NewApp Digest
search bot

hiding

Ransomware crews add EDR killers to their arsenal
Tech Optimizer
March 31, 2025

Ransomware crews add EDR killers to their arsenal

Antivirus and endpoint security tools are increasingly challenged by ransomware groups that use sophisticated strategies to disable defenses early in attacks. Cisco Talos reported that in nearly half of the ransomware incidents they handled in 2024, attackers successfully employed "EDR killers" to neutralize endpoint detection and response (EDR) systems, achieving success 48 percent of the time. Tools such as EDRSilencer, EDRSandblast, EDRKillShifter, and Terminator pose significant threats to organizational security. EDRKillShifter exploits vulnerable drivers on Windows machines to terminate EDR products, a tactic observed in operations by rival gangs like Medusa, BianLian, and Play. The primary goal of these tools is to disable EDR protections, allowing attackers to operate undetected, complicating system recovery efforts. Recovery often requires wiping and rebuilding entire networks if robust backups are available. Some EDR killers, like HRSword, are legitimate software tools misused by ransomware actors to disable endpoint protection systems. Attackers have exploited misconfigured systems, particularly EDR products set to audit-only mode, which detect but do not block malicious activity. LockBit has remained the most active ransomware-as-a-service group for the third consecutive year, accounting for 16 percent of claimed attacks in 2024. Newcomer RansomHub secured the second position with 11 percent of posts to leak sites. The effectiveness of law enforcement actions plays a significant role in shaping the ransomware landscape.
How to Uninstall Problematic Windows Updates Easily: Microsoft Customer Service
Winsage
March 26, 2025

How to Uninstall Problematic Windows Updates Easily: Microsoft Customer Service

Windows updates can enhance performance and security but may also cause issues such as system crashes, compatibility problems, or decreased performance. If these problems occur, uninstalling the problematic update can restore system functionality. To uninstall a Windows update, users can follow these steps: 1. Access Windows Update History: - Open Windows Settings and select Update & Security. - Click on Windows Update and then View update history. 2. Uninstall the Problematic Update: - In the update history, click on Uninstall updates. - Select the problematic update and click Uninstall, then restart the computer. 3. Use Control Panel to Uninstall Updates: - Open Control Panel and click Programs. - Click on View installed updates, select the update, and click Uninstall. 4. Use Safe Mode to Uninstall Updates: - Boot into Safe Mode by navigating to Update & Security > Recovery and selecting Restart now under Advanced startup. - After restarting, follow the previous steps to uninstall the update. 5. Use the Windows Update Troubleshooter: - Open Settings, navigate to Update & Security, and select Troubleshoot. - Click on Additional troubleshooters, select Windows Update, and run the troubleshooter. 6. Use System Restore to Undo Updates: - Access System Restore by searching for Create a restore point. - Follow instructions to select a restore point prior to the problematic update. 7. Prevent Future Problematic Updates: - Pause updates temporarily in Windows Update settings. - Use the Show or Hide Updates tool to block specific updates from installation. For persistent issues, users can contact Microsoft support via phone, live chat, or their support website for further assistance.
Malicious Android Apps Hide in Plain Sight, Target Millions of Devices
AppWizard
March 25, 2025

Malicious Android Apps Hide in Plain Sight, Target Millions of Devices

A malicious Android app campaign called “Vapor” has been discovered, designed to trick users into revealing sensitive information through misleading ads. This campaign includes various apps posing as utilities, such as QR code scanners and health trackers, with over 60 million downloads collectively. It primarily targets users in Brazil, the United States, and Mexico. Some apps have evaded detection by not showing harmful behavior immediately after installation and by disguising themselves. They use tactics like inundating users with full-screen ads and employing scare tactics to prompt downloads of additional harmful apps. The campaign may be run by a single cybercriminal group or a coalition, utilizing shared malware development tools. Despite Google removing many harmful apps, new variants continue to emerge, highlighting the evolving nature of mobile malware.
Large-Scale Malicious App Campaign Bypassing Android Security
AppWizard
March 18, 2025

Large-Scale Malicious App Campaign Bypassing Android Security

A recent analysis by Bitdefender has revealed a significant ad fraud campaign resulting in over 60 million downloads of malicious applications from the Google Play Store. The campaign involves at least 331 applications that can bypass Android's security measures, allowing them to remain undetected and activate without user interaction. These apps, which often disguise themselves as utility tools, are capable of displaying advertisements and launching phishing attacks without necessary permissions. Some of the malicious apps have been updated and continue to be active, while Google has been notified and is investigating the issue. The attackers employ various methods to conceal their apps, including hiding icons and exploiting system vulnerabilities. They also use custom command and control domains with encryption techniques to complicate detection efforts.
331 Malicious Apps with 60 Million Downloads on Google Play Bypass Android 13 Security
AppWizard
March 18, 2025

331 Malicious Apps with 60 Million Downloads on Google Play Bypass Android 13 Security

Security researchers at Bitdefender have identified a major ad fraud operation involving 331 malicious applications on the Google Play Store, which have over 60 million downloads. These apps exploit vulnerabilities in Android 13 to bypass security measures and conduct phishing attacks, ad fraud, and credential theft. The malicious apps disguise themselves as utility tools, such as QR scanners and health apps, and display intrusive full-screen ads even when not in use. They also attempt to collect sensitive user data without requiring typical permissions, indicating advanced manipulation of Android APIs. The attackers employ various techniques to evade detection, including hiding app icons, launching activities without user interaction, and using persistence mechanisms to remain active on devices. Most of these apps were first active on Google Play in the third quarter of 2024, initially appearing benign before being updated with malicious features. The latest malware was uploaded to the Play Store as recently as March 4, 2025, with 15 apps still available for download at the time of the investigation. The attackers likely operate as a single entity or a collective using similar packaging tools from black markets. They utilize advanced obfuscation techniques to avoid detection, including string obfuscation, polymorphic encryption, runtime checks for debugging, and native libraries obfuscated with specialized tools. This situation highlights significant vulnerabilities in Android's security framework and emphasizes the need for robust third-party security solutions, as attackers continue to adapt their methods.
Search