command execution Archives

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

Winsage

July 8, 2026

Trojanized LetsVPN installer gives attackers remote access to Windows PCs

A malware campaign has been discovered that exploits the VPN service LetsVPN. Researchers from ThreatLocker found a malicious Windows installer that pretends to be the legitimate LetsVPN application while deploying a remote access trojan (RAT) called GoodPersonRAT. The malware allows attackers to control infected systems using stealth techniques. The malicious installer first deploys the RAT and then installs the authentic LetsVPN application, creating an illusion of legitimacy. The package identified as Kuailian_win-setup.86.msi contains the legitimate LetsVPN installer, a loader, and an encrypted payload. GoodPersonRAT features include remote desktop control, file upload/download, command execution, proxying, keylogging, and clipboard monitoring. It specifically targets Telegram Desktop users by archiving critical account information and altering proxy settings. The malware ensures persistence through Windows services and scheduled tasks and can undermine security software. The LetsVPN installer is legitimate and signed, but the MSI package is unsigned and contains malicious components. Users are advised to download software only from official sources and verify digital signatures.

Tech Optimizer

June 14, 2026

Automate Amazon Aurora PostgreSQL major or minor version upgrade using AWS Systems Manager and Amazon EC2

Managing upgrades for the Aurora PostgreSQL-Compatible Edition can be labor-intensive and error-prone when done manually. Automating Amazon Aurora PostgreSQL upgrades can reduce manual effort by up to 80% and minimize downtime risks through consistent procedures. The automation solution uses AWS Systems Manager, Amazon EC2, and AWS Secrets Manager, structured around two modules: PREUPGRADE for readiness checks and UPGRADE for the actual upgrade process. The solution identifies upgrade candidates using database tags, creates safety backups with Copy-on-Write clones, manages the upgrade process with minimal human intervention, and offers real-time monitoring and email notifications. The workflow includes logging into the Systems Manager console, downloading the upgrade script, identifying Aurora PostgreSQL clusters based on tags, retrieving credentials from AWS Secrets Manager, executing pre-upgrade checks or upgrades, uploading log files to Amazon S3, and sending email notifications via Amazon SNS. Prerequisites include familiarity with the Aurora upgrade process, appropriate IAM permissions, creating a maintenance user, setting up AWS Secrets Manager, tagging Aurora clusters, creating an S3 bucket, and configuring an SNS topic for notifications. Implementation steps involve reviewing setup instructions, uploading the upgrade script to S3, creating an AWS Systems Manager automation document, executing the automation document, and monitoring the upgrade process through logs generated during pre-upgrade and upgrade phases. The logs provide detailed information on tasks performed, including replication slot status and configuration backups. After testing, it is recommended to clean up resources to avoid future charges.

Winsage

June 10, 2026

PowerToys just made Command Palette extensions easier to install and manage

PowerToys has released version 0.100.0, introducing several new features and enhancements: - Command Palette now includes an Extension Gallery for managing extensions directly. - Improvements to Command Palette include enhanced parameter pages, bookmarks for inline parameters, and better accessibility. - Dock feature enhancements allow for separate customization for each monitor and drag-and-drop functionality. - Performance Monitor introduces a Battery widget and dock bands for CPU, memory, and network metrics. - Calculator enhancements include new functions and improved error messaging. - Reliability improvements include a pinned commands section and smoother navigation. - FancyZones received updates for better localization and guidance. - File Explorer fixes address crashes related to Markdown previews. - File Locksmith improvements enhance handling of Unicode file paths. - Grab And Move has been fully released. - Image Resizer supports live settings reload. - Keyboard Manager editor is redesigned and enabled by default. - Mouse Without Borders adds quick access to refresh connections. - Peek's settings allow toggling of file preview tooltips. - PowerDisplay is optimized for better performance. - PowerToys Run improves calculator functionality and documents third-party plugins. - Quick Accent updates enhance UI consistency and language support. - Settings interface has been refreshed for better usability. - Shortcut Guide redesigned for reliability and includes built-in manifests. - Workspaces has a modernized editor. - ZoomIt introduces webcam overlay capabilities and improved recording features. - Development tools and dependencies have been updated for smoother contributions.

