u2int10

security セキュリティ 信息安全 💪(*´꒳`*)ﾑｷｯ OSCP+

[Co11ateral @co11ateral]

Chinese Backdoor for Telecom Systems

A while ago we showed the backdoor that the Chinese have been using to maintain persistence across telecom systems.

The backdoor attaches itself to a raw network socket and inspects incoming traffic. It sees packets before firewall rules have a chance to process them. So even if your firewall is configured correctly, the backdoor can still see traffic that should have been blocked.

To access the system hackers send a magic byte to get a reverse shell

We also showed how you can detect it

https://t.co/fBXtksn2Ju

@three_cube @_aircorridor #apt #redteam #blueteam

[MalDev Academy @MalDevAcademy]

We’re happy to announce that our EDR Internals & Development training is now in its final stages of development.

Over the past several months, an enormous amount of work has gone into building this highly technical & detailed training. The course covers the internals of modern EDR from both user-mode and kernel-mode perspectives, including techniques like syscall hooking, filesystem minifilters, ETW telemetry, memory scanning, kernel callbacks, process instrumentation callbacks, call stack tracing, and anti-tampering mechanisms.

The course concludes with building a limited yet functional custom EDR agent and we test it against several malware techniques to gain practical experience with detection engineering and EDR internals.

This huge undertaking would not have been possible without @GigelV41464 who dedicated countless hours to analyzing different EDR products, building custom implementations, analyzing internal mechanisms, and documenting the techniques with excellent depth and clarity.

The official launch date is scheduled for June 15, 2026 but starting today, we're opening access to an early bird discount of 20% for a limited time.

EDR Internals & Development: https://t.co/oN6qcMjLr2

[The Hacker News @TheHackersNews]

🚨 A new UNPATCHED Linux kernel “Dirty Frag” LPE flaw enables root access on Ubuntu, RHEL, Fedora and other distributions.

Researchers released a working proof-of-concept exploit capable of gaining root in a single command.

Details here: https://t.co/gxjVsS5pwo

[BleepingComputer @BleepinComputer]

CISA says ‘Copy Fail’ flaw now exploited to root Linux systems
https://t.co/k2KdOQ6lve

https://t.co/k2KdOQ6lve

[BleepingComputer @BleepinComputer]

You can learn more about these false positives and the DigiCert breach in our story:

➡️https://t.co/rPL35z0n7k

[BleepingComputer @BleepinComputer]

🚨 Warning: Microsoft Defender is wrongly flagging some DigiCert certificates as Trojan:Win32/Cerdigent.A!dha, triggering widespread false positives on Windows systems.

Admins report certificates being removed from the Windows trust store after recent Defender signature updates.

What’s happening:

🔴 Two DigiCert root certificates flagged as malware
🔴 Some systems remove certs from the AuthRoot trust store
🔴 Detection added in April 30th Defender signature updates

Microsoft has released fixes in Security Intelligence updates version 1.449.430.0.

The issue comes shortly after a DigiCert breach where attackers gained access to support systems and code-signing certificates.

If you're seeing Trojan:Win32/Cerdigent.A!dha alerts, update Defender signatures immediately.

[BleepingComputer @BleepinComputer]

New Linux ‘Copy Fail’ flaw gives hackers root on major distros
https://t.co/Ddr9lWEVpb

https://t.co/Ddr9lWEVpb

[ATT&CK @MITREattack]

ATT&CK v19 is live! We've split Defense Evasion into Stealth and Defense Impairment, introduced Sub-Techniques to ICS ATT&CK, Detection Strategies to Mobile, and added some AI and Social Engineering to Enterprise. Check out all the details in our blog post https://t.co/XHzwGHZuNX

[BleepingComputer @BleepinComputer]

Recently leaked Windows zero-days now exploited in attacks
https://t.co/4iMf09fD0d

https://t.co/4iMf09fD0d

[BleepingComputer @BleepinComputer]

New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges
https://t.co/Jb7KxMYugC

https://t.co/Jb7KxMYugC

[Heather Adkins - Ꜻ - Spes consilium non est @argvee]

An update from NIST. Due to volume they’re only going to enrich CVEs that are meaningful to USG federal systems and critical software (some more nuance in the blog post). This means if you’re relying on the NVD data for your enterprise security program and use other software, your tools may not flag software you use as at risk. https://t.co/pI2o2XootK

