A Guide to Developing Security-First Culture Powered by Threat Intelligence 

/in

Security-First Culture (SFC) is an organization-wide commitment where security considerations influence decision-making at every level, from strategic planning to daily operational tasks. 

It’s not just about having fancy tech or a dedicated IT team; it’s about making security a core part of how the company thinks and acts. A mindset where every decision, from coding a new app to sending an email, considers “How could this go wrong, and how do we protect against it?”.  
 
Leaders set the tone by prioritizing security, allocating resources, and weaving it into the company’s strategy. Every employee, regardless of their role, understands that they play a critical part in the organization’s security posture.    

Main Principles of Security-First Culture 

  1. Proactive Risk Management. Teams don’t wait for incidents to happen. They actively identify, assess, and mitigate risks before they materialize into threats. 
  1. Continuous Learning and Adaptation. Threats evolve, so should your people and your strategies. Regular training, updates, and process improvements are standard practice. 
  1. Transparency and Communication. Open dialogue about security concerns, incidents, and best practices creates an environment where problems are addressed quickly. 
  1. Security by Design. New products, services, and processes are developed with security considerations built-in from the beginning. Security supports innovation; it doesn’t block it. 
  1. Data-Driven Decision Making. Security decisions are based on threat intelligence, risk assessments, and measurable outcomes rather than assumptions or gut feelings. 

The principles sound sensible but quite challenging to implement. Transferring to SFC might look like an organizational revolution demanding changes on all levels, from the leadership mindset to everyday practices. And of course it must be quite a recourse-consuming adventure. Is the outcome worth it?  

Benefits of Security-First Culture 

The advantages of implementing SFC extend far beyond just preventing cyberattacks. But the straightforward outcome of suffering less breaches must certainly be considered. Verizon’s 2022 Data Breach Report says 82% of breaches involve human error, so a security-minded workforce can slash that risk. 

Fewer breaches mean less damage: financial, reputational, operational. Preventing even one incident can save millions: the average cost of a data breach exceeded $4 million back in 2023, according to IBM.  Besides, if an attack does happen, a prepared organization bounces back faster, minimizing damage and downtime. 

Customers, partners, and stakeholders have greater confidence in organizations that demonstrably prioritize security. This translates to stronger business relationships and competitive advantages. 

Less obvious but no less valuable benefits include:  

  • Improved Operational Efficiency: When security practices are integrated into daily workflows, they become second nature, reducing friction and improving overall productivity. 
  • Regulatory Compliance: A security-first approach makes compliance with various regulations (GDPR, HIPAA, SOX, etc.) more straightforward and less costly. 
  • Innovation Enablement: Paradoxically, strong security foundations enable organizations to innovate more freely, knowing they have robust safeguards in place. 
  • Employee Empowerment: When staff feel confident handling threats, they’re more engaged and take ownership of their role in security. 


Enrich your threat knowledge with TI Lookup

Enrich your threat knowledge with TI Lookup

Learn about TI Lookup and its capabilities to see how it can contribute to your company’s security


Explore more


SFC Champions and Those Who Paid the Price 

Several organizations have become benchmarks for security-first culture: 

Microsoft: Following significant security challenges in the early 2000s, Microsoft implemented their “Security Development Lifecycle” and “Assume Breach” philosophy, fundamentally transforming their approach to security.  
 
Google: Their “BeyondCorp” zero-trust security model and continuous security innovations demonstrate a deep cultural commitment to security. 

Apple: Known for privacy-by-design principles and strong encryption standards across all products and services. 

Not every company gets it right (providing us with impressive and didactic examples). These high-profile disasters could’ve been mitigated with a stronger SFC: 

Equifax (2017): A failure to patch a known vulnerability led to a breach exposing 147 million people’s data. A lack of proactive monitoring and employee awareness was a key factor. 

SolarWinds (2020): A supply chain attack compromised multiple organizations. Inadequate security training and siloed responsibilities left gaps that attackers exploited. 

AT&T (Multiple breaches 2023-2024): Repeated incidents affecting millions of customers demonstrate ongoing security culture deficiencies despite previous breaches. 

Evaluating Your Current Security Culture 

Here’s how to understand where you stand: 

Strong Security-First Culture Indicators Warning Signs of Weak Security Culture
Employees proactively report security concerns Security seen as “someone else’s job”
Security is discussed in regular business meetings Frequent workarounds to security policies
New projects include security requirements from the start Incident response is chaotic or delayed
Incident response is swift and coordinated Security training completion rates below 90%
Regular security training has high participation rates Security budget cuts during tough financial periods
Security metrics are tracked and reported to leadership Repeated similar security incidents

Cyber Threat Intelligence as a Pillar of Security-First Culture 

Cyber Threat Intelligence (CTI) isn’t just a technical capability — it’s the nervous system of a security-first culture. CTI provides the contextual awareness that transforms reactive security measures into proactive, strategic defense.  

Like security-first culture permeates and consolidates every organizational unit and structure, state-of-the-art CTI vendors like ANY.RUN offer solutions to cover security-related challenges on all business levels.  

CTI for Enriching Cyber Threat Investigations and Response 

Daily security operations rely on CTI to prioritize alerts, contextualize incidents, and guide response efforts. Instead of treating all security events equally, intelligence helps teams focus on genuine threats.  

Threat Intelligence Lookup allows employees of any grade to utilize a vast database of fresh Indicators of Compromise (IOCs), Behavior (IOBs), and Attack (IOAs) to instantly collect context for alerts, incidents, and campaigns. The data is continuously updated and derived from the attacks on over 15,000 companies using ANY.RUN’s Interactive Sandbox for hands-on investigations of malware and phishing attacks. 

