NewApp Digest
search bot

scheduled tasks

Russian Hackers Leverages Weaponized Microsoft Key Management Service (KMS) To Hack Windows Systems
Winsage
February 13, 2025

Russian Hackers Leverages Weaponized Microsoft Key Management Service (KMS) To Hack Windows Systems

The Sandworm APT group, also known as APT44 or UAC-0145, has been exploiting weaponized Microsoft Key Management Service (KMS) activators to breach Windows systems in Ukraine since late 2023. This campaign uses pirated KMS tools and counterfeit Windows updates to spread malware, targeting state bodies and critical infrastructure. The attackers deploy Trojanized KMS activators, such as “KMSAuto++x64_v1.8.4.zip,” often shared on torrent sites and forums for Ukrainian speakers. The attack begins with the BACKORDER loader, which disables Windows Defender and delivers the DarkCrystal RAT (DcRAT) to exfiltrate sensitive data. A new backdoor named Kalambur is also identified, distributed via a typosquatted domain that pretends to be a Windows Update. Security teams are advised to use Sigma rules and detection tools aligned with the MITRE ATT&CK framework to counter these threats.
Russian Hackers Leverages Weaponized Microsoft KMS to Hack Windows Systems
Winsage
February 13, 2025

Russian Hackers Leverages Weaponized Microsoft KMS to Hack Windows Systems

The Russian state-sponsored hacking group Sandworm, affiliated with the GRU, has been using pirated Microsoft Key Management Service (KMS) activation tools to infiltrate Ukrainian Windows systems since late 2023. They distribute a harmful ZIP file named “KMSAuto++x64_v1.8.4.zip” on torrent platforms, which, when executed, deploys the BACKORDER loader and disables Windows Defender. The BACKORDER loader then downloads the Dark Crystal Remote Access Trojan (DcRAT) from attacker-controlled domains, allowing data theft, including keystrokes and browser credentials. The campaign exploits Ukraine's high prevalence of unlicensed software, estimated at 70% in the public sector, increasing vulnerability to cyberattacks. Researchers have linked this activity to Sandworm through shared infrastructure and tactics, highlighting its role in Russia's hybrid warfare strategy against Ukraine. Cybersecurity experts recommend avoiding pirated software and implementing robust security measures to mitigate these threats.
9 SysInternals tools that should be built into Windows
Winsage
February 11, 2025

9 SysInternals tools that should be built into Windows

Windows is a popular operating system known for its versatility but often lacks advanced troubleshooting and system monitoring tools. SysInternals is a suite of utilities developed by Microsoft for power users and IT professionals, offering enhanced control over systems. Key tools in the SysInternals suite include: - Process Explorer (procexp.exe): Provides a detailed overview of running processes, including resource usage and file access, and allows users to identify locked files and potential malware. - Process Monitor (procmon.exe): Records file system, registry, and process activities in real-time, with filtering options to diagnose performance issues and application errors. - Autoruns (autoruns.exe): Displays all startup programs and processes, allowing users to disable or delete unnecessary entries to improve performance and security. - TCPView (tcpview.exe): Shows active TCP and UDP connections, detailing which processes are using network connections, enabling users to manage network activity. - SDelete (sdelete.exe): A command-line tool for secure file deletion that overwrites data to prevent recovery, useful for safeguarding sensitive information. - ZoomIt (zoomit.exe): Enhances presentations by allowing users to zoom in on screen areas and annotate, beneficial for educators and IT professionals. - RamMap (rammap.exe): Analyzes physical memory allocation, helping identify memory leaks and inefficient usage. - PendMoves (pendmoves.exe): Lists files scheduled for movement or deletion upon reboot, aiding in troubleshooting file modification issues. - BgInfo (bginfo.exe): Generates a desktop background displaying vital system information, customizable for user needs. The integration of these tools into Windows would enhance its diagnostic and troubleshooting capabilities, benefiting both everyday and power users.
ACPI wake alarm does not disable; How to disable it?
Winsage
December 26, 2024

ACPI wake alarm does not disable; How to disable it?

If your Windows system is waking up at night due to an ACPI Wake Alarm, you can try several solutions to resolve the issue: 1. Adjust Hibernate Settings: Change the Hibernate after Sleep feature in Power Options to a higher value or disable it by setting it to 0 (Never). 2. BIOS/UEFI Configuration: Access the BIOS/UEFI setup and disable the Wake on RTC Alarm if enabled. 3. PowerShell and Command Line for Wake Timers: Use commands like PLACEHOLDERd65d9fd27963b5bd to review power settings and PLACEHOLDER0384fd2e90496902 to disable specific devices from waking the computer. 4. Disable Wake Timers: In Power Settings, set Allow wake timers to disable for both On Battery and Plugged In states. 5. Check Security and Maintenance Settings: Uncheck the option for Allow scheduled maintenance to wake up my computer in the Security and Maintenance settings. 6. Task Scheduler Settings: Review scheduled tasks and uncheck the “Wake the computer to run this task” option in the Conditions tab. 7. Event Viewer Analysis: Check the Event Viewer under Windows Logs > System to identify the Wake Source, which may indicate the ACPI Wake Alarm. The issue often arises from ACPI wake alarms that can override wake timer settings, necessitating a thorough examination of all related configurations to fully disable them.
Hackers Exploit Microsoft Management Console to Drop Backdoor Payloads on Windows
Winsage
December 17, 2024

Hackers Exploit Microsoft Management Console to Drop Backdoor Payloads on Windows

The Securonix Threat Research team has identified a phishing campaign called the “FLUX#CONSOLE campaign,” which targets tax-related themes using Microsoft Common Console Document (MSC) files to deliver a backdoor payload. The attack begins with a phishing email containing a decoy PDF titled “Income-Tax-Deduction-and-Rebates202441712.pdf,” which conceals an MSC file that executes malicious payloads. The campaign employs various tactics, including tax-themed lures, exploitation of MSC files, DLL sideloading using DISM.exe, persistence through scheduled tasks, and advanced obfuscation techniques. The attack chain involves tricking users into opening a malicious MSC file disguised as a PDF, which contains XML commands to download or extract a malicious DLL named DismCore.dll. The DLL is sideloaded using Dism.exe, and the malware communicates with a Command-and-Control server at “hxxps://siasat[.]top,” exfiltrating data via encrypted HTTPS traffic. The attackers maintained access for about 24 hours, targeting victims in Pakistan. The tactics used do not align with known advanced persistent threat groups, highlighting the growing threat of MSC files as a delivery method for malware. Indicators of Compromise (IOCs) include the C2 address siasat[.]top and analyzed file hashes for the malicious files involved in the campaign.
Search