Petya Ransomware Spreading Rapidly Worldwide, Just Like WannaCry

Petya Ransomware Spreading Rapidly Worldwide, Just Like WannaCry

According to multiple sources, a new variant of Petya ransomware, also known as Petwrap, is spreading rapidly with the help of same Windows SMBv1 vulnerability that the WannaCry ransomware abused to infect 300,000 systems and servers worldwide in just 72 hours.

Petya reboots victims computers and encrypts the hard drive's master file table (MFT) and rendering the master boot record (MBR) inoperable, restricting access to the full system by seizing information about file names, sizes, and location on the physical disk.

Petya replaces the computer's MBR with its own malicious code that displays the ransom note and leaves computers unable to boot.

Oops: Microsoft's "Super-secure" Windows 10 S Hacked In 3 Hours

Oops: Microsoft's "Super-secure" Windows 10 S Hacked In 3 Hours



With the launch of Windows 10 S, Microsoft claimed that it’s an extra-secure operating system that’s protected against all kinds of ransomware. To test the claims, folks at ZDNet hired a security firm. As a result, the hackers were able to breach Windows 10 S within 3 hours by using Microsoft Word’s handling of macros.

Create macro based word file

put it on windows share

Access it from victims computer 

MS10 S pawnd 

32TB of Windows 10 internal builds, core source code leak online

32TB of Windows 10 internal builds, core source code leak online

The data – some 32TB of official and non-public installation images and software blueprints that compress down to 8TB – were uploaded to betaarchive.com, the latest load of files provided just earlier this week. It is believed the confidential data in this dump was exfiltrated from Microsoft's in-house systems around March this year.

The leaked code is Microsoft's Shared Source Kit: according to people who have seen its contents, it includes the source to the base Windows 10 hardware drivers plus Redmond's PnP code, its USB and Wi-Fi stacks, its storage drivers, and ARM-specific OneCore kernel code.

Anyone who has this information can scour it for security vulnerabilities, which could be exploited to hack Windows systems worldwide. The code runs at the heart of the operating system, at some of its most trusted levels.

I would suggest people to move on from windows 10 to other Operating system before it's too late

Brutal Kangaroo: CIA-developed Malware for Hacking Air-Gapped Networks Covertly

Brutal Kangaroo: CIA-developed Malware for Hacking Air-Gapped Networks Covertly



It has been created for Microsoft Windows that targets "closed networks by air gap jumping using thumb drives," mainly implemented in enterprises and critical infrastructures.



The newer version was using "unknown link file vulnerability (Lachesis/RiverJack) related to the library-ms functionality of the operating system."

A Decade Old Unix/Linux/BSD Root Privilege-Escalation Bug Discovered

A Decade Old Unix/Linux/BSD Root Privilege-Escalation Bug Discovered



Stack Clash

Each program running on a computer uses a special memory region called the stack. This memory region is special because it grows automatically when the program needs more stack memory. But if it grows too much and gets too close to another memory region, the program may confuse the stack with the other memory region. An attacker can exploit this confusion to overwrite the stack with the other memory region, or the other way around.



7 proof of Local exploit available



Affected systems  (Confirmed):

• Sudo on Debian, Ubuntu, and CentOS
• ld.so and most SUID-root binaries on Debian, Ubuntu, Fedora, and CentOS
• Exim on Debian
• rsh on Solaris 11 and so on
• Red Hat Enterprise

Patches are available from major distributions.

New PowerPoint malware delivery technique tested by spammers - Help Net Security

New PowerPoint malware delivery technique tested by spammers - Help Net Security

A spam run detected by several security companies has attempted to deliver malware through an innovative technique: a link in a PowerPoint slideshow.

The attack steps like this:

• A malicious Microsoft PowerPoint Open XML Slide Show (PPSX) or PowerPoint Show (PPS) is delivered attached in a bogus email (invoice, purchase order, what have you)
• Victims download the file and run it, and are faced with a single text link (or hyperlinked picture) in the file
• They are puzzled by it, and hover with the mouse’s pointer over it in order to discover where the link will take them
• That simple move triggers a mouseover action that leads to a security warning pop-up (Microsoft disables the content of suspicious files by default via Protected View)
• Users who are still curious and allow the program to be run, either by clickling the Enable All or Enable button, start a chain reaction: an embedded malicious PowerShell script is executed that downloads another downloader in the form of a JScript Encoded File (JSE), which retrieves the final payload from a C&C server (in this case, a banking Trojan).

New Fileless Ransomware with Code Injection Ability Detected in the Wild

New Fileless Ransomware with Code Injection Ability Detected in the Wild

Security researchers have recently discovered a new fileless ransomware, dubbed "Sorebrect," which injects malicious code into a legitimate system process (svchost.exe) on a targeted system and then self-destruct itself in order to evade detection.

Unlike traditional ransomware, Sorebrect has been designed to target enterprise's servers and endpoint. The injected code then initiates the file encryption process on the local machine and connected network shares.

This fileless ransomware first compromises administrator credentials by brute forcing or some other means and then uses Microsoft’s Sysinternals PsExec command-line utility to encrypt files.

"PsExec can enable attackers to run remotely executed commands, instead of providing and using an entire interactive login session, or manually transferring the malware into a remote machine, like in RDPs," Trend Micro says.