detection systems Archives

Tech Optimizer

May 31, 2025

Authorities Dismantled AVCheck, a Tool For Testing Malware Against Antivirus Detection

Law enforcement agencies from multiple nations dismantled a cybercriminal operation that provided malware testing services to evade antivirus detection. This effort led to the seizure of four domains and their servers, disrupting infrastructure that facilitated ransomware attacks globally. U.S. Attorney Nicholas J. Ganjei announced the disruption of an online software crypting syndicate that helped cybercriminals keep their malware undetected. The seized domains offered counter-antivirus tools and crypting services, allowing criminals to obfuscate malware and gain unauthorized access to systems. Investigators conducted undercover purchases and analyzed services, revealing connections to ransomware groups targeting victims in the U.S. and internationally. The operation, part of Operation Endgame, involved collaboration among the U.S., Netherlands, France, Germany, Denmark, Ukraine, and Portugal, with the FBI Houston Field Office leading the U.S. investigation. The seizures occurred on May 27.

Tech Optimizer

May 27, 2025

Microsoft oversells Windows 11’s Smart App Control as a “top antivirus solution”

Microsoft's Smart App Control (SAC) is integrated into Windows 11 and requires a clean installation to function optimally. It is designed to enhance security by using artificial intelligence to proactively shield users from threats, working alongside existing antivirus software rather than replacing it. SAC aims to anticipate and block suspicious applications before they can cause harm, minimizing system performance impact by avoiding constant file scanning. However, the effectiveness of SAC and its claims of being a groundbreaking innovation have been questioned, as proactive security measures have existed for years, and modern antivirus solutions offer advanced features beyond basic scanning. Users are advised to consider independent testing platforms for reliable antimalware options.

Winsage

May 10, 2025

Hackers Using Windows Remote Management to Stealthily Navigate Active Directory Network

Threat actors are exploiting Windows Remote Management (WinRM) to navigate through Active Directory environments stealthily, allowing them to bypass detection systems, escalate privileges, and deploy malicious payloads. WinRM operates on HTTP port 5985 and HTTPS port 5986, enabling remote command execution and management tasks. Attackers can gain access through compromised credentials and use WinRM-enabled PowerShell commands for reconnaissance, deploying payloads while evading detection. The attack chain includes initial access, reconnaissance, payload deployment, persistence, and lateral movement, often utilizing techniques that obfuscate malicious activities. Detecting such attacks is challenging due to the use of built-in Windows functionalities and encrypted channels. Recommended mitigation strategies include monitoring for unusual activity, restricting WinRM access, enforcing credential hygiene, and implementing advanced monitoring solutions.

Tech Optimizer

April 15, 2025

New ‘Waiting Thread Hijacking’ Malware Technique Evades Modern Security Measures

Security researchers have developed a new malware process injection technique called "Waiting Thread Hijacking" (WTH), which executes harmful code within legitimate processes while avoiding detection by security measures. This method improves upon traditional Thread Execution Hijacking by using a different sequence of operations that bypasses commonly monitored API calls. WTH involves allocating memory and injecting malicious payloads using standard functions, identifying dormant threads within the target process, acquiring thread context with less suspicious permissions, and overwriting the return address on the stack with the injected shellcode. The technique ensures stability by preserving the original state of the thread and allows it to resume normal operations after executing the malicious code. Additionally, WTH employs an obfuscation technique that distributes its steps across multiple child processes to evade behavioral detection systems. While WTH can avoid many conventional detection triggers, it is not completely immune, as some Endpoint Detection and Response (EDR) solutions can block unauthorized memory writes. Check Point Research has observed that WTH is effective against certain EDRs while others can block it but not older methods, illustrating the variability in EDR capabilities.

Tech Optimizer

April 15, 2025

5 reasons I regret not deploying my own home firewall sooner

A hardware firewall enhances network security by monitoring and filtering all traffic, preventing unauthorized access based on pre-defined rules, and analyzing traffic patterns for anomalies. It employs Next-Generation Firewall technology for deep packet inspection, utilizes GeoIP restrictions, and runs Intrusion Prevention/Detection Systems (IPS/IDS). Implementing a Zero Trust architecture minimizes device access, and notifications alert users to new device connections. Segregating IoT devices onto a dedicated VLAN reduces security risks. A multi-layered security approach, including rules-based and deep packet inspection, is essential for comprehensive protection. Hardware firewalls often run on Linux or FreeBSD, allowing additional functionalities like ad blocking through services such as Pi-hole. Cataloging devices improves troubleshooting and network management. The adoption of hardware firewalls is increasingly necessary due to the rise of connected devices in homes.

AppWizard

April 10, 2025

How Gaming Is Regulated On Android’s App Store

The Google Play Store offers millions of mobile games and enforces strict regulations to ensure user safety and legal compliance. These regulations cover content policies, monetization practices, data protection, technical requirements, and regional compliance. Games must adhere to content policies that prohibit hate speech, excessive violence, and misrepresentation, and must be rated by the International Age Rating Coalition (IARC). Monetization strategies require developers to use Google’s payment system for in-app purchases and disclose pricing and refund policies. Gambling games must have the necessary licenses and disclose odds for loot boxes. Data privacy guidelines mandate clear communication about data collection and user consent. Technical standards require games to function well across devices and be free from security threats. Google employs automated and manual reviews to enforce compliance, with consequences for violations ranging from warnings to permanent bans. Regional compliance is necessary, particularly in areas with strict regulations like China and the EU.

Tech Optimizer

April 7, 2025

Sakura RAT Released on GitHub Can Bypass Antivirus and EDR Tools

Sakura RAT is a newly developed remote administration tool available on GitHub, designed for use by malware analysts and security researchers. It features capabilities such as hidden browsing, hidden virtual network computing (HVNC), fileless execution, multi-session control, and anti-detection mechanisms to evade antivirus and endpoint detection systems. While marketed for research purposes, its open availability raises concerns about potential misuse by cybercriminals for activities like data exfiltration and ransomware deployment. Cybersecurity experts are advocating for the removal of the repository from GitHub and calling for improved detection systems to combat the risks posed by such advanced tools.