eCPTX - Advanced Penetration Testing

 

The eCPTX - Advanced Penetration Testing course from the popular eLearnSecurity Institute and INE is Advanced Penetration Testing. Prerequisites for this course Completion of eJPT and eCPPTv2 Is. The eCPTX course is one of the most popular and difficult courses in the field of penetration testing. This course has four sections including 1. Preparing for attacks | 2. Test the penetration of Active Directory Red Teaming and 3. Red Teaming on important infrastructures | 4. Evasion or bypassing techniques. In this course you will gain a deep understanding of the Red Team, Backdoor, client-side exploitation, build personalized Payloads, Active Directory penetration testing, Evasion techniques of defense tools such as anti Viruses or IDS / IPS, complete scrutiny of the target to find misconfigurations and weaknesses, as well as covert operations and stability. The eLearnSecurity Institute Roadmap is included in the High Quality Images section.

Course pre requisites

• EJPT  course
• ECPPTv2 course 
• Course specifications
• Course level: Advanced
• Time: 7 hours and 57 minutes
• Includes: ‌ 9 videos | 8 labs | ‌ 7 slides
• Professor: Andres Doreste
• ECPTX Course Content - Advanced Penetration Testing
• Preparing the Attack
• Social Engineering Attack Vectors
• Red Teaming Active Directory
• Advanced Active Directory Reconnaissance & Enumeration
• Red Teaming Active Directory
• Red Teaming Critical Domain Infrastructure
• Red Teaming MS SQL Server
• Red Teaming Exchange
• Red Teaming WSUS
• Evasion
• Defense Evasion

Link OFF Return Coming SOON

Read More

eCPPTv2 - Penetration Testing Professional

 

ECPPTv2 - Penetration Testing Professional from the popular eLearnSecurity Institute and INE is advanced penetration testing training. Prerequisite for this course is completion of the eJPT course . The eCPPTv2 course is one of the most popular courses in penetration testing. This course is comparable to the SEC560 course from the SANS Institute. This course teaches network penetration testing, web penetration testing, WiFi penetration testing and wireless networks, as well as operating system penetration testing. In this course, you will gain a deep understanding of Buffer overflow and Shellcoding, Windows and Linux exploitation, Post Exploitation, Pillaging. In this course you will learn about Ruby and Powershell to carry out attacks as well as build custom Metasploit tool modules and use them to carry out attacks.

Course prerequisites

• Beginner knowledge in networking topics, protocols used on the Internet
• Beginner knowledge in penetration testing topics
• Ability to read and understand code
• Course specifications
• Course level: Intermediate
• Time: 66 hours and 16 minutes
• Includes: ‌ 83 videos | 30 labs | ‌ 118 slides
• Master: Fabrizio Siciliano
• ECPPTv2 Course Content - Penetration Testing Professional
• System Security
• Architecture Fundamentals
• Assembler Debuggers and Tool Arsenal
• Buffer Overflows
• Shellcoding
• Cryptography and Password Cracking
• Malware
• Network Security
• Information Gathering
• Scanning
• Enumeration
• Sniffing & MitM Attacks
• Exploitation
• Post Exploitation
• Anonymity
• Social Engineering
• PowerShell for Pentesters
• PowerShell Fundamentals
• Offensive PowerShell
• Linux Exploitation
• Information Gathering
• Exploitation over the Network
• Post Exploitation
• Web App Security
• Information Gathering
• Cross Site Scripting
• SQL Injections
• Other Common Web Attacks
• Wi-Fi Security
• Prerequisites
• Environment Setup
• Wireless Standards and Networks
• Discover Wi-Fi Networks
• Traffic Analysis
• Attacking Wi-Fi Networks
• Wi-Fi as Attack Vectors
• Metasploit & Ruby
• Installation and Fundamentals
• Control Structures
• Methods, Variables, and Scope
• Classes, Modules, and Exceptions
• Pentesters Prerequisites
• Input Output
• Network and OS Interaction
• The Web
• Exploitation with Ruby
• Metasploit

Link OFF Return Coming SOON

Read More

New Malware Used by SolarWinds Attackers Went Undetected for Years

 

The threat actor behind the supply chain compromise of SolarWinds has continued to expand its malware arsenal with new tools and techniques that were deployed in attacks as early as 2019, once indicative of the elusive nature of the campaigns and the adversary's ability to maintain persistent access for years.

