Latest Linux Security News & Information

security advisoryauthentication bypassinfrastructure security

Fortinet FortiSandbox Critical Command Execution Risk Exploit 2026-39813

Fortinet has confirmed active exploitation of three FortiSandbox vulnerabilities . One allows attackers to bypass login controls, while the other two enable command execution directly on the appliance. Combined, they create a path from unauthenticated access to direct interaction with a system many organizations trust to analyze suspicious content. . In many environments, FortiSandbox sits between incoming content and the systems responsible for making security decisions about it. Before a user opens a file or a detection reaches an analyst, there is often another layer examining that content first. When attackers compromise this infrastructure, they aren't just accessing another appliance; they are gaining influence over the systems responsible for threat detection and response. Attackers Are Targeting the Infrastructure Behind Threat Detection FortiSandbox isn't a standard portal or employee-facing application. It’s built to inspect files, URLs, and attachments that have already raised suspicion elsewhere. The verdict generated by a sandbox rarely stays local; analysis results are forwarded to email security platforms, SIEMs, threat intelligence feeds, and automated response workflows. FortiSandbox sits at this junction, meaning one analysis engine influences multiple systems simultaneously. A compromise changes the math entirely. Attackers aren't just hitting one appliance; they’re gaining influence over the infrastructure that determines what gets flagged, blocked, or ignored. This is an infrastructure security issue—the target is the technology supporting malware analysis, threat detection, and broader security operations. Active Exploitation of FortiSandbox Vulnerabilities Impacts Security Operations Attackers are actively weaponizing three specific FortiSandbox vulnerabilities: CVE-2026-39813 : An authentication bypass via the platform's API. CVE-2026-39808 & CVE-2026-25089 : Command injection flaws allowing unauthenticated code execution. Thesevulnerabilities are being exploited shortly after disclosure. For a security operations center, this is critical because these platforms are foundational to threat detection and response workflows. When the tools designed to identify threats become targets, the integrity of the data supporting your security decisions is compromised. How the FortiSandbox Vulnerabilities Work The vulnerabilities affect different components of the platform, but the outcome is the same: attackers gain access to systems designed to analyze suspicious content. Attackers Can Bypass Login Controls One vulnerability affects the platform's API, allowing attackers to bypass authentication. Crafted requests grant access to administrative functions that should remain restricted, removing the boundary that separates a trusted administrator from an external threat. Command Injection Creates a Direct Path Into the Underlying System The more serious flaws allow for direct command execution on the appliance. For a Linux-based appliance, command execution is an infrastructure security failure. Once attackers run commands on the host, they can modify configurations, access stored data, or use the appliance as a foothold for further network movement. Remote Command Execution Can Affect Multiple Environments These flaws affect FortiSandbox deployments across on-premises, cloud, and platform-based environments. The long-term risk isn't just the device itself, but the potential to corrupt the malware analysis results being fed into the rest of your environment. How Compromised Malware Analysis Systems Impact Threat Detection and Response A compromised sandbox affects every system consuming its output. Modern security operations teams process more alerts than an analyst can review manually, relying heavily on automated systems to classify threats. Malware Analysis Systems Often Sit at the Center of Threat Detection and Response Malware analysis infrastructure is a core component of threat detection and responseprograms. A sandbox detonate files, observes behavior, and issues a verdict. If the platform issuing that verdict is compromised, the data shared with SIEMs, SOAR tools, and incident response workflows can no longer be trusted. Compromised Malware Analysis Systems Create Dangerous Detection Blind Spots The risk is often uncertainty rather than a loud system failure. Automated workflows continue to run and analysts continue to investigate, but the platform producing the decisions is compromised. Effective advanced threat detection depends on reliable analysis. When attackers gain access to the systems producing that analysis, they create blind spots exactly where defenders need visibility most. Malware Analysis Platform Risks for Linux and Cloud Infrastructure For Linux and cloud teams, this is an infrastructure security issue, not an endpoint problem. FortiSandbox Runs on Linux-Based Infrastructure FortiSandbox uses a hardened Linux-based operating system. Because the vulnerabilities allow command execution, the underlying platform is directly in scope. Once an attacker runs commands on a trusted security appliance, they are no longer attacking from the outside; they have established a foothold inside the infrastructure responsible for protecting the environment. Enterprise Cloud Infrastructure Security Often Depends on These Platforms Organizations run Linux workloads across cloud, Kubernetes, and hybrid environments. These platforms rely on automated malware analysis to inspect content before it hits production. Compromising a sandbox is more valuable than targeting individual workloads, as the sandbox sits upstream, making the calls on what the cloud environment should trust. How Organizations Should Protect Threat Detection and Response Systems Patching is step one. If you suspect your environment has been exposed, assume a breach. Identify and Patch: Locate all FortiSandbox deployments and apply updates immediately. Audit Logs: Review administrative activity andsystem logs for unexpected access or command execution. Validate Integrity: Audit the information flowing out of the platform. If compromise is suspected, verify that analysis results and automated actions are not being manipulated. Assess Downstream Impact: Once a system supporting threat detection and response is compromised, your investigation must extend into the broader security operations ecosystem connected to it. FAQ What is FortiSandbox used for? FortiSandbox is a malware analysis platform. It inspects suspicious files, URLs, and attachments in an isolated environment to identify malicious behavior before the content hits production systems. How can FortiSandbox vulnerabilities affect threat detection? FortiSandbox sits upstream of multiple security tools. A compromise allows attackers to interfere with the intelligence used to support threat detection and response decisions throughout the environment. Why do security operations centers rely on malware analysis platforms? A modern security operations center manages too many alerts for manual review. These platforms automate the classification of threats and enrich alerts, providing the data necessary for incident response. How do compromised security tools impact threat detection and response? Because analysis engines are integrated with monitoring and automation tools, a compromise poisons the entire threat detection pipeline, resulting in unreliable data and widespread blind spots. Why is infrastructure security becoming a larger target for attackers? Security platforms have broad visibility and influence. Attackers target trusted components of the infrastructure security stack to gain a force multiplier, influencing how threats are handled across the entire network. Want more Linux security news, malware research, and threat detection analysis? Subscribe to the LinuxSecurity Newsletter and get the latest vulnerabilities, attack techniques, security advisories, and expert insights delivered directly to yourinbox. Related Reading Proxies & Open Source Tools for Enhanced Threat Intelligence Innovations In Sandboxing Methods For Enhanced Malware Defense Rising Malware Threats to Linux: Risks and Security Strategies . Three critical FortiSandbox vulnerabilities allow attackers to bypass authentication and execute commands, risking security systems.. FortiSandbox vulnerabilities, command injection FortiSandbox, infrastructure security issues, malware analysis risks, authentication bypass threats. . MaK Ulac

