NewApp Digest
search bot

command execution

PoC Exploit Released for Windows Error Reporting ALPC Privilege Escalation
Winsage
March 3, 2026

PoC Exploit Released for Windows Error Reporting ALPC Privilege Escalation

A critical local privilege escalation vulnerability, tracked as CVE-2026-20817, affects Microsoft Windows through the Windows Error Reporting (WER) service. This flaw allows authenticated users with low-level privileges to execute arbitrary code with full SYSTEM privileges. The vulnerability resides in the SvcElevatedLaunch method (0x0D) and fails to validate user permissions, enabling attackers to launch WerFault.exe with malicious command-line parameters from a shared memory block. The exploit affects all versions of Windows 10 and Windows 11 prior to January 2026, as well as Windows Server 2019 and 2022. Microsoft addressed this vulnerability in the January 2026 Security Update. Organizations are advised to apply security patches and monitor for unusual WerFault.exe processes.
We’re talking about the best of Windows 11, and we want your input.
Winsage
January 26, 2026

We’re talking about the best of Windows 11, and we want your input.

Expressions of affection for Windows are common, and while the author acknowledges some shortcomings in Windows 11, it remains an essential tool for productivity, creativity, and communication. Qualcomm's Snapdragon X2 Plus platform is expected to indicate a significant transition toward Arm-based Windows devices. The Microsoft Store has become a reliable platform for discovering and downloading applications on Windows. Recent enhancements in Windows 11 have improved the experience for handheld gaming PCs. The Windows Package Manager, or winget, is highly regarded, and PowerToys is recommended as essential for Windows 11 users. The Command Palette allows users to launch applications using the keyboard and execute commands. The Windows Subsystem for Linux (WSL) provides a genuine Linux experience within Windows 11. Phone Link facilitates effortless photo transfers. The 12-inch Surface LCD is slightly thinner than the Surface Pro 11. The Windows Central community is engaged in discussions about the standout features of Windows 11.
China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware
Winsage
December 18, 2025

China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware

A newly identified cyber threat cluster called LongNosedGoblin has been linked to cyber espionage attacks targeting governmental entities in Southeast Asia and Japan, with activities traced back to at least September 2023. The group uses Group Policy to spread malware and employs cloud services like Microsoft OneDrive and Google Drive for command and control. Key tools include NosyHistorian, NosyDoor, NosyStealer, NosyDownloader, and NosyLogger, which perform functions such as collecting browser history, executing commands, and logging keystrokes. ESET first detected LongNosedGoblin's activities in February 2024, identifying malware on a governmental system. The attacks showed a targeted approach, with specific tools affecting select victims. Additionally, a variant of NosyDoor was found targeting an organization in an EU country, indicating a possible connection to other China-aligned threat groups.
Chinese hackers fake Teams downloads in false flag ploy
Tech Optimizer
December 18, 2025

Chinese hackers fake Teams downloads in false flag ploy

A cybersecurity investigation by ReliaQuest has revealed that a Chinese state-linked hacking group, Silver Fox (also known as Void Arachne), is using search engine optimization tactics to create a counterfeit Microsoft Teams download site at "teamscn[.]com." This site targets Chinese-speaking users and employs a typo-squatting strategy. Victims attempting to download the software receive a trojanized installer labeled "Setup.exe," which checks for the presence of antivirus software and executes obfuscated PowerShell commands to modify Windows Defender exclusion lists. The malware also drops a file named "Verifier.exe" and installs a functional version of Microsoft Teams to disguise its activities. The compromised system communicates with the domain "Ntpckj[.]com" to deliver the ValleyRAT payload, allowing remote access for data exfiltration and command execution. Silver Fox is linked to both state-sponsored espionage and financially motivated activities, having previously conducted similar SEO poisoning campaigns. The campaign primarily targets Chinese-speaking personnel in global organizations, particularly those with ties to China, and poses a significant risk to organizations lacking robust security measures. Security teams are advised to enhance logging and monitoring practices to detect suspicious activities.
Warning! Engineered Linux Malware Can Bypass Next-Gen Anti-Virus Solutions - Open Source For You
Tech Optimizer
December 9, 2025

