By Arianne Dela Cruz, Jay Nebre and Augusto Remillano II As the value of cryptocurrencies increased (after a short dip in 2018), we observed increased activity from cryptocurrency mining malware this year, particularly infections and routines involving Monero miners. Over a span of a few months, we came across an […]
Security
29 posts
By Vickie Su, Anita Hsieh, and Dove Chiu Waterbear, which has been around for several years, is a campaign that uses modular malware capable of including additional functions remotely. It is associated with the cyberespionage group BlackTech, which mainly targets technology companies and government agencies in East Asia (specifically Taiwan, […]
Microsoft released a total of 36 patches for December’s Patch Tuesday. Decembers tend to have a relatively low number of patches, and the last Patch Tuesday of the 2010s was no different. Seven of the 36 patches were identified as Critical, 28 Important, and one Moderate. The vulnerabilities covered a […]
by William Gamazo Sanchez and Joseph C. Chen In November 2019, we published a blog analyzing an exploit kit we named Capesand that exploited Adobe Flash and Microsoft Internet Explorer flaws. During our analysis of the indicators of compromise (IoCs) in the deployed samples that were infecting the victim’s machines, […]
We found a new spyware family disguised as chat apps on a phishing website. We believe that the apps, which exhibit many cyberespionage behaviors, are initially used for a targeted attack campaign. We first came across the threat in May on the site http://gooogle[.]press/, which was advertising a chat app […]
It’s no secret that as the security landscape becomes increasingly complex, resources are becoming harder and harder to find. Team members with high-tech skills and experience are both difficult to hire and retain, as security threats overwhelm them and dampen morale. CISOs have to prioritize detection, analysis, and coordinated responses, […]
Executive summary As part of a recent IoT hacking training exercise, a number of Rapid7 penetration testers set out to identify vulnerabilities in a number of children’s GPS-enabled smart watches under the guidance of IoT Research Lead Deral Heiland. Three different brands of watches were purchased from Amazon: Children’s SmartWatch, […]
Today we come to the end of 2019’s monthly Microsoft Patch Tuesday (also known as Update Tuesday). This Christmas, Microsoft presents us with 36 vulnerabilities (that’s two less than this time last year!) and no new vulnerabilities from Adobe for Adobe Flash. Unfortunately, despite a light month, there’s still action […]
What is a vulnerability risk management program? A vulnerability risk management program is imperative at any organization to secure assets, but how do you actually reduce risk in your technology environment? In order to understand how to reduce risk in any organization, you first have to understand the vulnerability risk […]
At Rapid7 Labs we are always on the look for new research topics and fields to stick our fingers in and play around with. Over the last few months I was able to dive deeper into the topic of Industrial Control Systems. During this research, I accidentally found a Denial […]
A fast web fuzzer written in Go.Heavily inspired by the great projects gobuster and wfuzz. Features Fast! Allows fuzzing of HTTP header values, POST data, and different parts of URL, including GET parameter names and values Silent mode (-s) for clean output that’s easy to use in pipes to other […]
This is a tool used to collect various intelligence sources for a given file. Fileintel is written in a modular fashion so new intelligence sources can be easily added.Files are identified by file hash (MD5, SHA1, SHA256). The output is in CSV format and sent to STDOUT so the data […]
Pretend to be busy or waiting for your computer when you should actually be doing real work! Impress people with your insane multitasking skills. Just open a few instances of genact and watch the show. genact has multiple scenes that pretend to be doing something exciting or useful when in […]
An antivirus maker discovered a bug in the decrypter application of the Ryuk Ransomware, the application “the Ryuk gang” basically provides to victims to recoup their files, after they paid the ransom. While the bug causes a deficient recuperation of certain types of documents, prompting data loss, regardless of whether […]
A player of popular gaming title Elder Scrolls Online recently took to Reddit to warn users of a phish via Playstation messaging. This particular phishing attempt is notable for ramping up the pressure on recipients—a classic social engineering technique taken to the extreme. A terms of service violation? In MMORPG […]