According to cybersecurity firm CrowdStrike, which detailed the novel tactics adopted by the Nobelium hacking group last week, two sophisticated malware families were placed on victim systems — a Linux variant of GoldMax and a new implant dubbed TrailBlazer — long before the scale of the attacks came to light.

Nobelium, the Microsoft-assigned moniker for the SolarWinds intrusion in December 2020, is also tracked by the wider cybersecurity community under the names UNC2452 (FireEye), SolarStorm (Unit 42), StellarParticle (CrowdStrike), Dark Halo (Volexity), and Iron Ritual (Secureworks).

The malicious activities have since been attributed to a Russian state-sponsored actor called APT29 (also known as The Dukes and Cozy Bear), a cyber espionage operation associated with the country's Foreign Intelligence Service that's known to be active since at least 2008.

GoldMax (aka SUNSHUTTLE), which was discovered by Microsoft and FireEye (now Mandiant) in March 2021, is a Golang-based malware that acts as a command-and-control backdoor, establishing a secure connection with a remote server to execute arbitrary commands on the compromised machine.

Mandiant also pointed out that Dark Halo actors had used the malware in attacks going back to at least August 2020, or four months before SolarWinds discovered its Orion updates had been tampered with malware designed to drop post-compromise implants against thousands of its customers.

In September 2021, Kaspersky revealed details of a second variant of the GoldMax backdoor called Tomiris that was deployed against several government organizations in an unnamed CIS member state in December 2020 and January 2021.

The latest iteration is a previously undocumented but functionally identical Linux implementation of the second-stage malware that was installed in victim environments in mid-2019, predating all other identified samples built for the Windows platform to date.

Also delivered around the same timeframe was TrailBlazer, a modular backdoor that offers attackers a path to cyber espionage, while sharing commonalities with GoldMax in the way it masquerades its command-and-control (C2) traffic as legitimate Google Notifications HTTP requests.

Other uncommon channels used by the actor to facilitate the attacks include —

• Credential hopping for obscuring lateral movement
• Office 365 (O365) Service Principal and Application hijacking, impersonation, and manipulation, and
• Theft of browser cookies for bypassing multi-factor authentication

Additionally, the operators carried out multiple instances of domain credential theft months apart, each time leveraging a different technique, one among them being the use of Mimikatz password stealer in-memory, from an already compromised host to ensure access for extended periods of time.

"The StellarParticle campaign, associated with the Cozy Bear adversary group, demonstrates this threat actor's extensive knowledge of Windows and Linux operating systems, Microsoft Azure, O365, and Active Directory, and their patience and covert skill set to stay undetected for months — and in some cases, years," the researchers said.

Read More

Cynet's Keys to Extend Threat Visibility

 

We hear about the need for better visibility in the cybersecurity space – detecting threats earlier and more accurately. We often hear about the dwell time and the time to identify and contain a data breach. Many of us are familiar with IBM's Cost of a Data Breach Report that has been tracking this statistic for years. In the 2021 report, IBM found that, on average, it takes an average of 212 days to identify a breach and then another 75 days to contain the breach, for a total of 287 days.

A new solution overview document provides insights on how XDR provider Cynet tackles the difficult problem of greatly improving threat visibility. Cynet takes a modern approach that includes a greater level of native technology integration and advanced automation purposely designed for organizations with smaller security teams than Fortune 500 organizations. A live webinar will discuss the same topic (Register here)

Cynet's Keys for Threat Visibility

Einstein said that the definition of insanity is doing the same thing over and over while expecting a different outcome. The old approach to threat visibility involving multiple protection technologies and trying to sift through a sea of alerts and information is obviously not working well. Cynet's different – and seemingly saner – approach to prevent, detect, and respond to modern-day threats involves several integrated capabilities.

According to the new Cynet solution overview, the following key technologies are used to provide extended threat visibility along with enhanced response capabilities.