An employee does not have to be a security expert to make a search request like a suspicious IP address and receive an instant verdict that the notorious banking stealer Lumma might have penetrated the perimeter:   

TI Lookup actionable IP search results 

TI Lookup enables teams to quickly gather critical threat context, transforming existing indicators tin actionable insights into the threat to hand to mitigate risks and protect the organization. 

Tap into fresh threat intel from attacks on 15K companies
Streamline detection and response with TI Lookup 



Get 50 requests to test it


CTI for Proactive Threat Monitoring 

When it comes to tactical implementation, security tools and controls are configured based on current threat intelligence, ensuring defenses remain relevant as the threat landscape evolves.  

Threat Intelligence Feeds provided by ANY.RUN deliver up-to-date curated indicators of compromise like URLs, domains, and IPs, enriched with threat context, to integrate with detection and monitoring systems and identify threats before they become incidents. 

Expand threat coverage in your organization
Integrate TI Feeds from ANY.RUN 



Test with 14-day trial


CTI For Early Detection of Malicious Files and URLs 

Smart threat intelligence solutions improve employees’ ability to make better security decisions in ambiguous situations. ANY.RUN’s Interactive Sandbox makes it possible to analyze any suspicious link, email, or file, and not just get a malicious/benign verdict, but to understand malware’s behavior as well as its operators’ TTPs. 

Thanks to interactivity, the sandbox makes it possible to engage with the environment and the threat just like on a standard desktop, detonating every stage of the attack to reveal the final malicious payload. 

A suspicious .exe file can be securely detonated in the sandbox 

As we can see, the Sandbox file analysis exposes its malicious behavior and labels it as AsyncRAT trojan. 

The intuitive interface of the sandbox simplifies malware analysis for junior security professionals and even non-specialists, providing them with a clear understanding of any threat.   

Sign up for ANY.RUN’s Interactive Sandbox with a business email 

CTI For Improving Security Strategy 

In strategic planning, CTI informs long-term security investments by identifying emerging threats and industry-specific risks. When planning business expansion, drafting a security budget for the next quarter, or gathering information on the key cybersecurity risks, it provides crucial context about the current threat landscape. 

ANY.RUN’s TI Reports contain manually collected intel on APTs, as well as malware and phishing campaigns that pose a danger to businesses right now. The reports help security teams gain greater visibility into the threats active at the moment and proactively defend their infrastructure. 

Step-by-Step Algorithm to Deploy SFC 

  1. Assess Current State: Survey employees, audit processes, and measure metrics like phishing click rates to identify gaps. 
  1. Develop Security Strategy: Align security with business goals, like customer trust or operational continuity. Create comprehensive plan addressing people, process, and technology. Establish policies and security rules (e.g., password standards, MFA use) and integrate them into workflows. 
  1. Train Employees and Implement Tools: (firewalls, encryption, threat intelligence solutions, and monitoring systems to support human efforts). 
  1. Measure and Iterate: Track KPIs (e.g., incident response time, training completion) and refine strategies based on results. 
  1. Review Regularly: Conduct quarterly audits and update tactics to address new threats. 
  1. Celebrate Successes: Recognize and reward security-positive behaviors. Share knowledge and learn from security community.  

Final Thoughts 

A security-first culture isn’t just about tech — it’s about people, processes, and a shared commitment to staying safe. By embedding cyber threat intelligence into every step, from leadership to daily operations, organizations can stay ahead of attackers, protect their data, and build trust with customers.  

Organizations that successfully implement security-first culture supported by robust threat intelligence capabilities don’t just survive in today’s threat environment. They thrive, using their security posture as a foundation for innovation, growth, and competitive advantage. 

About ANY.RUN  

Over 500,000 cybersecurity professionals and 15,000+ companies in finance, manufacturing, healthcare, and other sectors rely on ANY.RUN. Our services streamline malware and phishing investigations for organizations worldwide.  

  • Speed up triage and response: Detonate suspicious files using ANY.RUN’s Interactive Sandbox to observe malicious behavior in real time and collect insights for faster and more confident security decisions.  
  • Improve threat detection: ANY.RUN’s Threat Intelligence Lookup and TI Feeds provide actionable insights into cyber attacks, improving detection and deepening understanding of evolving threats. 

Start 14-day trial of ANY.RUN’s solutions in your SOC today 

The post A Guide to Developing Security-First Culture Powered by Threat Intelligence  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

PDFs: Portable documents, or perfect deliveries for phish?

/in
  • Cisco recently developed and released an update to its brand impersonation detection engine for emails. This new update enhances detection coverage and includes a wider range of brands that are delivered using PDF payloads (or attachments). 
  • A significant portion of email threats with PDF payloads persuade victims to call adversary-controlled phone numbers, displaying another popular social engineering technique known as Telephone-Oriented Attack Delivery (TOAD), also known as callback phishing.  
  • Talos observed that these threat actors often use Voice over Internet Protocol (VoIP) to remain anonymous. These phone numbers are sometimes reused on consecutive days. Additionally, Talos has identified instances of Adobe platform abuse to deliver PDF attachments to victims in TOAD emails. 
  • Talos plans to collect and gather intelligence around phone numbers as an additional indicator of compromise (IOC). 
  • Talos provides new insights into the use of QR codes and PDF annotations in email threats that impersonate legitimate brands through PDF payloads.