Jun 18, 2026 •

MaK Ulac Security Vulnerabilities

security researchLinux toolmalware analysis

Open-Source Screen Recorders: Documenting Malware and Exploits

For information security researchers, there is a continuous effort to improve methods of detecting and documenting vulnerabilities. One of the main tools in that direction is open-source screen recorders . Screen recorders simplify recording the vulnerability exploitation process, tracking malware activity, and publishing Proof of Concepts (PoCs) to the world, which is used to improve the overall level of cybersecurity . . Applications of Screen Recorders for Security Research Currently, several screen recording programs are available. When you choose a proper screen recorder , consider some essential aspects, which we'll list below. However, before doing that, let's examine the security research process in more detail. Documenting Vulnerabilities and Exploits Screen recording applications allow you to create a step-by-step video report that captures all the steps of the process in real-time. For example, when dealing with vulnerabilities such as buffer overflow, you can document the preparation of the test environment, the setup of the virtual machine, and the exploitation phase itself. The high quality of the recording and the ability to add annotations allow viewers to not only watch what is happening on the screen but also understand why the researcher is performing each action. Recording Malware Behavior During Analysis If you execute a suspicious executable within a sandbox, you can monitor all the changes, from new processes being visible to modifications in system files and registry settings. Not only can you document the behavior of Linux backdoor malware , but also comparative analysis of attacks . Synchronizing the recording with analysis tools such as Wireshark or Process Monitor also enables you to correlate visual data with technical data. Capturing and Sharing Proof of Concepts (PoCs) with the Community Creating and demonstrating Proof of Concepts (PoCs) using screen recording software allows you to showcase a vulnerability in action, demonstrate potentialrisks, and suggest ways to mitigate them. But first, you need to: Select an appropriate open-source screen recorder: OBS Studio, SimpleScreenRecorder, Kazam, or VLC Media Player; Configure settings: Adjust the recording settings to ensure high-quality captures (all screen/specific windows, framerate, fps, etc.); Set up a test environment: Ensure you have an isolated and controlled environment for documenting vulnerabilities and exploits or recording malware behavior. After editing the video material (trimming unnecessary fragments and adding comments), the PoC can be published on specialized platforms such as YouTube or Vimeo or shared in professional forums and communities. Comparative Analysis of Popular Open-Source Screen Recorders for Researchers When selecting an instrument, consider the specifics of your research and the operating system's functionality. These are the key features of some of the most popular software products: OBS Studio SimpleScreenRecorder XVidCap Supported OS Windows , macOS , Linux Linux Linux (X Window System) Interface Complex but multifunctional A simple but little customization Minimalistic but outdated System load High Low Low Main advantages Advanced scene handling, annotation support (via plugins), multiple audio/video sources; great for demonstrating complex exploits and vulnerabilities High-quality recording, flexible output settings; simplicity allows you to stay focused on settings during testing Basic recording features: suitable for quick demos but does not support annotation and multithreaded sources Output formats Various formats, including MP4, MKV, FLV, and others MKV, MP4, WebM, OGG Mostly AVI (limited format support) Techniques and Tips for EffectiveScreen Recording in Research To make screen recording as effective as possible, follow these rules: #1. Optimize Recording Settings Select high resolution and high frame rate to be able to capture detailed information, which is particularly crucial when showing intricate processes. It is also crucial to think about video encoding parameters that depend on the eventual audience and platform where the video will be published. For instance, MP4 is best for streaming online and publishing on YouTube, while MKV could be used for lab usage internally. #2. Organize and Label Your Recordings Organize recordings by project, date, and research type. Instead of using generic names such as "recording1," use descriptive names that reflect the nature of the recording, e.g., "buffer_overflow_demo_2026-07-21." Also, remember to add text annotations or graphics overlays. This makes the content more understandable and makes it easier to remember research details in the long run. #3. Ensure Data Privacy and Security When sharing recordings with colleagues, make sure the videos do not record sensitive data such as IP addresses, logins, passwords, or other identifying data. Encrypt and use protection from access when sharing recordings in closed networks, utilizing industry-standard encryption methods such as AES-256 or TLS to secure transmissions. Additionally, role-based access control (RBAC) and multi-factor authentication (MFA) should be implemented to ensure that only authorized personnel can view sensitive recordings. Always adhere to legal norms to prevent violating laws or corporate security guidelines. Bottom Line The use of open-source screen recording software opens up new opportunities for cybersecurity researchers . Ultimately, integrating visual documentation into security procedures is not just a convenient luxury but an actual necessity for modern researchers. Thus, every researcher can contribute to creating a safer digital world. . Delve into key open-source screencapturing tools vital for cybersecurity research, chronicling malware analysis, and disseminating knowledge.. screen recording software, malware documentation, security tools. . MaK Ulac

