Tag: windows
-
Patchwork APT: Leveraging PowerShell to Create Scheduled Tasks and Deploy Final Payload
Patchwork, the advanced persistent threat (APT) actor also known as Dropping Elephant, Monsoon, and Hangover Group, has been observed deploying a new PowerShell-based loader that abuses Windows Scheduled Tasks to execute its final payload. Active since at least 2015 and focused on political and military intelligence across South and Southeast Asia, Patchwork is renowned for…
-
New Smish: New York Department of Revenue
As I was visiting SmishTank to report the most recent SMish that I had received (an iMessage from a +27 South African telephone number claiming to be from ParkMobile) I noticed there had been many recent submissions from the New York Department of Revenue. SmishTank is operated by Professor Muhammad Lutfor Rahman, a colleague of mine…
-
Microsoft fixes Windows DRM video playback issues for some users
Microsoft says it has “partially” resolved a known issue that caused problems when trying to play DRM-protected video in Blu-ray/DVD/Digital TV applications. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-drm-video-playback-issues-now-partially-resolved/
-
Windows 11 KB5065789 update released with 41 changes and fixes
Microsoft has released the KB5065789 preview cumulative update for Windows 11 24H2, which includes 41 improvements, including new AI actions in File Explorer and bug fixes for Windows Update and Windows Sandbox. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-11-kb5065789-update-released-with-41-changes-and-fixes/
-
Lunar Spider Infected Windows Machine in Single Click and Harvested Login Credentials
A sophisticated cybercriminal group known as Lunar Spider successfully compromised a Windows machine through a single malicious click, establishing a foothold that allowed them to harvest credentials and maintain persistent access for nearly two months. The intrusion, which began in May 2024, demonstrates the evolving threat landscape where initial access can rapidly escalate to full…
-
Windows 95 was too fat to install itself so needed help from the slimmer 3.1
30 years on, Microsoft engineer explains why the old OS had to babysit its flashy successor First seen on theregister.com Jump to article: www.theregister.com/2025/09/29/chen_windows_95_install/
-
Forensic-timeliner: A Windows Forensics Tool for DFIR Investigators
Forensic-Timeliner is a fast, open-source command-line tool designed to help digital forensics and incident response (DFIR) teams quickly build a unified timeline of Windows artifacts. By automatically collecting, filtering, and merging CSV output from popular triage tools, it creates a mini timeline that is ready for analysis in tools like Timeline Explorer or Excel, as…
-
Forensic-timeliner: A Windows Forensics Tool for DFIR Investigators
Forensic-Timeliner is a fast, open-source command-line tool designed to help digital forensics and incident response (DFIR) teams quickly build a unified timeline of Windows artifacts. By automatically collecting, filtering, and merging CSV output from popular triage tools, it creates a mini timeline that is ready for analysis in tools like Timeline Explorer or Excel, as…
-
LockBit 5.0 ist zurück; zielt auf Linux, Windows und ESXi
Eigentlich sollte die LockBit-Infrastruktur ja mit der Operation Cronos zerschlagen sein. Trend Micro schlägt jetzt Alarm, denn man ist auf eine neue Variante LockBit 5.0 gestoßen. Die Malware greift Systeme mit Linux, Windows sowie VMware ESXi-Instanzen an. Rückblick auf LockBit … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/09/29/lockbit-5-0-ist-zurueck-zielt-auf-linux-windows-und-esxi/
-
Lockbit 5.0: Neue Ransomware-Variante für Windows und Linux im Umlauf
Die Cybererpresser verbessern die Verschleierung ihrer Malware und Erschweren die Wiederherstellung verschlüsselter Dateien. First seen on golem.de Jump to article: www.golem.de/news/lockbit-5-0-neue-ransomware-variante-fuer-windows-und-linux-im-umlauf-2509-200598.html
-
SMS Pools and what the US Secret Service Really Found Around New York