Brand impersonation via PDF payload 

PDFs: Portable documents, or perfect deliveries for phish?

The portable document format (PDF) is a standard method for sharing information electronically. Files created in other applications (e.g., Microsoft Word) are often converted into this format, which can then be viewed using PDF rendering applications like Adobe Reader, commonly available on most OSs. Thanks to its excellent portability, this file format is widely used for the mass distribution of documents to large audiences. However, in recent months, it has also been exploited for illegitimate purposes, such as brand impersonation. 

Brand impersonation is a social engineering technique that exploits the popularity of well-known brands to persuade email recipients to disclose sensitive information. As discussed in our previous blog, adversaries can deliver brand logos and names to victims using multiple types of payloads. One of the most common methods of delivering brand logos and names is through PDF payloads (or attachments).

In some cases, the entire email, including a brand’s logo, is embedded within a PDF attachment. Figure 1 displays an example of a QR code phishing email that impersonates the Microsoft Corporation brand. The threat actor used an enticing subject line, “Paycheck Increment,” timed strategically during periods when promotions or merit changes are likely to occur in various organizations.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 1. A QR code phishing email impersonating the Microsoft brand.

In other cases, the company’s logo is included in a separate image or PDF attachment and is displayed to the victim as soon as they open the email. Below is an example of a QR code phishing email that impersonates both the Microsoft and Adobe Inc. brands. Figure 2 shows the Adobe logo attached to an email as an image file.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 2. A QR code phishing email impersonating the Microsoft and Adobe brands.

A brand’s logo may not always be present in every brand impersonation attempt. For example, the following phishing email, which impersonates the Adobe brand, does not include any logos.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 3. A phishing email impersonating the Adobe brand.

When the victim clicks on the “View the Attached online here” hyperlink, they are redirected to a phishing page impersonating a Dropbox, Inc. webpage.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 4. Phishing page impersonating Dropbox download page.
PDFs: Portable documents, or perfect deliveries for phish?
Figure 5. The final phishing page of the above email, impersonating the Dropbox brand.

Telephone-oriented attack delivery (TOAD) 

A significant portion of email threats with PDF payloads persuade victims to call adversary-controlled phone numbers, displaying another popular social engineering technique: telephone-oriented attack delivery (TOAD), also known as callback phishing.  

Victims are instructed to call a specific number in the PDF to resolve an issue or confirm a transaction. Once the victim calls, the attacker poses as a legitimate representative and attempts to manipulate them into disclosing confidential information or installing malicious software on their computer.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 6. Overview of a typical TOAD attack sequence.

Phishing typically involves sending emails or messages with malicious links or attachments that direct the victim to a counterfeit website. Callback phishing, however, does not rely on fake websites or phishing links. Instead, attackers use direct voice communication to exploit the victim’s trust in phone calls and the perception that phone communication is a secure way to interact with an organization. Additionally, the live interaction during a phone call enables attackers to manipulate the victim’s emotions and responses by employing social engineering tactics. Callback phishing is, therefore, a social engineering technique rather than a traditional email threat.  

Most phone numbers found in email threats leveraging this social engineering technique are Voice over Internet Protocol (VoIP) numbers, as it is significantly harder to trace a VoIP number back to a specific individual or physical location compared to a traditional phone number. Below is an example of a TOAD attack that impersonates the McAfee LLC brand.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 6. A TOAD example impersonating the McAfee brand.

Talos has observed that phone numbers are sometimes reused on consecutive days. This could happen for multiple reasons. First, intelligence about phone numbers is collected and distributed at a slower pace compared to other artifacts like URLs and files. In most cases, phone numbers observed in emails by cybersecurity companies are not shared with third-party reputation services, or vice versa. As a result, these phone numbers often remain under the radar for several days. Second, the reuse of phone numbers provides logistical advantages for scam call centers. It enables consistent contact for multi-stage social engineering attacks, scheduling callbacks, and maintaining a credible “brand” presence with victims. Lastly, phone numbers may be reused to minimize costs, particularly if the VoIP service is not free. The plot below illustrates a case where the number +1-818-675-1874 was used in TOAD emails impersonating Best Buy’s Geek Squad brand for four consecutive days.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 7. An example of phone number reuse (+1-818-675-1874) in TOAD emails on consecutive days.

Talos has also observed several cases of e-signature service abuse on the Adobe platform between April and May 2025. Figure 8 shows an example email that impersonates the PayPal brand. In this case, the entire PDF file (i.e., the body of the email) was uploaded to Adobe and sent directly to the victim through the e-signature service.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 8. A TOAD example impersonating the PayPal brand.
PDFs: Portable documents, or perfect deliveries for phish?
Figure 9. The Adobe’s e-signature service abuse in TOAD.

QR codes in PDF payloads 

Adversaries extensively use QR codes alongside brand impersonation phishing emails, a tactic known as QR code phishing. As seen in Figures 10 – 12, attackers exploit the legitimacy of popular brands to convince users to scan the QR code, ultimately redirecting them to a phishing page, which is often protected by some form of CAPTCHA.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 10. A QR code phishing email impersonating the Docusign, Inc. brand.
PDFs: Portable documents, or perfect deliveries for phish?
Figure 11. CAPTCHA protecting the final phishing page.
PDFs: Portable documents, or perfect deliveries for phish?
Figure 12. Final phishing page.