Feb 27, 2025 •

MaK Ulac Security Vulnerabilities

Banner 2 1028x280 1708121730 1 1771599631

Linux securityrootkitthreat detection

PUMAKIT Rootkit Analysis: Multi-Stage Malware and Evasion Techniques

The recently discovered PUMAKIT loadable kernel module (LKM) rootkit stands out as an advanced example of multi-stage malware, operating over multiple stages to avoid detection and establish control on targeted systems. It does not simply plant malicious software; instead. It involves an intricate web of activities starting with droppers, memory executables, and rootkits before finally arriving at its final goal - complete control. . Beyond its multilayered architecture, PUMAKIT employs sophisticated evasion techniques to remain undetected. These include hooking into system calls, hiding files and processes from users' views, and altering credentials to maintain control. In this article, we will explore both its multistage structure and the tactics used to remain hidden. This analysis will explain how PUMAKIT operates so you can detect and defend against such advanced threats to your Linux systems. Understanding Multi-Stage Malware An understanding of multi-stage malware is necessary to fully comprehend PUMAKIT's complexity. Unlike traditional forms of malware that execute one action at a time, multi-stage threats typically carry out attacks over multiple stages. This starts with initial infections followed by escalated actions designed to ensure they become deeply entrenched within a system. PUMAKIT begins its attack with a dropper, an item of malicious code designed solely to gain entry. Once executed successfully, this code fetches additional payloads--usually in-memory executables--prepared for later stages. Due to this multilayered approach, detection is far more challenging since each stage can be designed to bypass security measures. Examining PUMAKIT's Dropper PUMAKIT's dropper is the foundation of its multi-stage attack strategy. Think of it as an opening act that gives more sinister elements access. Once deployed, the Dropper ensures that system configuration allows further malicious payloads, whether exploiting vulnerabilities within or using social engineering tactics toconvince users to grant necessary permissions. Once inside, the dropper often uses various means to obscure its presence, including self-destructing after running, so security software has more difficulty tracking its source. This initial phase aims to establish the malware with minimum suspicion raised. Memory Executables: Silent Operators Once the dropper has accomplished its task, in-memory executables take over. Traditional malware often leaves traces easily identified by security software, while PUMAKIT's in-memory executables operate directly within RAM instead, making them harder to detect. Executables perform key tasks that set the foundation for rootkit deployment in their final stage: manipulating system processes, opening backdoors for remote access, or disabling certain security features. Stealth is key. Operating in memory enables these components to complete their mission without leaving an evidence trail that investigators could quickly discover and analyze. Unpacking PUMAKIT's Rootkits Step two in PUMAKIT's multi-stage attack involves installing rootkits - specifically LKM (Loadable Kernel Module) and Kitsune SO userland rootkits - into the system to allow attackers to access and control them persistently. Rootkits pose a particular danger because they operate at low levels within systems, enabling attackers to gain persistent control and access over them. The LKM rootkit integrates deeply within the kernel, the central portion of an operating system. It can intercept system calls, modify service behavior, and conceal itself and any related malicious activities from view. The Kitsune SO userland rootkit is another advanced rootkit adept at hiding processes, files, and network activities from regular security measures. Together, these rootkits form a formidable defense against detection, making it virtually impossible to spot compromised systems using standard measures alone. Advanced Evasion Techniques Modern Linux rootkits like PUMAKIT utilize sophisticatedevasion techniques to remain undetected, such as syscall hooking using ftrace. By hooking into system calls, they can manipulate what the system reports back to a user or admin. For instance, by intercepting system requests and returning false information, everything appears normal when, in fact, anything goes amiss. PUMAKIT utilizes anti-debugging strategies as another weapon against security analysts attempting to understand its behavior. By recognizing and counteracting attempts to debug its processes, PUMAKIT effectively blocks this type of analysis by looking for debuggers or using timing checks to detect irregularities that indicate monitoring activity. PUMAKIT excels at concealing network connections - which is essential for maintaining undetected access to the compromised system. By manipulating network stack data to hide its communication channels and ensure outbound traffic doesn't raise red flags, PUMAKIT can maintain an undetectable backdoor into compromised systems. Credential Modification: An Unseen Hand Credential modification is another underhanded tactic employed by PUMAKIT. By exploiting functions such as prepare_creds and commit_creds, the malware can escalate privileges or gain permissions that would usually be restricted - making it easier for attackers to commit other illegal actions without drawing too much attention to themselves. Once in place, rootkits can modify key system processes' credentials by giving them elevated permissions, effectively giving an attacker unbridled power while still remaining undetected by standard security protocols. Understanding PUMAKIT's Impact on Linux Security PUMAKIT and other multi-stage malware present significant security challenges to Linux system security, with traditional security measures often ineffective against such complex threats. First and foremost, in-memory executables and rootkits require shifting away from disk-based detection methods in favor of solutions that focus on behavioral analysis and memory forensics.Furthermore, regularly updating and patching systems against vulnerabilities that droppers may exploit is equally essential. Practical Detection and Mitigation Strategies for Admins Early detection of PUMAKIT relies on both stringent access controls and continuous monitoring. An intrusion detection system (IDS) , configured to identify unusual behavior, such as hidden network connections or unexpected credential modifications, can provide early warning. Due to the complexity of multi-stage malware like PUMAKIT, its detection and prevention requires a multifaceted approach. Implementing endpoint detection and response (EDR) solutions that monitor behaviors rather than signature-based threats will be more successful. Such solutions look for any abnormal system activity that might indicate that in-memory executables or rootkits are present on a system. Kernel integrity checkers can assist in detecting any modifications made by LKM rootkits that alter your kernel, making auditing and integrity checks part of any effective security strategy. Regular system audits should also be conducted. Tighter access controls may help delay or even prevent initial infiltration by droppers. Utilizing the principle of least privilege ensures that even if an attacker gains an entry point, their presence won't quickly expand without raising alarms. Our Final Thoughts on Addressing & Learning From PUMAKIT Cyberwar is constantly changing, and multi-stage malware like PUMAKIT offers attackers new avenues for exploitation. With its multiple layers of infection processes and advanced evasion techniques, PUMAKIT poses an extraordinary threat to security professionals. By understanding its operation- from initial dropper deployment to rootkit installation- you can better defend against it and prepare your systems against attack. Staying one step ahead of such advanced threats requires constant vigilance and in-depth knowledge of your system's normal operations and sophisticated detection tools. By adapting tothese complex threats and taking measures that combine traditional and modern security methods, you can significantly lower your risk and protect your Linux environment from multi-stage malware threats. . COSMICWIND poses a formidable threat to Linux security, employing layered strategies and sophisticated avoidance methods.. rootkit evasion techniques, multi-stage malware analysis, Linux threat detection. . Brittany Day

