NewApp Digest
search bot

endpoint

Microsoft Discovers Return Of Alarming MacOS Malware With Sinister New Tricks
Tech Optimizer
February 18, 2025

Microsoft Discovers Return Of Alarming MacOS Malware With Sinister New Tricks

The XCSSET malware, discovered in 2020, allows cybercriminals remote access to developers' MacBooks and has led to a reassessment of macOS security measures. A new variant of XCSSET has been identified, specifically targeting macOS systems and exploiting vulnerabilities, particularly in keychains, to steal sensitive information like usernames and passwords. This variant spreads through Xcode projects and features enhanced functionality that makes detection and removal more challenging. It employs increased randomization in payload generation and uses both xxd and Base64 encoding. The malware can remain undetected, targeting Xcode projects for payload insertion and extracting data from cryptocurrency wallets and the Notes app. Microsoft has confirmed that its Defender for Endpoint on Mac can detect both the old and new variants of XCSSET, but developers are advised to exercise caution by downloading only from trusted sources, using the latest software versions, inspecting Xcode projects before opening them, and avoiding third-party applications.
Earth Preta APT Exploit Microsoft Utility Tool to Control Windows
Winsage
February 18, 2025

Earth Preta APT Exploit Microsoft Utility Tool to Control Windows

Researchers from Trend Micro's Threat Hunting team have identified a cyberattack campaign by the APT group Earth Preta, targeting government entities in the Asia-Pacific region, including Taiwan, Vietnam, Malaysia, and Thailand. The group uses spear-phishing emails and advanced malware to compromise Windows systems, notably employing the Microsoft Application Virtualization Injector (MAVInject.exe) to inject malicious payloads into legitimate processes. The attack typically begins with a malicious file, IRSetup.exe, which drops both legitimate and malicious files onto the system, often accompanied by a decoy PDF posing as an official document. Earth Preta utilizes a modified variant of the TONESHELL backdoor malware, sideloaded using OriginLegacyCLI.exe and a malicious DLL, EACore.dll. This malware communicates with a command-and-control server for data exfiltration and remote operations, offering capabilities such as reverse shell access, file deletion, and persistent storage of victim identifiers. The malware adapts its behavior based on the presence of ESET antivirus software, using different techniques for code injection. Trend Micro attributes this campaign to Earth Preta with medium confidence, noting that the group has compromised over 200 victims since at least 2022, primarily focusing on government entities and using phishing as the initial attack vector.
REF7707 Hackers Attacking Windows & Linux Machines Using FINALDRAFT Malware
Winsage
February 14, 2025

REF7707 Hackers Attacking Windows & Linux Machines Using FINALDRAFT Malware

A hacking campaign named “REF7707” has been targeting Windows and Linux systems with malware families including FINALDRAFT, GUIDLOADER, and PATHLOADER. It originated in late November 2024, when Elastic Security Labs detected alerts from the Foreign Ministry of a South American nation. The attackers used Microsoft’s certutil application to download files and had valid network credentials for lateral movement. FINALDRAFT, a key component of the campaign, exploits the Windows-signed debugger CDB.exe and uses a Scheduled Task for persistence. It employs Microsoft’s Graph API for command and control, utilizing cloud services and domains like support.vmphere[.]com and update.hobiter[.]com. The campaign highlights the need for improved security measures across different operating systems.
Russian Hackers Leverages Weaponized Microsoft KMS to Hack Windows Systems
Winsage
February 13, 2025

Russian Hackers Leverages Weaponized Microsoft KMS to Hack Windows Systems

The Russian state-sponsored hacking group Sandworm, affiliated with the GRU, has been using pirated Microsoft Key Management Service (KMS) activation tools to infiltrate Ukrainian Windows systems since late 2023. They distribute a harmful ZIP file named “KMSAuto++x64_v1.8.4.zip” on torrent platforms, which, when executed, deploys the BACKORDER loader and disables Windows Defender. The BACKORDER loader then downloads the Dark Crystal Remote Access Trojan (DcRAT) from attacker-controlled domains, allowing data theft, including keystrokes and browser credentials. The campaign exploits Ukraine's high prevalence of unlicensed software, estimated at 70% in the public sector, increasing vulnerability to cyberattacks. Researchers have linked this activity to Sandworm through shared infrastructure and tactics, highlighting its role in Russia's hybrid warfare strategy against Ukraine. Cybersecurity experts recommend avoiding pirated software and implementing robust security measures to mitigate these threats.
10 Best UTM (Unified Threat Management) Firewalls
Tech Optimizer
February 11, 2025

10 Best UTM (Unified Threat Management) Firewalls

Unified Threat Management (UTM) firewalls integrate multiple security functionalities into a single platform, streamlining security management and reducing costs for organizations, particularly small and medium-sized enterprises (SMEs). UTM solutions include features such as firewalls, intrusion detection and prevention systems (IDPS), antivirus, anti-spam, VPN, web content filtering, and application control, providing comprehensive protection against various cyber threats. UTM firewalls serve as a gateway between internal networks and external connections, inspecting all traffic to block malicious activity. They continuously monitor for suspicious patterns, scan for malware, filter web access, provide VPN capabilities for secure remote connectivity, and filter emails to protect against spam and phishing. UTM systems offer centralized management through a unified dashboard, receive regular updates for emerging threats, and may include performance optimization features. The distinction between UTM and traditional firewalls lies in UTM's broader range of security functions, acting as a comprehensive security solution rather than solely focusing on real-time malware scanning. Top UTM firewalls include: 1. SonicWall UTM: Intrusion prevention and gateway anti-virus. 2. Sophos UTM: User-friendly management with advanced security measures. 3. Check Point UTM: Comprehensive protections including firewalls and VPNs. 4. Fortinet FortiGate UTM: Integrates security and networking functions. 5. WatchGuard UTM: Balances performance, security, and management ease. 6. Juniper UTM: High-performance security services. 7. Barracuda UTM: Extensive network protection through integrated functions. 8. Stormshield UTM: Proactive defense mechanisms. 9. Huawei Unified Security Gateway (USG): Versatile security protections. 10. Cisco UTM: Integrated security and threat management services. Key features of the best UTM firewalls include application control, advanced threat prevention, reporting and analytics, scalability, endpoint protection, and DDoS protection.
Latest Windows 11 build adds full MIDI 2.0 support and improved performance
Winsage
February 7, 2025

Latest Windows 11 build adds full MIDI 2.0 support and improved performance

Microsoft has released Windows 11 Insider Preview Build 27788 in the Canary Channel, which includes significant enhancements to the MIDI standard. This update supports both MIDI 1.0 and MIDI 2.0, designed exclusively for 64-bit operating systems, and extends full MIDI compatibility across all modern Windows architectures, including Arm64-based PCs. The MIDI 2.0 standard features high-speed data transmission, high-fidelity messages, and endpoint discovery and negotiation. The new MIDI stack improves performance with better timing and reduced jitter, and a faster MIDI driver supports both versions with automatic API translation for interoperability. The update also includes a USB MIDI 2.0 class driver developed in collaboration with the Association of Musical Electronics Industry of Japan and AmeNote, ensuring compatibility with both MIDI 2.0 and legacy MIDI 1.0 devices. Additionally, the preview introduces a 1-click resume function for OneDrive and selective installation options for games in the Microsoft Store.
Search