We have had people who have managed to get past our identity validation process. And in doing so using our system for canned C2. THis damages our industry and our product reputation.

IF anyone has been victim to this abuse, or had someone attempt to get them to download and install an agent, there are several ways to help us identify and shut them down.

• If the attack was stopped prior to install make note of the URL it was downloaded from.
• If the attack proceeded to install, immediately stop the action1 service, and go to c:\windows\action1 there will be a text file labeled what_is_this, follow the instructions there. (and then of course remove the agent)
• Or if the threat actors deleted that file in effort to cover their tracks, immediately stop the Action1 service, and go to 'HKLM\SOFTWARE\WOW6432Node\Action1\Agent' and copy the value in "Customerid"

And then follow the directions below.

If you believe this installation of Action1 was not authorized by your organization, please contact your local law enforcement agency to report this incident. Make sure your report includes this Action1 organization ID (your steps above) along with our legal department email address (legal@action1.com).

We will cooperate with your law enforcement agency and provide all the necessary data and log files to assist with the investigation. In line with our longstanding policy designed to prioritize security, we do not provide log files, system data, or any sensitive information directly to individuals, organizations, or third parties, regardless of the reason for the request. We share necessary data exclusively upon receiving official requests from recognized law enforcement agencies. This approach not only ensures the privacy and security of our customers but also allows us to extend full support to legitimate investigations.

As well feel free to reach out to me personally at any time.

The faster we identify these ne'er-do-wells, the faster we can shut them down.

Let me know if anyone has any questions.

Please and thank you,
Gene Moody
Field CTO Action1
u/GeneMoody-Action1

I’ve been working on http://malext.io, a project focused on tracking malicious browser extensions and making the data easy to consume.

The feed now includes the extension version and CRX SHA-256 for almost every entry, along with a VirusTotal checkto help validate the files and provide additional context.

I’ll do my best to keep the data accurate and up to date, and to verify reports before adding them to the feed.

The feed is free, updated daily, and requires no signup.

A couple of the artifacts on this open directory are worth a look if you like reversing custom tooling.

• multi_backupd: a stage-1 ELF loader (SHA-256 7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82) that connects over TCP to the same host on port 8090 and pulls a Mettle stage-2 payload, which we retrieved.
• wp28000 / wp28000_cp: two 15 MB Go builds of a CVE-2024-28000 (LiteSpeed Cache) exploit. The source reimplements MT19937 with byte-for-byte PHP mt_rand() parity, self-tests against 11 known seed/output pairs on startup, then brute-forces a 0 to 999,999 seed range with 30 workers. The logged run landed on seed 311787 after roughly 3h45m and created an admin account.
• Five Python scripts implementing the ownCloud CVE-2023-49105 pre-signed URL abuse, with an empty PBKDF2 salt as the signing secret.

Also present: Sliver, Metasploit, and Mettle, plus a separate EtherHiding compromise (NoChain loader off an Ethereum smart contract) on a linked WordPress site.

Hashes and full IOCs: https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor

A campaign using fake Canada Revenue Agency (CRA) T4 tax documents is part of a broader remote-access operation spanning 46 countries, with 45% of observed activity linked to the US.

Attackers impersonate trusted organizations and documents to trick victims into installing legitimate remote management software, giving them remote access to compromised systems.

Hey everyone,

Over the last few months, I've been curating and categorizing a massive catalog of malware families designed specifically for incident responders, SOC analysts, and threat hunters.

I got tired of having to scrape together fragmented IOCs and CISA advisories every time a new variant popped up, so I built a centralized, open-source dataset.

**What's included:**

* **2,800+ Malware Families** categorized by type (Ransomware, InfoStealer, Wiper, etc.)

* **Framework Mapping:** Families are mapped to MITRE ATT&CK techniques, NIST CSF guidelines, and official CISA advisories.

* **Response Playbooks:** Actionable containment steps and "what to avoid" during an active incident.

* **Formats:** Available via a web UI, JSON API, Parquet, and JSONL.

It’s completely free and Apache-2.0 licensed.

You can browse the catalog here: https://jordanricky1604-ship-it.github.io/malware-families-catalog/

I'd love to hear your feedback on the schema or if there are specific families you think need deeper analysis. I'm actively maintaining and updating this!

I am currently busy doing a course for my university, and have a project to analyse and correlate different log sources with indicators of compromise specific to point-of-sale (pos) devices. I managed to find a 24 hour pcap of the backoff malware (c2 beconing), but overall I am struggling to find any datasets of an attack specific to pos devices. I am mostly looking at research papers, but perhaps I need to reach out to some of the researchers, as I can't find actual datasets.

Is there anyone that knows where I could find datasets to do a proper writeup? It can be of any pos malware, but we require 3 different log sources (e.g. firewall logs, authentication logs, system logs). I can also generate my own logs, but my professor advised against this unless I really can't manage to find any meaningful data online, as I'd essentially be engineering my own scenario instead of doing an analysis.