Dec 16, 2024 •

Brittany Day Hacks/Cracks

20.Lock AbstractDigital Circular Esm H240

data protectionopen sourcemalware analysis

Harnessing Proxies for Threat Intelligence Using Open Source Tools

Sensitive corporate data can be stolen at this very second; unfortunately, breaches can be invisible. As cyber threats multiply at an exponential rate, reacting to them like before no longer works. The answer lies in more innovative threat intelligence that enables preemptive action. The stakes are high: the 2024 IBM Cost of a Data Breach report shows that the average breach costs $4.45 million, and 82% of organizations suffer multiple breaches. However, many incidents never get reported, sometimes because of inadequate monitoring that leaves them undetected. Take, for example, a security analyst tracking suspicious traffic to an unfamiliar domain. Using a proxy, they uncover a phishing attack targeting sensitive company credentials. Without the right tools, that threat might have gone unnoticed. This guide will walk you through exactly how proxies can be combined with advanced, open-source tooling to revolutionize threat intelligence and posture you to anticipate and neutralize cyber threats before they strike. The Role of Proxies in Threat Intelligence Proxies are essential in threat intelligence, as they always enable researchers to analyze traffic without direct exposure to malicious traffic. For example, ISP proxies , which come directly from internet service providers, mimic real user traffic, making the threat investigation more authentic and less likely to raise suspicion. Key Functions of Proxies We all know how critical it is to stay ahead with regard to threats. Proxies are the trump card in this persistent fight. They can act like an additional pair of eyes when investigating network traffic without revealing our presence to any adversary. If you can tap proxies within the security framework, early warnings of malicious intent, if any, could be noticed, anomalies unmasked, and vulnerabilities pointed out with third-party compliance. Traffic Analysis Analyzing the incoming and outgoing data , proxies assist the researchers in identifying howmalicious actors behave and where the threats are located. They can also identify anomalies or suspicious data transfers that can help in Infrastructure protection to avoid breaches. Anonymity and Deception A proxy allows people to conceal their IPs and locations for research or investigations. It also helps security teams replicate users' behavior and collect intelligence about suspected threat actors’ activity, which helps researchers better study threats. Malware Analysis Proxies can be used to safely handle the links or files, probably required for research work, which could be harmful because the researcher is protected from the direct implications of the proxies. It also captures other important information related to malware activity and interaction, such as with CnC servers, which can be helpful when conducting investigations. Traffic Analysis with Proxies Threat identification and mitigation are essential parts of traffic monitoring and analysis. Proxies add an extra layer of security to prevent the researcher's system from being compromised. Importance of Monitoring Incoming and Outgoing Traffic Staying vigilant with network traffic is crucial to our roles as Linux and IT admins. Monitoring incoming and outgoing traffic lets you catch early signs of malicious activity, safeguarding our systems before threats escalate. Analyzing traffic patterns will enable you to spot anomalies such as data exfiltration , phishing attempts, or malware communications, giving you valuable insights into potential security breaches. Effective traffic surveillance helps identify the weaknesses in a network that an attacker can use to their advantage and ensure that practices are aligned with industry standards and government regulations to avoid fines for non-compliance. You can further enhance your monitoring using proxies for an added layer of security so the threat intelligence stays strong and our systems are better protected. Traffic analysis, with the help of tools like squid andMITM proxy, helps keep your network infrastructure secure and, as such, makes it more effective. If you know the complete concepts of overall traffic monitoring, that can definitely help you in the proactive defense of our networks by keeping our organizational data intact. Early Threat Detection : It is effective in traffic surveillance as it can detect noticeable signs of malicious attacks and control them before they become serious risks. Anomaly Identification : When both inbound and outbound traffic are monitored, information exfiltration, data theft, phishing, or malware traffic can be spotted. Vulnerability Identification : Traffic analysis provides insight into the network organization, discovering potential risks attackers may otherwise exploit. Compliance