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

JavaScriptの主要HTTPクライアントライブラリaxiosのnpm正規アカウントが乗っ取られ、RAT（遠隔操作ツール）を投下する悪意あるバージョンが公開されていたと報告されています。npmでは同様の手口が繰り返されていますが、今回は週間8,300万回以上ダウンロードされ17万件超のパッケージが依存するaxios自体が直接の標的となりました。

偽パッケージではなく正規のaxios自体が汚染されており、通常どおりインストールするだけで感染するおそれがある状態だったとのこと。
攻撃者はGitHub Actionsを使った自動テスト・公開のパイプラインを経由せず、奪取したメンテナーアカウントのメールアドレスを匿名のProtonMailに変更したうえで、npmのコマンドラインツールから手動で公開したとされています。
リポジトリ側のコードレビューやセキュリティチェックが介在しない経路であり、検知が困難だった模様。

現在、悪意あるバージョンはnpmから削除済みですが、インストール済みの環境ではRATが動作している可能性があり、該当バージョンを導入した場合はシステムが侵害された前提での対応が推奨されています。

【攻撃手口の概要】

・汚染されたバージョンはaxios@1[.]14[.]1とaxios@0[.]30[.]4の2つ。安全な最新版はそれぞれ1[.]14[.]0と0[.]30[.]3

・攻撃者はメンテナー（jasonsaayman）のnpmアカウントの認証情報を窃取。メールをifstap@proton[.]meに変更したほか、nrwiseという別のnpmアカウントも関与が確認されている

・悪意あるバージョンにはplain-crypto-js@4[.]2[.]1という偽の依存パッケージが追加されている。axios本体からは一切参照されておらず、インストール直後に自動実行されるpostinstallスクリプトを走らせることだけが目的

・このスクリプトがmacOS・Windows・Linuxに対応したドロッパーとして機能。C2サーバー（sfrclak[.]com / 142[.]11[.]206[.]73）からOS別の第2段階ペイロードを取得

・実行後はマルウェア自身を削除し、パッケージの構成情報ファイル（package[.]json）を正規版に差し替えることで痕跡を消去。侵害調査での発見を遅らせる狙いとみられる

2025年9月以降、npmメンテナーの認証情報を起点とするサプライチェーン攻撃が繰り返し発生しています。今回もGitHub Actionsのパイプラインが迂回され、npm CLIから直接公開されていました。利用者側の予防策として、CI環境でのnpm install --ignore-scripts（インストール時のスクリプト自動実行を無効化するオプション）の利用などが挙げられています。

https://t.co/eJHqwkP5si

[ATT&CK @MITREattack]

ATT&CK v19 is coming 4/28! The biggest change this release is the replacement of the Defense Evasion tactic in Enterprise ATT&CK with new Stealth and Impair Defenses tactic. @coolestcatiknow talked more about what's changing back at ATT&CKcon 6.0 https://t.co/giWBDeDPTn.

[Panos Gkatziroulis 🦄 @ipurple]

📘 Looks like a great resource for blue teamers
🌐 Windows Event Catalog https://t.co/GRGtAIN0UR

[Florian Roth ⚡️ @cyb3rops]

This is bad.
Putty level bad.
https://t.co/3w1C8YiBu8

[piyokango @piyokango]

React Server Componentsの脆弱性 CVE-2025-55182（React2Shell）についてまとめてみた。 - piyolog https://t.co/pKbxcanlj6

[Florian Roth ⚡️ @cyb3rops]

F5 Breach
https://t.co/Fc1Se8FBCH

[CISA Cyber @CISACyber]

🚨 Nation-state affiliated threat actors have compromised F5’s systems & downloaded portions of its BIG-IP source code—posing serious risk to FCEB agencies. Follow the guidance in ED 26-01 immediately to protect systems from potential exploits. 🔗 https://t.co/cXH0W4jGZo

[CISA Cyber @CISACyber]

🚨 Cyber threat actors are exploiting newly identified zero-day vulnerabilities in Cisco Adaptive Security Appliances via web services, posing significant risk. Federal agencies must act immediately and follow the guidance in Emergency Directive 25-03. 🔗 https://t.co/4DMWopRPtr

[NSA Cyber @NSACyber]

Chinese state-sponsored actors are targeting global telecommunications and other critical infrastructure orgs. We’ve joined others worldwide to call these actors out and publish hunting & mitigation guidance to reduce this ongoing threat. https://t.co/saq1a0sT8o