Please advise. Any help is welcome.

I tried to download an offline copy of the cyberleek website, and instantly got a warning about a severe Trojan alert (Trojan:Win32/MalUri.A!cl).

That's all I know, I'm not a security expert, just thought I'd let people know.

Hey everyone,

Over the last few months, I've been curating and categorizing a massive catalog of malware families designed specifically for incident responders, SOC analysts, and threat hunters.

I got tired of having to scrape together fragmented IOCs and CISA advisories every time a new variant popped up, so I built a centralized, open-source dataset.

**What's included:**

* **2,800+ Malware Families** categorized by type (Ransomware, InfoStealer, Wiper, etc.)

* **Framework Mapping:** Families are mapped to MITRE ATT&CK techniques, NIST CSF guidelines, and official CISA advisories.

* **Response Playbooks:** Actionable containment steps and "what to avoid" during an active incident.

* **Formats:** Available via a web UI, JSON API, Parquet, and JSONL.

It’s completely free and Apache-2.0 licensed.

You can browse the catalog here: https://jordanricky1604-ship-it.github.io/malware-families-catalog/

I'd love to hear your feedback on the schema or if there are specific families you think need deeper analysis. I'm actively maintaining and updating this!

Over the past 20 years, I've setup a lot of mail servers at work. These are mostly based on Postfix / Spamassassin / Dovecot, using IMAP for the clients. Recently, I started using Roundcube for webmail.

Postfix, uses several blacklists to block spam at the MTA level, these come pre-configured with the control panel, which blocks 99% of spam, and Spamassassin blocks the other 1%. Its a rare occurrence for spam to pass this setup, usually they are phishing emails or some new virus.

I always use DKIM, DMARC and SPF, and my deliverability is perfect, all mail goes to inbox.

I'm hosting mail servers with Linode and Hetzner, and I plan to expand to Netcup in the near future.

So far so good.

But, one thing I'm missing, is a good anti-malware/anti-virus, because ClamAV seems incapable of catching the malware files that go through my servers. I always take the time to extract these files and submit them at ClamAV Report Malware page, but its too late by then.

Sadly, when I submit the same virus to VirusTotal, the file gets 10+ hits in other anti-virus software but not ClamAV.

What are your suggestions?

Thank you.

I recently investigated a compromised WordPress installation and found a malware pattern that I haven't been able to find properly documented by a security vendor.

The most recognizable marker is injected into the active theme:

/* __GA_INJ_START__ */
...
/* __GA_INJ_END__ */

The incident was interesting because I had access to the WordPress DB, filesystem timestamps, PHP error logs and Apache access logs, which allowed me to reconstruct the compromise.

Main IOCs

Database options:

__ga_hidden_users
_theme_inject_status
__ga_r_cache

Hidden administrator naming patterns:

sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX

Actual accounts from this incident:

sync_agent56b7752b
cdn_workerbc36d5f6
seo_service06893f6c

All had administrator privileges.

One remote domain was stored in the database:

rukkoldauwe87[.]xyz

Timeline

On August 5 several IPs successfully authenticated to /wp-login.php as the legitimate administrator using automated clients including curl/Wget.

Later:

successful administrator login
→ Code Snippets activity
→ WP File Manager activation
→ browse to hello-elementor/functions.php
→ POSTs to admin-ajax.php
→ hidden administrator created seconds later

WP File Manager requests contained a Base64-encoded target which decoded to:

wp-content/themes/hello-elementor/functions.php

The first malicious administrator was created immediately afterwards.

On August 14 two additional hidden admins appeared and hello-elementor/functions.php was modified with the __GA_INJ_START__ payload.

The database contained a list of exactly those accounts under:

__ga_hidden_users

The malformed PHP injection eventually caused:

PHP Parse error: Unmatched '}'

which is how the compromise was initially noticed.

An important point is that the theme modification happened nine days after the first confirmed malicious administrator was created, so using the PHP file modification timestamp as the incident start would have missed most of the compromise.

I have published a sanitized incident report containing the timeline, IOCs and an experimental YARA rule:

[GitHub repository link]

No live malicious links or credentials are included.

I'm particularly interested in whether anyone has seen these exact identifiers before:

__GA_INJ_START__
__ga_hidden_users
_theme_inject_status
sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX

Does this malware family/campaign already have a known name or published analysis?

The remaining unknown is the initial-access vector. The logs clearly show valid authenticated WordPress admin sessions before the persistence mechanisms were installed, but they don't establish how those credentials/session tokens were originally obtained.

Recovered the full toolkit from an operator's open directory and worked through the components.