Monitoring : Traffic standards, best practices, and government regulations can help an organization avoid penalties arising from non-compliance. Open Source Tools for Traffic Analysis As fellow Linux admins, we have learned how to have the proper tools on one's side for any occasion. In the case of traffic analysis, it is barely possible to do without open-source solutions from Squid or Mitmproxy. Squid does its job well in monitoring web traffic, thus helping you efficiently notice unusual patterns. Mitmproxy is probably better for deep analyses of encrypted HTTPS traffic. These utilities continue to enable you to locate and reroute threats and provide community-driven support upon which we depend to protect our systems. Let's dive into how these open-source solutions can amplify our threat intelligence efforts. Squid Squid is a powerful HTTP server and cache that is ideal for web traffic analysis. It empowers security specialists to track and analyze web requests to distinguish irregularities. Mitmproxy Short for Man-in-the-Middle Proxy, Mitmproxy is an ingenious interactive HTTPS proxy that allows the researcher to monitor, alter, and analyze web traffic in real-time. One of the tool's most significantstrengths is its ability to evaluate encrypted traffic, which cyber criminals frequently employ to hide their activities. Ensuring Anonymity and Deception The identity of the parties involved in threat intelligence investigations should be protected. This safety is done by masking an IP address and location, thereby bringing the advantages of proxies and assisting a researcher in gaining access to dangerous sites or tracking a suspect without revealing the individual’s identity. Importance of Anonymity for Security Researchers Protection from Retaliation : This keeps the persons involved in research unknown to the attackers, thereby minimizing attacks or harm. Safe Exploration of Malicious Domains : Researchers can access and work with potentially malicious sites, threads, or files without endangering their authentic selves or systems to cybercriminals. Unbiased Data Collection : This allows researchers to capture data without influencing or changing attacker behavior, developing better threat intelligence. Open-Source Tools for Anonymity Tor (The Onion Router) Tor is perhaps the most famous network for anonymizing connections to the Internet using multiple volunteer-operated servers located globally. Another advantage of Tor is its extensive coverage, which is useful for blending in and avoiding detection during investigations. Malware Analysis with Proxies Analyzing malware is an integral part of threat intelligence, and using proxies is a good practice when working with potentially harmful content. They help researchers analyze traffic between the hosting of malicious websites and infected hosts, allowing the discovery of Command and Control (C&C) servers or other IoCs. Proxies offer a controlled environment required to investigate malware and its behaviors, including its transmission and communication. This is critical when identifying the best strategies to contain a practically unobservable threat. Safely Analyzing Malicious Websitesand Downloads Proxies are beneficial in safely researching and studying potentially risky websites and files. They are a barrier between the researcher and threats. With such websites, proxies capture and forward the traffic and keep the researcher’s system from malicious activity. Likewise, proxies assist in tracking downloads. Although they allow the researcher to examine malicious files, they do not permit their running on the researcher’s network. This isolation is crucial in malware analysis and threat intelligence, as the operative space is restricted and controlled. Open-Source Tools for Malware Analysis For us Linux and IT admins, having the right tools to dissect and understand malware is crucial. ClamAV and Av matching, combined with the Cuckoo Sandbox, are game-changers as open-source solutions in this arena. ClamAV brings robustness in terms of scanning and detecting malicious software at an antivirus level, whereas Cuckoo Sandbox maintains the environment for runtime dynamic analysis, observing malware behavior. Such tools allow you to save yourself from threats, share your findings with the community, and fortify your systems. Let's see how the usage of these open-source tools can increase our capability for malware analysis and defense. Cuckoo Sandbox Cuckoo Sandbox is an automated malware analysis system that emulates an environment for running files/URLs suspected of being malicious in nature. By integrating proxies like Squid or Mitmproxy, Cuckoo Sandbox can intercept the network traffic arising out of malware execution and produce a detailed report on the malware's activities. Integrating Proxies with Threat Intelligence Platforms Incorporating proxies with threat intelligence platforms adds value and efficiency