Tech Optimizer

June 6, 2026

PostgreSQL Dump and Restore: The Complete pg_dump Guide

pg_dump is a utility for exporting a PostgreSQL database into a file, which can be restored on the same or different servers. It exports a single database's tables, views, sequences, functions, indexes, triggers, and in-database grants but does not include roles, tablespaces, or server-level configurations. To capture global objects, pg_dumpall --globals-only should be executed prior to the per-database dump. pg_dump requires CONNECT and SELECT privileges on all tables and sequences within the target database, and a dedicated backup role is sufficient for single-database dumps, while superuser access is needed for global objects. pg_dump supports various output formats: plain SQL (.sql), custom binary (.dump), directory of files, and tar archive (.tar), each with different capabilities for restoration and compression. The custom format allows for selective and parallel restoration. For non-interactive use, credentials can be stored in a .pgpass file or passed via the PGPASSWORD environment variable. Restoration methods depend on the dump format: psql is used for plain SQL files, while pg_restore is used for custom and directory formats. The restoration process requires the target database to be created beforehand. Version mismatches between pg_dump and pg_restore can lead to failures, so it's essential to ensure that the binaries are version-matched. In Docker, pg_dump and pg_restore can be executed within containers, but care must be taken to manage credentials and ensure version compatibility. Exit codes from pg_dump should be checked to confirm successful operations.

Winsage

June 4, 2026

Microsoft makes Linux developers feel more at home in Windows with Coreutils release

Microsoft has introduced a solution that integrates Coreutils directly into the Windows environment, allowing developers to execute a majority of Linux commands from CMD, PowerShell, or Windows Terminal without needing to switch between platforms. This enhancement aims to improve developer productivity by streamlining the use of Linux command line utilities on Windows.

Tech Optimizer

May 20, 2026

PoC Exploit Released for 20-Year Old PostgreSQL RCE Vulnerability

A proof-of-concept exploit has been developed for CVE-2026-2005, a remote code execution vulnerability in the pgcrypto extension of PostgreSQL. This vulnerability, stemming from legacy code, allows attackers to trigger a heap-based buffer overflow through specially crafted PGP messages, enabling arbitrary memory read and write operations. Successful exploitation can escalate privileges to PostgreSQL superuser status and execute commands on the operating system. The exploit targets PostgreSQL instances compiled from a specific vulnerable commit and circumvents protections like Address Space Layout Randomization (ASLR). It involves corrupting heap memory structures, leading to a controlled pointer leak that reveals the heap layout. Security researcher Varik Matevosyan has published the PoC on GitHub, demonstrating the exploitation process. The exploit requires a compatible PostgreSQL binary and utilizes Python-based tools for interaction. Organizations are advised to review their PostgreSQL deployments, disable unnecessary extensions, and apply security updates to mitigate risks.

BetaBeacon

May 5, 2026

ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows

ScarCruft compromised a video game platform in a supply chain attack, trojanizing its components with a backdoor called BirdCall to target ethnic Koreans residing in China. The attack enabled the threat actors to target both Windows and Android devices, turning it into a multi-platform threat. The campaign targeted sqgame[.]net, a gaming platform used by ethnic Koreans in China, known as a transit point for North Korean defectors. BirdCall has features like screenshot capture, keystroke logging, and data gathering, and relies on legitimate cloud services for command-and-control. The Android variant collects various data and has seen active development.

BetaBeacon

May 5, 2026

ScarCruft hackers push BirdCall Android malware via game platform

APT37, also known as ScarCruft and Ricochet Chollima, has developed an Android version of the backdoor BirdCall, which serves as spyware in addition to a backdoor. The malware was delivered through a Chinese website that hosts games for Android, iOS, and Windows, targeting only Android and Windows systems. The Android variant of BirdCall has capabilities such as extracting IP geolocation information, collecting contact lists, call logs, SMS data, device information, taking screenshots, recording audio, and exfiltrating files. Users are advised to download software only from official marketplaces and trusted publisher sites to protect against malware infections.

Tech Optimizer

April 16, 2026

MiningDropper Android Malware Exploits Lumolight App

Researchers at Cyble Research and Intelligence Labs (CRIL) have discovered an Android malware framework called MiningDropper, which is being used in various campaigns to distribute malicious payloads such as cryptocurrency miners, infostealers, Remote Access Trojans (RATs), and banking malware. Over 1,500 MiningDropper samples were detected in one month, with many showing minimal antivirus detection. MiningDropper operates as a multi-stage delivery framework that employs techniques like XOR-based obfuscation and AES encryption to evade detection. A recent variant uses a trojanized version of the Lumolight application as the initial infection vector, often spread through phishing links and fraudulent websites. The malware executes a series of stages, starting with decrypting an embedded asset and loading additional payloads, including a counterfeit Google Play update interface to deceive users. Two main campaign clusters have been identified: an infostealer campaign targeting Indian users by impersonating trusted entities, and a global campaign distributing the BTMOB RAT, which enables credential theft and device takeover. The final payload capabilities include extracting sensitive data, enabling full device compromise, facilitating financial fraud, and unauthorized cryptocurrency mining. MiningDropper's modularity allows it to adapt and scale across various campaigns while maintaining low detection rates.