Warning! Engineered Linux Malware Can Bypass Next-Gen Anti-Virus Solutions – Open Source For You

The author created a custom reverse TCP payload using Python, packaged it into an .elf executable, and tested its stealthiness against antivirus software. The payload included functionalities such as webcam snapshots, keylogging, screen capture, and file transfers. Established tools for obfuscation often triggered antivirus alerts, prompting the author to develop a custom solution to avoid signature-based detection, maintain behavioral control, and gain insights into detection engines. The payload was designed to connect back to the attacker's machine and execute commands, while the listener processed incoming data. After compiling the binary, it was submitted to VirusTotal, where only four out of 64 antivirus engines flagged it, indicating that custom code can bypass many next-gen antivirus products.
Maybe don't trust every Windows Update without checking - hackers hijack images to spread dangerous malware
Winsage
November 29, 2025

Maybe don’t trust every Windows Update without checking – hackers hijack images to spread dangerous malware

Cybercriminals are using fake Windows Update screens to spread sophisticated malware, employing social engineering techniques to deceive users. These ClickFix attacks create convincing illusions of legitimate update prompts in full-screen web browser pages, prompting users to execute malicious commands. The malware, known as Stego Loader, reconstructs its payload in memory using C# routines, making it difficult for standard antivirus solutions to detect and remove. Recommended precautions include regular antivirus scanning, robust firewall protection, disabling the Windows Run Box, and careful examination of image-based files, as they can be weaponized to deliver malware. Organizations must be vigilant about the manipulation of seemingly legitimate assets, which complicates logging, monitoring, and forensic analysis, and poses significant risks to supply chain security.
Hackers Using RMM Tools LogMeIn and PDQ Connect to Deploy Malware as Legitimate Software
Tech Optimizer
November 13, 2025

Hackers Using RMM Tools LogMeIn and PDQ Connect to Deploy Malware as Legitimate Software

Cybersecurity researchers at AhnLab Security Intelligence Center (ASEC) have discovered an attack campaign that uses legitimate Remote Monitoring and Management (RMM) tools, specifically LogMeIn Resolve and PDQ Connect, to deploy backdoor malware on users' systems. Attackers lure victims to fake download sites that mimic legitimate software pages for utilities like Notepad++, 7-Zip, and VLC Media Player, delivering modified versions of LogMeIn Resolve. The malicious installers are disguised with filenames such as "notepad++.exe" and "chatgpt.exe." Once executed, these files install the RMM tool and additional malware capable of stealing sensitive information. ASEC has identified three CompanyId values associated with the attacks: 8347338797131280000, 1995653637248070000, and 4586548334491120000. The malware, known as PatoRAT, is a Delphi-developed backdoor that gathers system information and has extensive malicious capabilities, including keylogging and remote desktop access. Users are advised to download software only from official websites and verify digital signatures, while organizations should monitor for unauthorized RMM installations and the identified indicators of compromise.
Emotet: The horse returns to a gallop more dangerous than ever
Tech Optimizer
November 13, 2025

Emotet: The horse returns to a gallop more dangerous than ever

Emotet is a Trojan Horse malware that emerged in 2014, impacting over 1.6 million devices and originally designed to steal banking credentials. Developed by the MealyBug criminal organization, it evolved into a modular Trojan-dropper, enabling it to download various payloads and act as Malware-as-a-Service on the dark web. Emotet spreads primarily through spam emails, often using malicious Word or Excel files, and has been disseminated via local area networks and password-protected zip folders. The malware operates through botnets categorized into epochs, with Epochs 1, 2, and 3 dismantled in 2021 by a coordinated international operation. Following this, Emotet resurfaced in November 2021 as Epochs 4 and 5, incorporating a Cobalt Strike beacon for enhanced propagation. Recommended precautions include keeping software updated, using two-factor authentication, and educating employees about email threats. Network administrators are advised to block unscannable email attachments, configure specific email filters, and maintain secure backups.
Search