to cybersecurity security. A proxy is a highly valued collection point for monitoring web traffic, malicious behavior, and indicators of compromise. When incorporated with systems like MISP (Malware Information Sharing Platform) or OTX (OpenThreat eXchange), proxy information enhances threat intelligence by mapping these internet traffic and domain-specific peculiarities with collective threat information. Enriching Threat Data with Proxy Logs Proxy logs contain helpful information that can help make threat intelligence more effective. When used with threat intelligence platforms, these logs can be run through the databases of known threats, and new threats and correlated patterns can be run against the previous attacks. Furthermore, proxy logs provide archival information, which is crucial for trace investigations conducted after an attack; this way, the teams learn threat tactics and improve their protection measures. Examples of Open Source Threat Intelligence Platforms Leverage threat intelligence platforms for active defense. MISP or OpenCTI are open-source and must be part of our toolkit. MISP allows organizations to share information about threats and correlate events, while OpenCTI is a sophisticated framework used for representing, managing, and analyzing knowledge about cyber threats. These platforms amplify our capabilities for threat detection while creating a collaborative environment where we share community-sourced intelligence to which we can contribute. Let's dive into how open-source platforms amplify our threat intelligence efforts. MISP (Malware Information Sharing Platform) MISP is one of the largest sources for sharing and correlating IoCs related to targeted attacks. Adding proxy logs into the mix will help other members add more context to the indicators shared via MISP by making them more accurate. For example, such proxy data can validate the fact that, yes, indeed, an IP address flagged as malicious is indeed pulling off malicious activities or is part of a botnet. Open Threat Exchange (OTX) OTX is a centralized threat-sharing platform that allows multiple organizations to exchange threat information. Proxy logs can be fed into OTX to give near real-time updates on active threats suchas new phishing campaigns or new strains of malware. Using Honeypots with Proxies When used with proxies, honeypots may also assist in detecting and analyzing malicious activities while guaranteeing that they do not impact the researcher’s natural systems. This setup is accompanied by proxies that log traffic between the attackers and the honeypot, which translates to possible attack methodologies, malware characteristics, and potential vulnerabilities in the system. Open-Source Honeypot Tools Honeypots are strategic methods of luring cyber threats for analysis. Cowrie and Dionaea are excellent open-sourced honeypot tools. Cowrie emulates a vulnerable SSH and Telnet environment that traps an attacker, while Dionaea catches malware by emulating vulnerable services. These will give an excellent insight into the methodology and pattern of the attack and enable you to control our security posture further. This helps you turn the tables against attackers and enhance our defenses through open-source honeypot tools. Let us now turn to how these help dig up and test threat intelligence effectively. Cowrie Cowrie is a medium-interaction honeypot that mimics SSH and Telnet servers. It can record all connections and the commands the attackers execute, which can shed light on the standard brute force attack strategies and methods for malware distribution. Dionaea Dionaea is another honeypot used to capture malware that targets system vulnerabilities. With the help of the proxy, Dionaea can safely forward the malicious traffic to the honeypot while the actual system remains unharmed. The proxy logs can also show trends in malware distribution—consecutive tries to scan certain software vulnerabilities, for example. Keep Learning about How to Harness Proxies for Threat Intelligence When it comes to threat intelligence, proxies are a completely irreplaceable tool. They allow the researcher to investigate and analyze traffic, remain anonymous, communicate with adversarial parties,and obtain valuable data, all while minimizing personal and system vulnerabilities. Coupled with open-source tools, proxies raise the bar of this service by offering cost-effective, adaptable, and community-supported solutions to multiple threat intelligence operations. Integrating proxies into your threat intelligence framework enhances your organization's security and helps combat increasingly advanced cyber threats. . . Utilize virtual private networks to amplify security insights through sophisticated publicly available software and proactive safeguarding methodologies.. threat Intelligence tools, proxies for analysis, open source security, malware investigation, traffic analysis tools. . MaK Ulac