In most QR code phishing emails with PDF payloads, the entire email body is embedded in the attachment and is rendered for the victim as soon as they open the email. This technique easily evades email filters and detection engines that rely on textual features and keywords, unless preceded by optical character recognition (OCR) analysis. However, OCR is an error-prone process and increases computational costs.

Annotations in PDF payloads 

Although the PDF format is an open standard, its structure is not straightforward to understand (this book provides an excellent explanation). PDFs can contain both visible and hidden information within their three main components: the text layer, the image layer and the internal structure (e.g., comments and annotations). This flexibility allows certain elements within a PDF to make it appear legitimate, helping it evade spam filters and detection systems. 

To make QR code phishing emails more evasive, attackers often exploit otherwise legitimate PDF annotations. For example, a phishing URL might be embedded in a text annotation, sticky note, comment, or form field within a PDF attachment. Alternatively, attackers may add irrelevant text (or “noise”) to bypass detection systems. 

Figures 13 and 14 demonstrate how multiple URLs can be embedded in a PDF attachment using annotations. In this case, the QR code may link to a legitimate web page to build the recipient’s trust, while the embedded annotation points to the actual phishing page. To further obscure the attack, attackers may use shortened URLs, making it harder for users to verify the link’s legitimacy before clicking.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 13. A QR code phishing email impersonating the Microsoft brand.
PDFs: Portable documents, or perfect deliveries for phish?
Figure 14. An example PDF attachment with a QR code; two URLs are included in this file in the form of annotations.

Trends of brand impersonation via PDF payloads 

Brand impersonation remains a prevalent social engineering tactic in phishing attacks, with Talos frequently observing PDF payloads delivering brand names or logos in recent months. 

Using Cisco Secure Email Threat Defense’s brand impersonation detection engine, we uncovered how widespread these attacks are. The plot in Figure 15, reflecting the period between May 5 and June 5, 2025, highlights the most impersonated brands detected in emails with PDF attachments. Microsoft and Docusign were among the most frequently impersonated brands in phishing emails with PDF attachments. Similarly, NortonLifeLock, PayPal, and Geek Squad were among the most impersonated brands in TOAD emails with PDF attachments.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 15. The topmost brands impersonated in emails with PDF attachments.

The map in Figure 16 indicates where brand impersonation attempts using PDF attachments originated for the above brands, both locally and internationally, during this time period.

PDFs: Portable documents, or perfect deliveries for phish?
Figure 16. The originating IP addresses of brand impersonation attempts using PDF attachments.

Protection against brand impersonation

Brand impersonation is one of the most popular social engineering techniques, and it is continuously being used by attackers in different types of email threats. Therefore, a brand impersonation detection engine plays a pivotal role in defending against cyber attacks. 

Cisco Talos relies on a wide range of systems to detect this type of threat and protect our customers, from rule-based engines to advanced machine learning-based systems. Learn more about Cisco Secure Email Threat Defense’s brand impersonation detection engine here.

Cisco Talos Blog – ​Read More

The top-five funny school, social media, and IoT hacks | Kaspersky official blog

/in

On this here blog of ours we constantly write about all sorts of cyberattacks and their devastating effects — from cryptocurrency theft to personal data leaks. Yet there’s a different category of high-profile hacks: those where the hackers aren’t after money, but instead pull off silly stunts that are mostly harmless enough and just for fun (though some (one in particular — the Ecovacs hack, below) could be more serious than others). Today, we tell you about five of these and discuss the lessons we can learn from them…

“They’re everywhere!” When traffic lights talk to you in the voices of Zuckerberg and Musk

In the spring of 2025, unknown individuals hacked crosswalk buttons on traffic lights across Silicon Valley. These audio-enabled buttons are widely installed on pedestrian signals across the United States. As you might expect, they’re designed for people with visual impairments: their main purpose is to play voice messages that help pedestrians who can’t see well understand when it’s safe to cross the road.

The unknown individuals replaced the standard voice messages on crosswalk buttons in several Silicon Valley towns with their own — featuring AI-generated imitations of the ubiquitous tech-billionaires Mark Zuckerberg and Elon Musk. Videos recorded by local residents show the hacked buttons playing the messages.

In a voice imitating Mark Zuckerberg: “It’s normal to feel uncomfortable or even violated, as we forcefully insert AI into every facet of your conscious experience. I just want to assure you, you don’t need to worry because there’s absolutely nothing you can do to stop it.”

In a voice imitating Elon Musk: “You know, they say money can’t buy happiness… I guess that’s true. God knows I’ve tried. But it can buy a Cybertruck and that’s pretty sick, right? F***, I’m so alone.”

Another message in a simulated Musk voice: “You know, people keep saying cancer is bad, but have you tried being a cancer? It’s f****** awesome. Call me Elonoma. Heh-heh-heh.”

The billionaires’ voices were clearly AI-generated, but exactly how the hackers managed to breach the traffic light audio buttons remains unknown. Security experts have noted, however, that default passwords are often used when connecting these kinds of buttons, and nobody bothers to change them after installation.

It looks like no one was hurt by the prank – except maybe the billionaires’ pride.

In Illinois, students learn a key lesson: never forget about Rick

On the last Friday of the 2021 school year, all the TVs and projectors in classrooms across six schools in Cook County, Illinois, turned on by themselves. A message appeared on the screens: “Please remain where you are. An important announcement will be made shortly.” A five-minute countdown timer was displayed below the unsettling message…

Five minutes later, 500 screens simultaneously started showing the famous Rick Astley video for Never Gonna Give You Up. Later that same day, the song played again over the schools’ public address systems.