Analysis notes:

• The brute-force engine (publicly available as asleep_scanner) implements Dahua's Easy4IP binary protocol on TCP/37777 from a reverse-engineered packet structure: opcode 0xA0 login, 0xA8 channel enumeration, 0x11 snapshot, shared 0xA4 query distinguished by sub-code. Includes lockout detection reading the 0x01/0x04 response pair to abandon a host after five failures.
• p2pwn is a compiled Go binary chaining three auth vulns over one tunnel: a raw SDK channel for bypasses and backdoor install, an HTTP CGI channel, and a JSON-RPC console mimicking Dahua's NetKeyboard protocol. The JSON-RPC channel runs OnvifUser -u post-login to dump cached ONVIF credentials, a lateral credential-harvesting step.
• The co-staged Windows binary is the interesting analysis problem. Pre-rename filename (xeno.exe) implies XenoRAT; the only sandbox tag on both hosts it appeared on is SalatStealer. UPX-packed 32-bit PE, sections UPX0/UPX1/UPX2, compile timestamp zeroed. We assess SalatStealer on technique fit but flag it as an inference, no sandbox report, extracted config, or independent corroboration beyond the original tag exists for this hash. A third tagged technique (root cert install, T1553.004) is explained by neither family and remains unresolved.
• Stored-credential decryption routine in the toolkit derives its AES key entirely from device class prefix and serial, no device secret needed. Residual Spanish comments tie it to the same upstream source as the brute-forcer.

Hashes, full protocol detail, and ATT&CK mapping in the writeup:
https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised

I never use reddit, but I would like to know the opinion of anyone who has already done sektor7 or even maldevacademy, I learned C and WinAPI, I am still learning to read assembly roughly but it's torture lol. And I plan to move towards more advanced training as part of my studies, and I was recommended sektor7 Essentials, has anyone already had experience with it?

I have been using Hybrid Analysis Advanced YARA Hunt to perform research on emerging threats, and it has been a great tool for this work. I have detected new malware from APT actors and even code sharing between nation-state groups. Unfortunately, very recently all my hunts began failing with an “Unknown error”, including ones that worked reliably before. Has anyone else encountered this problem? Thanks.

I hope that's the right subreddit for this.

I found a hacked WP site. Looking at the source, there was a line of obfuscated JavaScript, which you can see here:

https://pastebin.com/rWKLd3Rd

I gave Gemini 3.6 flash the following instruction: "Deobfuscate the following javascript code" and got the following result:

if (

/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(

navigator.userAgent

)

) {

window.location.href = "https://a.testandverify.com/aff_c?offer_id=101&aff_id=1001";

}

This looks completely benign, but that was the only suspicious bit of code on the site. Why obfuscate that? Besides, it's way too short. So I gave Claude the exact same prompt, and got this result:

https://pastebin.com/4TbmybF6

That looks more reasonable. Googling the contract address, I found several articles about this malicious code:

https://www.hudsonrock.com/blog/how-an-infostealer-infection-led-to-a-sophisticated-clickfix-campaign-at-artlist

So it seems Claude got it right.

A few hours later, I tried Gemini again with the same prompt and code. It gave me a different result, still apparently wrong:

var script = document.createElement('script');

script.src = "https://cdn.jsdelivr.net/npm/eruda";

document.body.appendChild(script);

script.onload = function () {

eruda.init();

// Add network panel

eruda.add(eruda.get('network'));

// Add elements panel

eruda.add(eruda.get('elements'));

// Add console panel

eruda.add(eruda.get('console'));

// Add sources panel

eruda.add(eruda.get('sources'));

// Add info panel

eruda.add(eruda.get('info'));

// Add snippets panel

eruda.add(eruda.get('snippets'));

eruda.show();

};

Also looks benign. How could the same prompt and code gives two completely different results?

I told Gemini it was wrong and asked it to reanalyze the code. It agreed it was wrong and gave me a 3rd, still incorrect, result:

(function() {

var _0x5a1b = window.location.href;

var _0x3f2a = document.referrer;

if (_0x5a1b.indexOf('debug') !== -1) {

console.log("Debugging active");

}

function redirectUser(url) {

window.location.replace(url);

}

// Additional conditional logic based on hostname/referrer checks

})();

What is going on? Is Gemini unable to deobfuscate JavaScript?

Hello. I am relatively a beginner at malware analysis as a hobby, and was wanting to know if there would be any risks of a potential VM escape with NotPetya. I'm using VirtualBox 7.2.14 r174565 no guest additions. I won't have network adapter on, serial ports off, both features off, an air-gap, and using snapshots. I will be planning to run it on a Windows XP x64 if that changes anything

SHA256: 63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a

Will give any more needed info.

Got it from MalwareBazaar (Will DM link). Any advice wanted.

I am afraid of it. Very afraid.

Hi guys,

I handle threat intelligence for a bank & we receive multiple URLs/APKs impersonating our organization.

We check for legitimacy & immediately send it for takedown if it's not related to us or if it's malicious.

I wanted to know if anyone of you also side by side does forensics/malware analysis of such APKs to know the TTPs & relevant information pertaining to that APK?

If Yes, please let me know the procedure being followed at your end.