Tags: apple, authentication, business, china, conference, control, country, credit-card, crime, crypto, data, email, exploit, finance, fraud, google, group, Hardware, infrastructure, iphone, jobs, korea, law, linux, mfa, mobile, phishing, phone, scam, service, smishing, software, theft, usa, windowsLast week the United Nations General Assembly kicked off in New York City. On the first day, a strange US Secret Service press conference revealed that they had seized 300 SIM Servers with 100,000 SIM cards. Various media outlets jumped on the idea that this was some state-sponsored sleeper cell waiting to destroy telecommunication services…
-
Fake Microsoft Teams installers push Oyster malware via malvertising
Hackers have been spotted using SEO poisoning and search engine advertisements to promote fake Microsoft Teams installers that infect Windows devices with the Oyster backdoor, providing initial access to corporate networks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-microsoft-teams-installers-push-oyster-malware-via-malvertising/
-
Hackers Use Fake Invoices to Spread XWorm RAT via Office Files
Hackers are sending fake invoice emails with malicious Office files that install the XWorm RAT on Windows systems, allowing full remote access and data theft. Learn how the shellcode and process injection are used to steal data, and how to stay safe from this persistent threat. First seen on hackread.com Jump to article: hackread.com/hackers-fake-invoices-xworm-rat-office-files/
-
Windows 11: Wenn euch Privatsphäre wichtig ist, solltet ihr diese Funktion abschalten
Tags: windowsFirst seen on t3n.de Jump to article: t3n.de/news/windows-11-wenn-euch-privatsphaere-wichtig-ist-solltet-ihr-diese-funktion-abschalten-1709517/
-
Meet LockBit 5.0: Faster ESXi drive encryption, better at evading detection
the Windows binary uses heavy obfuscation and packing: it loads its payload through DLL reflection while implementing anti-analysis techniques like Event Tracing for Windows (ETW) patching and terminating security services;the Linux variant maintains similar functionality with command-line options for targeting specific directories and file types;the ESXi variant specifically targets VMware virtualization environments, and is designed…
-
Microsoft’s new AI feature will organize your photos automatically
Microsoft has begun testing a new AI-powered feature in Microsoft Photos, designed to categorize photos automatically on Windows 11 systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsofts-new-ai-feature-will-organize-your-photos-automatically/
-
Sicherheitsupdates für Windows 10 – Ab Anfang Oktober kann man sich beim ESU-Programm anmelden
Tags: windowsAb Anfang Oktober können sich Windows-10-Nutzer beim ESU-Programm anmelden, um für ein Jahr weiter Sicherheitsupdates zu erhalten. First seen on computerbase.de Jump to article: www.computerbase.de/news/betriebssysteme/sicherheitsupdates-fuer-windows-10-ab-anfang-oktober-kann-man-sich-beim-esu-programm-anmelden.94485
-
LockBit’s new variant is ‘most dangerous yet,’ hitting Windows, Linux and VMware ESXi
Operation Cronos didn’t kill LockBit it just came back meaner First seen on theregister.com Jump to article: www.theregister.com/2025/09/26/lockbits_new_variant_is_most/
-
LockBit’s new variant is ‘most dangerous yet,’ hitting Windows, Linux and VMware ESXi
Operation Cronos didn’t kill LockBit it just came back meaner First seen on theregister.com Jump to article: www.theregister.com/2025/09/26/lockbits_new_variant_is_most/
-
Windows 11 24H2: Hacker können mit WerFaultSecure.exe LSASS-Passwörter stehlen und Sicherheitssoftware lahm legen
Ich ziehe mal ein Sicherheitsthema rund um Windows 11 24H2 raus, was mich bereits ca. eine Woche beschäftigt. Sicherheitsforscher von Zero Solarium haben eine Möglichkeit gefunden, die Windows-Datei WerFaultSecure.exe zu missbrauchen, um einerseits LSASS-Passwörter aus dem Cache zu stehlen. Andererseits … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/09/26/windows-11-24h2-hacker-stehlen-mit-werfaultsecure-exe-lsass-passwoerter-und-legen-sicherheitssoftware-lahm/
-
Microsoft releases the final Windows 10 22H2 preview update