The hackers behind this surprise pop… classic’s airing were four American students, and what they did was pull off one of the biggest Rickrolls in history that day. A Rickroll is a popular online prank where an unsuspecting user is sent a seemingly important or exciting link, only to be redirected to the video for English singer Rick Astley’s 1987 hit, Never Gonna Give You Up. Rickrolling achieved cult status back in 2007 after spreading on the 4chan imageboard.

Let’s get back to the four students. Their massive Rickroll was a hi-tech twist on a classic American tradition known as the senior prank: basically, a good-natured prank pulled by high-school, college, or university seniors before graduation.

However, the four Illinois students clearly took it to a new level. To pull off their Rickroll, they exploited fairly basic vulnerabilities in the school’s infrastructure. For example, the pranksters gained access to the system controlling hundreds of projectors and TVs across the entire school district because the default usernames and passwords hadn’t been changed after setup.

Similarly, the students were able to log into the schools’ audio public address systems. The person who originally configured the PAs diligently changed the default system password to the one provided as an example in the user manual, which of course was available online. While they were at it, the hacking team discovered an administrator account with “password” used as the password.

It’s worth highlighting just how responsibly the hackers approached the whole operation. Before carrying out the Rickroll, the prankster team prepared a detailed 26-page report, which they sent to the school administrators immediately after the incident. In it, the students thoroughly described their actions and provided recommendations for improving the schools’ cybersecurity. Additionally, once the Rickroll was over, the script they wrote restored the school systems back to their original state.

We always knew: the rise of the machines would begin with robot vacuums

Last year, reports surfaced online about a series of hacks targeting Chinese-made Ecovacs Deebot X2 robot vacuums in cities across the United States. Pranksters assumed control of the robots’ movements and shouted expletives through the built-in speakers. Additionally, they could spy on the owners through the integrated cameras.

The story seemingly had its beginnings at the DEF CON 32 hacker conference, where cybersecurity researchers Dennis Giese and Braelynn Luedtke presented their talk, Reverse engineering and hacking Ecovacs robots. The presentation described vulnerabilities they’d discovered in Ecovacs robot vacuums and lawnmowers, as well as methods for exploiting them. As part of their study, the researchers were able to gain remote access to the built-in microphones and cameras and control the vacuums’ movements. We previously covered their work in detail in our post Ecovacs robot vacuums get hacked.

(By the way, during their presentation at DEF CON, Giese and Luedtke themselves became the target of a hacker prank: a member of the audience managed to take control of the presenter’s clicker and spent several minutes messing with the speakers by randomly flipping through their slides.)

Giese and Luedtke reported their findings to the vendor in a responsible manner. Ecovacs engineers attempted to patch the vulnerabilities, but didn’t have much luck. Several months after the report went out, unknown tech enthusiasts, likely inspired by the study, were able to recreate the techniques described in it to execute a series of attacks on other people’s robot vacuums. For example, in one such attack in California, a robot chased the owner’s dog around the house while shouting obscenities.

The exact number of victims from this series of hacks remains unknown, as it’s plausible that the pranksters didn’t always make their presence obvious — they might have simply observed the vacuum owners’ lives. That, clearly, would have been a very serious infringement of those owners’ privacy – and could in no way be described as mere “fun and games”; neither could this: what if Ecovacs lawnmowers are next?

Lizard Squad “breaking free”: a defacement free redesign of Lenovo’s website

Here’s another playful attack by teenagers, this time targeting Lenovo. A decade ago, the computer manufacturer’s website was hacked. Visitors were redirected to a slideshow featuring photos of bored-looking adolescents, presumably the hackers themselves, all set to the song Breaking Free from Disney’s High School Musical.

Clicking on the slideshow would lead users to the hacking group Lizard Squad’s account on X, which was still known as Twitter at the time. The hackers left a jab at the webmasters in the source code: “The new and improved rebranded Lenovo website featuring Ryan King and Rory Andrew Godfrey”. These two individuals had previously been linked to Lizard Squad.

The attack was orchestrated via DNS hijacking. The hackers altered the DNS records for lenovo.com, causing all users attempting to reach the official company website to be automatically redirected to a fake page controlled by the pranksters.

The attack was apparently a protest against what was seen as the computer vendor’s lax attitude toward security and user protection. Shortly before the defacement, it was revealed that Lenovo had been selling laptops preloaded with Superfish malware. This made users who purchased infected devices potentially vulnerable to data interception and man-in-the-middle attacks. Thus, the hack seems kind of wrong, but at the same time feels justified.

Bring back 2013, when Twitter accounts were hacked for mischief — not crypto scams

These days, when the X account of a high-profile individual or major company gets hacked, it almost invariably leads to some kind of cryptocurrency scam. But it wasn’t always this way. Just a decade ago, popular accounts on what was then still known as Twitter were more often hijacked for giggles than for illicit financial gain.

Take February 2013, for example. Unknown hackers breached Burger King’s Twitter account to post this gem: “We just got sold to McDonalds! Look for McDonalds in a hood near you.”

On top of that, Burger King’s profile picture was swapped out for the McDonald’s logo, and their bio read: “Just got sold to McDonalds because the whopper flopped.” The bio also included the misspelled line “FREDOM IS FAILURE” and a dead link to a press release.

For about an hour, the attackers posted increasingly outrageous messages before Twitter finally suspended the account. Interestingly, Burger King’s arch-rival, McDonald’s, tweeted a message of support — while making sure to clarify they had nothing to do with the breach.