Include Multiple Threat Detection Technologies

Cynet includes multiple prevention and detection technologies, all natively orchestrated in the platform:

• NGAV – Fundamental endpoint protection based on known bad signatures and behaviors.
• EDR – To detect and prevent more complex endpoint threats that bypass NGAV solutions.
• NTA – To detect threats that have made their way into the network and so-called lateral movement.
• UBA – To detect unusual activity that could signal stolen credentials, a rogue insider, or bots.
• Deception – To uncover intrusions that have bypassed other detection technologies
• CLM – To mine the extensive log data generated by IT systems.
• SSPM – To find and correct configuration errors in SaaS applications.

Coordinate All Signals

Making sense out of multiple detection technologies by integrating, coordinating, and prioritizing information was supposed to be the realm of Security Incident and Event Management (SIEM) technologies. Unfortunately, SIEM doesn't do well with real-time data and requires significant care and feeding.

XDR solutions, like Cynet's, are purpose-built to integrate real-time signals from multiple points of telemetry on a single platform. Cynet even includes an Incident Engine that automatically investigates threats to determine the attack's full scope and root cause.

Automate All Response Actions

Quickly and accurately identifying threats is a game-changer. The ability to automatically and fully eradicate identified threats is, well, a game-changer changer. This means security teams won't have to be burdened with lengthy investigations, which many don't have the time or skills to undertake. Cynet provides an extensive set of remediation actions across files, hosts, networks and users as well as remediation playbooks that can be configured to be invoked manually or automatically.

Provide Full MDR Oversight

Beyond the technology platform, Cynet offers all clients a full, 24x7 MDR service at no additional cost. This team continuously monitors client environments to ensure nothing dangerous is overlooked or mishandled. Having an expert team watching out for issues should put smaller organizations with smaller security teams at ease, knowing an expert team of cybersecurity experts has their backs.

In With the New

With the time required to identify and contain data breaches steadily increasing, we need to rethink the traditional cybersecurity approach. It seems companies keep throwing more money, more technology, and more bodies at the problem, yet achieving the same (or worse) results. Cynet is one company that seems to be approaching the problem differently by combining multiple prevention, detection, response, and automation capabilities on a single, unified breach protection platform. Rather than buying all this stuff separately and munging it all together, the Cynet platform seems to expand and improve threat visibility out of the box.

Download the solution brief here

Read More

Hacker Group 'Moses Staff' Using New StrifeWater RAT in Ransomware Attacks

 

A politically motivated hacker group tied to a series of espionage and sabotage attacks on Israeli entities in 2021 incorporated a previously undocumented remote access trojan (RAT) that masquerades as the Windows Calculator app as part of a conscious effort to stay under the radar.

Cybersecurity company Cybereason, which has been tracking the operations of the Iranian actor known as Moses Staff, dubbed the malware "StrifeWater."

"The StrifeWater RAT appears to be used in the initial stage of the attack and this stealthy RAT has the ability to remove itself from the system to cover the Iranian group's tracks," Tom Fakterman, Cybereason security analyst, said in a report. "The RAT possesses other capabilities, such as command execution and screen capturing, as well as the ability to download additional extensions."

Moses Staff came to light towards the end of last year when Check Point Research unmasked a series of attacks aimed at Israeli organizations since September 2021 with the objective of disrupting the targets' business operations by encrypting their networks, with no option to regain access or negotiate a ransom.

The intrusions were notable for the fact that they relied on the open-source library DiskCryptor to perform volume encryption, in addition to infecting the systems with a bootloader that prevents them from starting without the correct encryption key.

To date, victims have been reported beyond Israel, including Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.

The new piece of the attack puzzle discovered by Cybereason comes in the form of a RAT that's deployed under the name "calc.exe" (the Windows Calculator binary) and is used during the early stages of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.

The removal and the subsequent replacement of the malicious calculator executable with the legitimate binary, the researchers suspect, is an attempt on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention enable them to evade detection until the final phase of the attack when the ransomware payload is executed.

StrifeWater, for its part, is no different from its counterparts and comes with numerous features, chief among them being the ability to list system files, execute system commands, take screen captures, create persistence, and download updates and auxiliary modules.

