Malware

Intrusions discovered earlier this week commenced with the delivery of a malicious email purporting to be from a CrowdStrike employment agent that includes a link for downloading an employee CRM app, which when clicked redirected to a CrowdStrike-spoofing website offering Windows and macOS versions of the app, according to CrowdStrike.

Any sense that macOS computers are immune from attacks is a farce, say security researchers.

Included in the discovered web shells were China Chopper — which is a fixture among advanced persistent threat operations — c99shell, and r57shell, as well as a backdoor that integrated Lazarus Group-like capabilities, according to a report from WatchTowr Labs.

After performing client app initialization, NonEuclidRAT — which has been proliferating in the dark web since late November — conducts detection bypass checks and establishes a TCP socket while adding Microsoft Defender Antivirus exclusions and leveraging Windows API calls for process enumeration.

Hackers have set up a botnet based on exploitation of zero day in Four-Faith industrial routers.

Vulnerable Illumina iSeq devices, which lacked firmware read and write protections and had Secure Boot disabled, could be subjected to privileged escalation attacks and subsequent arbitrary code execution in their firmware, according to an Eclypsium report.