Microsoft has released the final non-security preview update for Windows 10, version 22H2, which includes fixes for the out-of-box experience and SMBv1 protocol connectivity. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-releases-the-final-windows-10-22h2-preview-update/
-
MS-Account vorausgesetzt Update – – Europa erhält Windows-10-Updates ein Jahr (ohne Auflagen)
Im Europäischen Wirtschaftsraum erleichtert Microsoft den Zugang zu Windows-10-Sicherheitsupdates, wenn der offizielle Support endet. First seen on computerbase.de Jump to article: www.computerbase.de/news/betriebssysteme/12-monate-aufschub-europa-erhaelt-windows-10-updates-fuer-ein-jahr-ohne-auflagen.94469
-
MS-Account vorausgesetzt Update – – Europa erhält Windows-10-Updates ein Jahr (ohne Auflagen)
Im Europäischen Wirtschaftsraum erleichtert Microsoft den Zugang zu Windows-10-Sicherheitsupdates, wenn der offizielle Support endet. First seen on computerbase.de Jump to article: www.computerbase.de/news/betriebssysteme/12-monate-aufschub-europa-erhaelt-windows-10-updates-fuer-ein-jahr-ohne-auflagen.94469
-
Fake Ukraine Police Notices Spread New Amatera Stealer and PureMiner
FortiGuard Labs exposes a high-severity phishing campaign impersonating the National Police of Ukraine to deliver Amatera Stealer (data theft) and PureMiner (cryptojacking) to Windows PCs. First seen on hackread.com Jump to article: hackread.com/fake-ukraine-police-notices-amatera-stealer-pureminer/
-
Hackers Breach Active Directory, Steal NTDS.dit for Full Domain Compromise
Threat actors recently infiltrated a corporate environment, dumped the AD database file NTDS.dit, and nearly achieved full domain control. AD acts as the backbone of Windows domains, storing account data, group policies, and password hashes. Compromise of its core file effectively hands attackers the keys to the kingdom. Attack Overview The breach began when attackers…
-
Hackers Breach Active Directory, Steal NTDS.dit for Full Domain Compromise
Threat actors recently infiltrated a corporate environment, dumped the AD database file NTDS.dit, and nearly achieved full domain control. AD acts as the backbone of Windows domains, storing account data, group policies, and password hashes. Compromise of its core file effectively hands attackers the keys to the kingdom. Attack Overview The breach began when attackers…
-
Deutsche Umwelthilfe: Microsofts Update-Pläne für Windows 10 sind Augenwischerei
Umwelt- und Verbraucherschützer sind unzufrieden mit Microsofts kostenlosen Windows-10-Updates für ein weiteres Jahr. Der Vorstoß geht ihnen nicht weit genug. First seen on golem.de Jump to article: www.golem.de/news/deutsche-umwelthilfe-microsofts-update-plaene-fuer-windows-10-sind-augenwischerei-2509-200536.html
-
Deutsche Umwelthilfe: Microsofts Update-Pläne für Windows 10 sind Augenwischerei
Umwelt- und Verbraucherschützer sind unzufrieden mit Microsofts kostenlosen Windows-10-Updates für ein weiteres Jahr. Der Vorstoß geht ihnen nicht weit genug. First seen on golem.de Jump to article: www.golem.de/news/deutsche-umwelthilfe-microsofts-update-plaene-fuer-windows-10-sind-augenwischerei-2509-200536.html
-
LAMEHUG: An LLM-Driven Malware for Dynamic Reconnaissance and Data Exfiltration
A novel AI-driven threat leverages LLMs on Hugging Face to execute adaptive reconnaissance and data exfiltration in real time. Rather than relying on static scripts or prewritten payloads, LAMEHUG dynamically queries a Qwen 2.5-Coder-32B-Instruct model via the Hugging Face API to generate Windows command-shell instructions tailored to its current environment. This capability enables on-the-fly reconnaissance,…
-
LAMEHUG: An LLM-Driven Malware for Dynamic Reconnaissance and Data Exfiltration
A novel AI-driven threat leverages LLMs on Hugging Face to execute adaptive reconnaissance and data exfiltration in real time. Rather than relying on static scripts or prewritten payloads, LAMEHUG dynamically queries a Qwen 2.5-Coder-32B-Instruct model via the Hugging Face API to generate Windows command-shell instructions tailored to its current environment. This capability enables on-the-fly reconnaissance,…