t.co/8aHZQoPRb1

running "xz --version" is not a good idea.

for f in $(type -ap xz); do echo "File:" $f "version:" $(strings "$f" | grep -F "xz (XZ Utils)" | cut -d " " -f 4); done

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Sanesecurity

https://t.co/VxmACTjYYw
to
Sanesecurity
https://t.co/JuDfS59wos added

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Added yesterday ... and additional sigs today to detect the xz backdoor fallout...

https://t.co/2X6w4wQqqs.badliblzma
https://t.co/hdlu9cIycZ.badxz
https://t.co/BV2muP4zBq

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Just re-enabled uodates on @[email protected].

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Need a quick check for #3cx compromise... use this database https://t.co/Z29yRUHy5Z

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Example of sig update notifications over on: @[email protected]

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Signature update notifications are now being pushed out on [email protected] via the Fediverse's fab api 🔥

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Yes, Sanesecurity is also now on [email protected] 🐦

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

A new phishing campaign abuses OneNote documents to infect computers with the infamous AsyncRAT malware, targeting users in the U.K., Canada and the U.S.

All these being blocked with:

Sanesecurity.Malware.28733.Heur.BadOne.Hta.UNOFFICIAL

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
CVE-2022-30190 is being detected using phish.ndb 👍

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

So far... 24 hours and site still not taken down by https://t.co/JMA24QqEH3 😩

Detail:

https://refund dot care/subscription-cancel.php

Fake address...

Mailing Address:xx00 E. Union Ave
Suite 1100. Denver, CO 80237

support at https://t.co/EkO4CGUVj4

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

@SecurityRandom @Hexacorn @R0h1rr1m We are still updating every hour ✅

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Lowest of the low example... Received... Url reported for takedown... Sig made.

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

@LaravelAcademy Hi... All sorted in the next update in a few minutes. Thanks for the report.

[JAMESWT @JAMESWT_WT]

@CertPa @guelfoweb @VirITeXplorer @Certego_IRT @D3LabIT @malwrhunterteam @reecdeep @58_158_177_102 @sugimu_sec @BleepinComputer @a_de_pasquale @peterkruse #amazing work @Libraesva @rsaccani

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Sigs updated: 19:17:24 : jurlbl.ndb:1, jurlbla.ndb, blurl.ndb, bofhland, porcupine, #sanesecurity #clamav

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Sigs updated: 18:17:28 : jurlbl.ndb:2, jurlbla.ndb, blurl.ndb, phishtank, #sanesecurity #clamav

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Sigs updated: 17:17:33 : jurlbl.ndb:1, jurlbla.ndb, blurl.ndb, bofhland, porcupine, #sanesecurity #clamav

[𝙎𝙖𝙣𝙚𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 @sanesecurity]

Sigs updated: 16:17:34 : rogue.hdb:2, jurlbl.ndb:2, jurlbla.ndb, blurl.ndb, porcupine, #sanesecurity #clamav