Fast-forward to August 2017, which was when the Ourmine hacking outfit targeted the Twitter account of soccer giant Real Madrid. The hackers used the club’s account to announce that none other than Lionel Messi, who then played for Real Madrid’s fiercest rival, FC Barcelona, was transferring to Real Madrid.

The post quickly racked up 2800 likes and 3100 retweets. Ourmine also posted a series of tweets claiming responsibility for the hack, with one declaring, “Internet security is s*** and we proved that.” It’s hard to argue with that.

A takeaway from the hacks: protect your password from the start

Perhaps the most crucial lesson to learn from these online shenanigans is this: using weak — or even worse, default — passwords is a surefire way to hand control of your device, account, or website to internet pranksters… if you’re lucky. Weak passwords were what tripped up city infrastructure and school administrators, and it’s highly likely that the Twitter account hacks were also linked to a careless approach to password policies.

This blog has frequently discussed how to create strong passwords. But to wrap things up, let’s reiterate a few basic rules of password hygiene:

  • Passwords should be at least 16 characters long, or even longer if the website allows it.
  • When creating a password, it’s good practice to mix uppercase and lowercase letters, numbers, and special characters.
  • It’s best to avoid easily guessable things like common words or dates in your password. And you definitely shouldn’t use the word “password”.
  • Ideally, your password should be a random combination of characters.
  • Create a new, unique password for each website.

Of course, any user today signs up for dozens, if not hundreds, of online services. So, remembering long and unique passwords for each one isn’t feasible. That’s where Kaspersky Password Manager can help you manage this and protect yourself not just from pranks, but from far more serious consequences.

Additionally, the app automatically checks all your passwords for uniqueness, and helps you create truly strong and random combinations of characters. So, when using Kaspersky Password Manager, you don’t need to keep all those complex rules in mind — the password manager does it all for you. Beyond passwords, Kaspersky Password Manager can store and sync two-factor authentication tokens and passkeys. We recently thoroughly explored this new passwordless technology for accessing websites and services in our complete guide to using passkeys in 2025.

Kaspersky official blog – ​Read More

DEVMAN Ransomware: Analysis of New DragonForce Variant 

/in

Editor’s note: The current article is authored by Mauro Eldritch, offensive security expert and threat intelligence analyst. You can find Mauro on X. 

New ransomware strains continue to surface frequently, and many of them are loosely built on or repackaged from existing families. One such case involves a sample resembling DragonForce ransomware, yet bearing several unique traits and identifiers suggesting the involvement of a separate entity known as DEVMAN. 

A previously analyzed campaign connected to the Mamona strain, itself linked to BlackLock affiliates and the Embargo group, also intersected with DragonForce activity. During one such attack, DragonForce actors exfiltrated a target’s .env file and published it on their Dedicated Leak Site (DLS) on Tor with the caption: “Is this your .env file?” 

This newer sample, uploaded by TheRavenFile, appears related but not entirely identical to the DragonForce lineage. Despite being labeled as a DragonForce or Conti variant by most AV engines, the sample displays unique behaviors that point toward DEVMAN involvement. 

Our DragonForce/Conti sample on VT, but don’t be fooled by appearances 

DEVMAN: Key Takeaways 

  • DEVMAN reuses DragonForce code but adds its own twists: The .DEVMAN extension and unique strings sit on top of a mostly DragonForce codebase. 
  • Attribution is muddy: AV engines label the sample as DragonForce or Conti, yet its behavior and leak-site links point to DEVMAN. 
  • DragonForce’s RaaS model allows affiliates to create spinoff variants: 
    That’s likely how samples like DEVMAN emerged; built on DragonForce code, but customized and repackaged. 
  • Ransom notes encrypt themselves: This happens likely due to a builder flaw 
  • Most malicious activity takes place offline, aside from SMB probing: No external C2 communication was observed during analysis. 
  • Three encryption modes are built in: full, header-only, and custom. 
  • Behavior varies by OS: Wallpaper change fails on Windows 11 but works on Windows 10. 

Dragons as a Service 

Some time ago, DragonForce introduced their RaaS (Ransomware-as-a-Service) model, aiming to recruit both affiliates to operate their ransomware and others who wanted to use their infrastructure, branding, and reputation as a platform to publish stolen data.  

This shift brought new actors into the landscape, increasing overall activity, noise, and irregularities, including the sample analyzed here. Depending on the analyst or tool, it may be labeled as DragonForce, Conti (the base framework for DragonForce), or DEVMAN. 

DEVMAN? A relatively new actor has recently emerged under this name, featuring its own Dedicated Leak Site (DLS) called Devman’s Place, a separate infrastructure, and nearly 40 claimed victims, primarily in Asia and Africa, with occasional incidents in Latin America and Europe. 

A Hybrid Ransomware Sample 

Let’s analyze the sample inside ANY.RUN’s secure interactive sandbox: 

View analysis session  

This sample, flagged by most antivirus engines as a DragonForce (or Conti), is actually, modified to behave like a new variant belonging to DEVMAN. It uses that name as the file extension for encrypted data but otherwise shares a large part of its codebase with DragonForce, including leftover strings and identifiers. That strongly suggests DEVMAN may be using a DragonForce build for some of its operations. 

Encrypted file with the .DEVMAN extension 

This appears to be a lightly customized version; one that hasn’t attracted much attention, either from the threat intelligence community or from its own operator. The result is a tangled ransomware crossbreed with overlapping traits.  

Automatic detection labels the sample as “DragonForce” 

A closer look reveals more. 

