Mindly.Social @root

**Hourly Jobs | TotalCyber.io** @TotalCyberJobsBot@infosec.exchange · 43m

**AAKL** @AAKL@infosec.exchange · 1h

CIA has updated the KEV catalogue.

- CVE-2025-22457: Ivanti Connect Secure, Policy Secure and ZTA Gateways Stack-Based Buffer Overflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-22457 #CISA #cybersecurity #infosec #Ivanti

**AAKL** @AAKL@infosec.exchange · 1h

**Hourly Jobs | TotalCyber.io** @TotalCyberJobsBot@infosec.exchange · 1h

**AAKL** @AAKL@infosec.exchange · 1h

**AAKL** @AAKL@infosec.exchange · 2h

**AAKL** @AAKL@infosec.exchange · 2h

**AAKL** @AAKL@infosec.exchange · 2h

**AAKL** @AAKL@infosec.exchange · 2h

**BeyondMachines** @beyondmachines1@infosec.exchange · 2h

**Hourly Jobs | TotalCyber.io** @TotalCyberJobsBot@infosec.exchange · 2h

**OTX Bot** @techbot@social.raytec.co · 3h

OTX Bot @techbot@social.raytec.co

Deobfuscating APT28's HTA Trojan: A Deep Dive into VBE Techniques & Multi-Layer Obfuscation

This analysis delves into APT28's cyber espionage campaign targeting Central Asia and Kazakhstan diplomatic relations, focusing on their HTA Trojan. The malware employs advanced obfuscation techniques, including VBE (VBScript Encoded) and multi-layer obfuscation. The investigation uses x32dbg debugging to decode the obfuscated code, revealing a custom map algorithm for character deobfuscation. The process involves decoding strings using embedded characters from Windows vbscript.dll. The analysis identifies the use of Microsoft's Windows Script Encoder (screnc.exe) to create VBE files. By employing various deobfuscation techniques, including a Python script, the final malware sample is extracted and analyzed, showcasing APT28's evolving tactics in cyber espionage.

Pulse ID: 67efc6e712b49d46c1423ca9
Pulse Link: https://otx.alienvault.com/pulse/67efc6e712b49d46c1423ca9
Pulse Author: AlienVault
Created: 2025-04-04 11:47:51

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

#APT28 #Asia #CentralAsia

**OTX Bot** @techbot@social.raytec.co · 3h

OTX Bot @techbot@social.raytec.co

Russian-Speaking Threat Actor Abuses Cloudflare & Telegram in Phishing Campaign

A Russian-speaking threat actor has launched a new phishing campaign using Cloudflare-branded pages themed around DMCA takedown notices. The attack abuses the ms-search protocol to deliver malicious LNK files disguised as PDFs. Once executed, the malware communicates with a Telegram bot to report the victim's IP address before connecting to Pyramid C2 servers. The campaign leverages Cloudflare Pages and Workers services to host phishing pages, and uses an open directory to store malicious files. The infection chain includes PowerShell and Python scripts, with incremental changes in tactics to evade detection. The actors' infrastructure spans multiple domains and IP addresses, primarily using Cloudflare's network.

Pulse ID: 67efc6ed5285702a3440969a
Pulse Link: https://otx.alienvault.com/pulse/67efc6ed5285702a3440969a
Pulse Author: AlienVault
Created: 2025-04-04 11:47:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cloud #CyberSecurity #ICS

**skry** @skry@mastodon.social · 3h

skry @skry@mastodon.social

"the ProtectEU plan, launched on Monday, says the European Commission wants to develop a roadmap to allow "lawful and effective access to data for law enforcement in 2025" and a technology roadmap to do so by the following year."
https://www.theregister.com/2025/04/03/eu_backdoor_encryption/

The Register · 1dEU: These are scary times – let's backdoor encryption!By Iain Thomson

#eur #privacy #security

Recent searches

Search options

Administered by:

Server stats:

#infosec