"The end goal for Moses Staff appears to be more politically motivated rather than financial," Fakterman concluded. "Moses Staff employs ransomware post-exfiltration not for financial gain, but to disrupt operations, obfuscate espionage activity, and to inflict damage to systems to advance Iran's geopolitical goals."

Read More

Critical Bug Found in WordPress Plugin for Elementor with Over a Million Installations

 

A WordPress plugin with over one million installs has been found to contain a critical vulnerability that could result in the execution of arbitrary code on compromised websites.

The plugin in question is Essential Addons for Elementor, which provides WordPress site owners with a library of over 80 elements and extensions to help design and customize pages and posts.

"This vulnerability allows any user, regardless of their authentication or authorization status, to perform a local file inclusion attack," Patchstack said in a report. "This attack can be used to include local files on the filesystem of the website, such as /etc/passwd. This can also be used to perform RCE by including a file with malicious PHP code that normally cannot be executed."

That said, the vulnerability only exists if widgets like dynamic gallery and product gallery are used, which utilize the vulnerable function, resulting in local file inclusion – an attack technique in which a web application is tricked into exposing or running arbitrary files on the webserver.

The flaw impacts all versions of the addon from 5.0.4 and below, and credited with discovering the vulnerability is researcher Wai Yan Myo Thet. Following responsible disclosure, the security hole was finally plugged in version 5.0.5 released on January 28 "after several insufficient patches."

The development comes weeks after it emerged that unidentified actors tampered with dozens of WordPress themes and plugins hosted on a developer's website to inject a backdoor with the goal of infecting further sites.

Read More

SolarMarker Malware Uses Novel Techniques to Persist on Hacked Systems

 In a sign that threat actors continuously shift tactics and update their defensive measures, the operators of the SolarMarker information stealer and backdoor have been found leveraging stealthy Windows Registry tricks to establish long-term persistence on compromised systems.

Cybersecurity firm Sophos, which spotted the new behavior, said that the remote access implants are still being detected on targeted networks despite the campaign witnessing a decline in November 2021.

Boasting of information harvesting and backdoor capabilities, the .NET-based malware has been linked to at least three different attack waves in 2021. The first set, reported in April, took advantage of search engine poisoning techniques to trick business professionals into visiting sketchy Google sites that installed SolarMarker on the victim's machines.

Then in August, the malware was observed targeting healthcare and education sectors with the goal of gathering credentials and sensitive information. Subsequent infection chains documented by Morphisec in September 2021 highlighted the use of MSI installers to ensure the delivery of the malware.

The SolarMarker modus operandi commences with redirecting victims to decoy sites that drop the MSI installer payloads, which, while executing seemingly legitimate install programs such as Adobe Acrobat Pro DC, Wondershare PDFelement, or Nitro Pro, also launches a PowerShell script to deploy the malware.

"These SEO efforts, which leveraged a combination of Google Groups discussions and deceptive web pages and PDF documents hosted on compromised (usually WordPress) websites, were so effective that the SolarMarker lures were usually at or near the top of search results for phrases the SolarMarker actors targeted," Sophos researchers Gabor Szappanos and Sean Gallagher said in a report shared with The Hacker News.

The PowerShell installer is designed to alter the Windows Registry and drop a .LNK file into Windows' startup directory to establish persistence. This unauthorized change results in the malware getting loaded from an encrypted payload hidden amongst what the researchers called a "smokescreen" of 100 to 300 junk files created specifically for this purpose.

"Normally, one would expect this linked file to be an executable or script file," the researchers detailed. "But for these SolarMarker campaigns the linked file is one of the random junk files, and cannot be executed itself."

What's more, the unique and random file extension used for the linked junk file is utilized to create a custom file type key, which is ultimately employed to execute the malware during system startup by running a PowerShell command from the Registry.

The backdoor, for its part, is ever-evolving, featuring an array of functionalities that allow it to steal information from web browsers, facilitate cryptocurrency theft, and execute arbitrary commands and binaries, the results of which are exfiltrated back to a remote server.