Detect malware as it executes in a live environment
Analyze suspicious files and URLs in ANY.RUN’s Sandbox 



Sign up with business email


Initial Behavior and Detection 

First things first — our newborn dragon does what dragons do: it burns down the village. Files are encrypted rapidly and automatically, also attempting to locate SMB shared folders to spread further — but in our lab environment, it wasn’t that lucky. 

Two things caught our attention immediately. First, on Windows 11, the sample was unable to change the wallpaper for unknown reasons, while on Windows 10 it worked flawlessly.  

Second, although desktop files are the most visible, they are not the last to be encrypted. The process continues beyond them. 

SMB traffic attempting to laterally spread the infection 

Ransom Note Issues and Deterministic Renaming 

The ransom notes were not dropped as expected. Instead, every location where a note should have appeared contained, quite mysteriously, a file with a scrambled name and the .DEVMAN extension, suggesting the sample might be malfunctioning and targeting its own files. 

Fortunately, ANY.RUN logs all activity, not just network traffic, but disk writes as well, allowing us to reconstruct one of those files right at the moment it was created. And, interestingly enough, the ransom note isn’t just similar to the ones used by DragonForce. It is, in fact, a DragonForce ransom note. 

A DragonForce ransom note 

When retrieving the list of created and modified files, we noticed an interesting pattern: the sample scrambles file names instead of simply appending an extension. 

And here’s the most curious part; its own readme.txt files, once encrypted, are always renamed to e47qfsnz2trbkhnt.devman. This strongly suggests the use of a deterministic function that produces static outputs for identical inputs. 

Encrypted Ransom notes, all sharing the same name 

Offline Behavior and Local Footprint 

So, let’s focus on those local oddities, and a good place to start it’s the binary itself. 

Aside from the aforementioned SMB connections, no suspicious network dialogue was observed, suggesting that all malicious activity takes place locally and offline.  

Using FLOSS, a tool by Mandiant, we can decode and extract additional strings to better understand the sample’s internal logic prior to disassembly. 

The first thing we notice is that the sample checks for Shadow Copies (probably just to make sure we’ve got a solid backup policy in place) and lists a series of file extensions that it deliberately avoids encrypting. 

Decoded strings obtained via Floss 

Encryption Modes and File Targeting 

Further analysis reveals multiple encryption modes: full encryption, header-only encryption, and custom encryption, designed to prioritize either speed or complexity, depending on the intended scenario.  

Header-only encryption, in particular, allows the malware to corrupt large volumes of data in less time, trading completeness for speed. 

At least 3 different encryption modes are available 

SMB Spread and Local Targeting 

Further exploration reveals a bit more detail about the sample’s attempts to connect to SMB folders, explicitly referencing local network octets and hardcoding the ADMIN$ share name, along with several error and debug messages. 

Octects belonging to local addresses and direct mention to the ADMIN share 

Persistence and File Lock Evasion via Restart Manager 

Another interesting behaviour that further supports the Conti lineage of this sample is its interaction with the Windows Restart Manager. The malware creates temporary sessions under the registry key: 

HKEY_CURRENT_USERSoftwareMicrosoftRestartManagerSession0000 

There, it logs metadata such as Owner, SessionHash, RegFiles0000, and RegFilesHash, pointing to system-critical files like NTUSER.DAT and its corresponding logs. 

Each of these entries is quickly deleted after being written, likely an attempt to avoid leaving persistent forensic traces. This pattern mirrors behaviour seen in Conti and later carried on by DragonForce, which now appears to be inherited by DEVMAN (what a Zoo!).  

The goal seems clear: use the Restart Manager to bypass file locks and ensure encrypted access to active user session files. It’s noisy, and somewhat old, but it works. 

Regkeys altered by the sample 


Learn to analyze malware in a sandbox

Learn to analyze cyber threats

See a detailed guide to using ANY.RUN’s Interactive Sandbox for malware and phishing analysis


Read full guide


Mutex Usage and Sample Coordination 

Another notable behavior involves the use of synchronization primitives, particularly mutexes, to coordinate the sample’s execution and possibly prevent multiple instances from running in parallel. This is standard among ransomware families derived from Conti, and this case is no exception. 

Right from the beginning, the sample creates a mutex named: hsfjuukjzloqu28oajh727190 

This mutex is not randomly generated; it is hardcoded into the binary, as confirmed by decoded strings extracted using FLOSS. Its presence suggests that the sample uses it to detect existing instances of itself, a basic anti-reentry mechanism. 

The sample also creates several mutexes and interacts with objects under the naming pattern: 

  • LocalRstrMgr[GUID] 
  • LocalRstrMgr-[GUID]-Session0000 

These mutexes are tied to the Windows Restart Manager API and match the behaviour seen in previous ransomware families (notably Conti and its derivatives), which use this mechanism to query which processes are holding handles to specific files.  

This facilitates forced encryption of locked resources, including user profile data like NTUSER.DAT. 

The reuse of fixed strings can serve as a strong indicator of compromise (IOC) for future detection or correlation with other samples likely created using the same packer or builder. However, this is a volatile indicator that is likely to change over time. 

When possible, assign a “trust” expiration date (or half-life) to indicators; it can be a valuable practice for maintaining detection accuracy over time. 

Mutexes used by the sample 

Final Observations 

An Experimental Build with Unusual Behavior 

This sample looks more like an affiliate testing a new build than something currently being deployed that you’d casually run into in a production environment. While not particularly sophisticated, it presents a number of unusual behaviors worth highlighting, particularly its tendency to encrypt its own ransom notes. 