Nov 24, 2024 •

MaK Ulac Network Security

security practicesmalwarecyber threat

Ebury Malware Analysis: Key Risks for 400K Linux Servers

As cybersecurity practitioners, we are no strangers to the constant threat of malicious actors and the importance of remaining vigilant to protect our systems. Security researchers have identified a massive botnet comprising over 400,000 compromised Linux servers, reinforcing the need to stay alert and implement robust security measures. Let's examine the significance of this discovery and what we can learn from it to protect against future attacks. . Why Is the Ebury Malware So Significant? What Can We Learn from This Threat? According to researchers, the botnet has been active since at least 2009, demonstrating the tenacity and persistence of the threat group behind the Ebury malware . The botnet has evolved significantly over the past decade, employing various techniques to propagate the malware and expand its reach. For example, the Ebury gang has leveraged access to hosting companies’ infrastructure to install Ebury on all hosted servers, intercepted and redirected SSH traffic inside data centers to capture credentials, and automatically steals crypto wallets when victims log in. Of particular concern is the botnet's use for illicit financial gain, such as stealing financial data from transactional websites and cryptojacking to mine cryptocurrency on infected systems. Research also reveals the latest update to the Ebury malware family, version 1.8, which includes new ways to hide information, a new domain generation algorithm (DGA), and better userland rootkits that Ebury uses to hide from system admins. Linux admins must recognize the implications of these findings and take proactive steps to prevent compromise from the evolving Ebury threat. Maintaining patched systems and robust credential policies is critical, along with monitoring for indicators of compromise and implementing security best practices such as firewall configurations and regular software updates . Perhaps most importantly, we must remain vigilant and continue educating ourselves and others about the evolvingthreat landscape, ensuring we stay up-to-date with the latest security trends and techniques. Our Final Thoughts on the Ebury Malware The recent discovery of a massive botnet comprised of over 400,000 compromised Linux servers highlights the ongoing need for strong cybersecurity measures and constant vigilance. It is essential to recognize the evolving threat landscape and take proactive steps to prevent compromise, stay informed about the latest security trends, and educate others about the importance of security best practices. Failure to take such measures could have severe long-term consequences that could put sensitive financial and other data at risk. . The Ebury malware poses a major risk to Linux security, exploiting its botnet capabilities and increasing Linux-targeted attacks, emphasizing the need for better defenses. Ebury Botnet, Linux Malware, Cyber Threats, Cryptojacking, Server Security. . Brittany Day

Jun 03, 2024 •

Brittany Day Hacks/Cracks

command executionmalware analysisdata theft

StripedFly Malware Infects Over A Million Systems: Remote Access Threat

StripedFly malware is capable of grabbing screenshots and stealing passwords. . Cybersecurity researchers have discovered an “impressive” malware threat hiding in plain sight for half a decade. Called StripedFly, the malware’s earliest evidence of activity dates back to 2017, Kaspersky claims, where at one point it was discovered but dismissed as a “mere” cryptocurrency miner. However, a new investigation has shown that StripedFly is capable of a lot more than just mining cryptocurrency: it can execute commands remotely, grab screenshots and execute shellcodes, steal passwords and other sensitive data, record sounds using the integrated microphone, move to adjacent endpoints using previously stolen credentials, abuse the EternalBlue exploit to worm into other systems, and lastly - mine Monero. . Experts in cybersecurity have revealed the remarkable functions of StripedFly malware, which can effectively harvest confidential information and perform various operations.. StripedFly Malware, Remote Access Threat, Cybersecurity Analysis, Malicious Software. . LinuxSecurity.com Team