"Another important takeaway […], which was also seen in the ProxyLogon vulnerabilities targeting Exchange servers, is that defenders should always check whether attackers have left something behind in the network that they can return to later," Gallagher said. "For ProxyLogon this was web shells, for SolarMarker this is a stealthy and persistent backdoor that according to Sophos telematics is still active months after the campaign ended."

Read More

Iranian Hackers Using New PowerShell Backdoor in Cyber Espionage Attacks

 

An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.

The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.

"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."

The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.

Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.

The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.

Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.

Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.

"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."

Read More

Ukraine Continues to Face Cyber Espionage Attacks from Russian Hackers

Cybersecurity researchers on Monday said they uncovered evidence of attempted attacks by a Russia-linked hacking operation targeting a Ukrainian entity in July 2021.

Broadcom-owned Symantec, in a new report published Monday, attributed the attacks to an actor tracked as Gamaredon (aka Shuckworm or Armageddon), a cyber-espionage collective known to be active since at least 2013.

In November 2021, Ukrainian intelligence agencies branded the group as a "special project" of Russia's Federal Security Service (FSB), in addition to pointing fingers at it for carrying out over 5,000 cyberattacks against public authorities and critical infrastructure located in the country.

Gamaredon attacks typically originate with phishing emails that trick the recipients into installing a custom remote access trojan called Pterodo. Symantec disclosed that, between July 14, 2021 and August 18, 2021, the actor installed several variants of the backdoor as well as deployed additional scripts and tools.

"The attack chain began with a malicious document, likely sent via a phishing email, which was opened by the user of the infected machine," the researchers said. The identity of the affected organization was not disclosed.

Towards the end of July, the adversary leveraged the implant to download and run an executable file that acted as a dropper for a VNC client before establishing connections with a remote command-and-control server under their control.

"This VNC client appears to be the ultimate payload for this attack," the researchers noted, adding the installation was followed by accessing a number of documents ranging from job descriptions to sensitive company information on the compromised machine.

Ukraine Calls Out False Flag Operation in Wiper Attacks

The findings come amidst a wave of disruptive and destructive attacks levied against Ukrainian entities by alleged Russian state-sponsored actors, resulting in the deployment of a file wiper dubbed WhisperGate, around the same time multiple websites belonging to the government were defaced.

Subsequent investigation into the malware has since revealed that the code used in the wiper was re-purposed from a faux ransomware campaign called WhiteBlackCrypt that was aimed at Russian victims in March 2021.

Interestingly, the ransomware is known to include a trident symbol — that is part of Ukraine's coat of arms — in the ransom note it displays to its victims, leading Ukraine to suspect that this may have been a false flag operation deliberately intended to blame a "fake" pro-Ukrainian group for staging an attack on their own government.

Read More

eMAPT - Mobile Application Penetration Testing Professional

The eMAPT - Mobile Application Penetration Testing Professional course from the popular eLearnSecurity Institute and INE is an advanced mobile application penetration testing course. Prerequisite for this course is completion of the eJPT course . In the eMAPT course, you will learn the penetration testing of iOS and Android software at a high level. In this course, penetration testing of Android and iOS based software will be taught. In this course, you will find SQL Injection vulnerabilities, software analysis, usage, with basic topics such as the structure of iOS and Android software, compiling and signing software, security in iOS and Android, reverse engineering of iOS and Android software. 

Course pre requisites

• Completion of the eJPT course
• Course specifications
• Course level: Intermediate
• Time: 11 hours and 7 minutes
• Includes: ‌ 17 videos | ‌ 21 slides
• Professor: Anthony Trummer
• EMAPT Course Content - Mobile Application Penetration Testing Professional
• Android & Mobile App Pentesting
• Android Architectures
• Setting up a Testing Environment
• Android Build Process
• Reversing APKs
• Device Rooting
• Android Application Fundamentals
• Network Traffic
• Device and Data Security
• Tapjacking
• Static Code Analysis
• Dynamic Code Analysis
• iOS & Mobile App Pentesting
• iOS Architecture
• Jailbreaking Device
• Setting up a Testing Environment
• iOS Build Process
• Reversing iOS Apps
• iOS Application Fundamentals
• iOS Testing Fundamentals
• Network Traffic
• Device Adminsitration
• Dynamic Analysis

Link OFF Return Coming SOON

Read More