We examine a variant of the .NET backdoor Kazuar used by Pensive Ursa. This includes previously undocumented features from system profiling to injection modes. The post Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive…
Category: Unit 42
CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys
We analyze an attack path starting with GitHub IAM exposure and leading to creation of AWS Elastic Compute instances — which TAs used to perform cryptojacking. The post CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys appeared…
When PAM Goes Rogue: Malware Uses Authentication Modules for Mischief
A breakdown of how Linux pluggable authentication modules (PAM) APIs are leveraged in malware. We include malware families that leverage PAM. The post When PAM Goes Rogue: Malware Uses Authentication Modules for Mischief appeared first on Unit 42. This article…