Oct 29, 2023 •

LinuxSecurity.com Team Hacks/Cracks

cyber threatssecurity incidentransomware

Exploring CL0p Ransomware's Threats to Linux Systems and Businesses

"Variants of CL0p were initially only found on Windows systems, but the gang also developed a Linux variant toward the end of 2022, reflecting the diversity of endpoint operating systems used by modern businesses. In an interesting, flawed technical glitch, security researchers noted that the Linux version’s encryption is easily reversible using a simple decryptor." . CL0p is a notorious name on the ransomware scene, and with good reason. The gang’s members have been responsible for a series of high-profile attacks since security researchers first spotted their ransomware strain in the wild back in 2019. Our internal data shows that CL0p continues to cause havoc and will likely supplant LockBit as the top ransomware gang in 2023. Here is a deep dive into the CL0p ransomware and the gang’s attacks. CL0p is the name given to a group of Russian-speaking threat actors who use a ransomware strain that appends the extension .CL0p onto encrypted system files. The gang’s members tweaked a previously used ransomware strain known as CryptoMix to create ransom.CL0p. The group is financially motivated and began its operations by targeting businesses earning at least $5 million in annual revenues. Among the techniques used in traditional CL0p ransomware attacks are local file deletion, evading sandboxes, downloading tools from external URLs and halting system processes. Attacks commonly feature the Truebot tool, which collects and transmits information about the local system in addition to loading malicious shell code and other program modules. The popular adversary simulation tool Cobalt Strike helps CL0p threat actors expand their network access to multiple systems. The link for this article located at Security Boulevard is no longer available. . The LockBit ransomware group broadens its approach by targeting macOS systems, exploiting vulnerabilities and wreaking havoc throughout networks.. CL0p Ransomware, Linux Malware, Threat Actors, Cybercrime, EndpointSecurity. . LinuxSecurity.com Team

Aug 21, 2023 •

LinuxSecurity.com Team Hacks/Cracks

remote accesscyber threatmalware analysis

Barracuda Email Security: Exploitation Of SUBMARINE Backdoor Threat

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday disclosed details of a "novel persistent backdoor" called SUBMARINE deployed by threat actors in connection with the hack on Barracuda Email Security Gateway (ESG) appliances. . "SUBMARINE comprises multiple artifacts — including a SQL trigger, shell scripts, and a loaded library for a Linux daemon — that together enable execution with root privileges, persistence, command and control, and cleanup," the agency said . The findings come from an analysis of malware samples obtained from an unnamed organization that had been compromised by threat actors exploiting a critical flaw in ESG devices, CVE-2023-2868 (CVSS score: 9.8), which allows for remote command injection. Evidence gathered so far shows that the attackers behind the activity, a suspected China nexus-actor tracked by Mandiant as UNC4841, leveraged the flaw as a zero-day in October 2022 to gain initial access to victim environments and implanted backdoors to establish and maintain persistence. To that end, the infection chain involved sending phishing emails with booby-trapped TAR file attachments to trigger exploitation, leading to the deployment of a reverse shell payload to establish communication with the threat actor's command-and-control (C2) server, from where a passive backdoor known as SEASPY is downloaded for executing arbitrary commands on the device. SUBMARINE, also codenamed DEPTHCHARGE by the Google-owned threat intelligence firm, is the latest malware family to be discovered in connection with the operation. Executed with root privileges, it resides in a Structured Query Language (SQL) database on the ESG appliance. The link for this article located at The Hacker News is no longer available. . AQUANAUT infiltration tactic leverages SQL procedures and code, targeting a significant vulnerability in Cisco Web Security Appliances.. Barracuda Email Security,SUBMARINE,Command Injection,Cyber Threat. . LinuxSecurity.com Team

Jul 29, 2023 •

LinuxSecurity.com Team Hacks/Cracks

Community Poll

More Polls

Should Linux servers automatically install security updates?

Yes — critical security patches should install automatically.
No — every update should be tested before deployment.
Only critical vulnerabilities should auto-install.
I patch when Reddit starts panicking.

Stay Ahead With Linux Security News

Refine news

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending News

Misuse of Cron Jobs for Long-Term Access in Linux Environments

Risks of GitHub Repo Breach on Linux Supply Chain Security

After Years of Supply Chain Attacks, npm Is Finally Closing the Door on Auto-Scripts

FFmpeg PixelSmash Vulnerability Exposes Linux Media Servers to Remote Code Execution Risk

Explore Latest Linux Security news

Fortinet FortiSandbox Critical Command Execution Risk Exploit 2026-39813

Open-Source Screen Recorders: Documenting Malware and Exploits

PUMAKIT Rootkit Analysis: Multi-Stage Malware and Evasion Techniques

Harnessing Proxies for Threat Intelligence Using Open Source Tools

Ebury Malware Analysis: Key Risks for 400K Linux Servers

StripedFly Malware Infects Over A Million Systems: Remote Access Threat

Exploring CL0p Ransomware's Threats to Linux Systems and Businesses

Barracuda Email Security: Exploitation Of SUBMARINE Backdoor Threat

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending News

Misuse of Cron Jobs for Long-Term Access in Linux Environments

Risks of GitHub Repo Breach on Linux Supply Chain Security

After Years of Supply Chain Attacks, npm Is Finally Closing the Door on Auto-Scripts

FFmpeg PixelSmash Vulnerability Exposes Linux Media Servers to Remote Code Execution Risk

Powered By

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

QUICK LINKS

subscribe to newsletters!

Stay Ahead With Linux Security News

Refine news

Topics

Category

Authors

Published Date

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending News

Explore Latest Linux Security news

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending News

Search Topics

Powered By

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

QUICK LINKS

subscribe to newsletters!