A Critical Flaw in the Builder 

While it’s ironic that no one could, at least not easily, pay the ransom without knowing who to pay (because the ransom note gets encrypted), the underlying message here is more serious: there’s a core design flaw in the builder that allows it to self-encrypt key components.  

That simple .txt file is often the only clue victims have to identify the threat actor and initiate negotiation; and for the threat actor, it’s the best chance of getting paid. 

I spoke with DEVMAN, who stated “[…] we stopped using DragonForce months ago […]”. 

Threat Actor Communication 

One noteworthy indicator of a threat actor’s maturity is their ability to maintain polite, detailed, and respectful communication; a trait that also applies to DEVMAN. This attitude seems to echo in their technical approach, even in cases where their ransomware encrypts its own ransom notes. 

A Familiar Build Beneath the Surface 

Now, if we strip this sample of its oddities, there’s not much to talk about it on its own merits (no offense meant to the developers), or at least nothing to say that we haven’t covered in other articles about ransomware.  

Still, its oddities make it a valuable case study, not for technical innovation, but for the way it reflects shifting actor dynamics and common development pitfalls in the ransomware ecosystem. 

Turning Oddities into Actionable Intelligence 

Unusual samples like this DEVMAN variant can easily slip past traditional analysis workflows. With ransom note encrypted, scrambled filenames, and unexpected behavior across operating systems, manual investigation becomes time-consuming and risky to overlook. 

This is where ANY.RUN’s Interactive Sandbox proves invaluable. By logging every action in real time, from file system changes to mutex creation and registry modifications, it enables analysts to trace even fragmented or malfunctioning ransomware behavior.  

This kind of visibility gives security teams a real operational advantage: 

  • Faster detection and response: Immediate insight into threat behavior, even in offline or misconfigured attacks. 
  • Clearer attribution: Links to reused infrastructure, code similarities, and TTP patterns are surfaced early. 
  • More efficient investigation workflows: Analysts can extract IOCs, map persistence mechanisms, and understand impact without switching tools. 
  • Better collaboration across teams: Findings can be shared easily with SOCs, threat intel units, and communications teams, ensuring faster alignment during incidents. 

Start 14-day trial of ANY.RUN’s Interactive Sandbox in your SOC today 

MITRE ATT&CK Mapping 

Let’s jump to drafting a quick ATT&CK matrix for this sample, which ANYRUN does automatically for us: 

  • T1204.002 – User Execution: Malicious File 

The executable requires user (or threat actor) interaction to launch. 

  • T1053.005 – Scheduled Task/Job: Scheduled Task 

Presence of scheduling-related strings implies possible persistence via tasking. 

  • T1027 – Obfuscated Files or Information 

Internal file renaming and readme scrambling suggest static obfuscation logic. 

  • T1070 – Indicator Removal on Host 

The sample deletes registry keys and values shortly after writing them. 

  • T1135 – Network Share Discovery 

Explicit scanning for SMB shares (ADMIN$, IP ranges like 192.x, 172.x). 

  • 6T1021.002 – SMB/Windows Admin Shares 

Uses netapi32, srvcli, and netutils to interact with administrative shares. 

  • T1005 – Data from Local System 

Enumerates and encrypts user data including NTUSER.DAT and log files. 

  • T1486 – Data Encrypted for Impact 

Core functionality: encrypting files with .DEVMAN extension. 

  • T1490 – Inhibit System Recovery 

Attempts to interact with volume shadow copies. 

IOCs 

MD5:e84270afa3030b48dc9e0c53a35c65aa 

SHA256:df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7 

403 

FileName:hsfjuukjzloqu28oajh727190 

FileName:e47qfsnz2trbkhnt.devman 

SHA256:018494565257ef2b6a4e68f1c3e7573b87fc53bd5828c9c5127f31d37ea964f8 

References 

Analysis: https://app.any.run/tasks/64918027-01e6-415a-85b3-474fca5fc5c4 

VirusTotal Analysis (multiple labeling/attribution): https://www.virustotal.com/gui/file/ 

df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403 

Original Intel Pulse (OTX): https://otx.alienvault.com/pulse/ 

68535853fe15cff17229577d

The post DEVMAN Ransomware: Analysis of New DragonForce Variant  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

How much an ICS incident costs | Kaspersky official blog

/in

Despite over a decade of talk about “industrial digital transformation”, it’s only now we’re observing a tipping point. According to the VDC Research report Securing OT with Purpose-built Solutions, only 7.6% of surveyed industrial organizations consider themselves fully digital, but within two years 63.6% expect to be so. This shift is driven by two main factors: economic pressure pushing companies to radically increase efficiency, and the growing accessibility of technologies such as the industrial internet of things (IIoT) and edge computing.

Digitalization helps industrial enterprises boost both their efficiency and safety. Most organizations have already implemented asset, maintenance, and supply-chain management systems that reduce downtime and operating costs. More advanced technologies like digital twins and predictive analytics significantly improve processes, boost production, and cut waste of materials and resources. Integrating data from IT systems and ICS enables real-time decision-making based on up-to-date information.

But with integration comes vulnerability: systems that were once isolated or not digital at all become susceptible to IT failures and direct cyberattacks. Attacks on OT systems can lead to increased defect rates, failure of complex equipment, disruption of downstream production processes, and even catastrophic events that threaten worker safety. Even brief outages can have serious business consequences and damage a company’s reputation.

Major obstacles to industrial digitalization

According to the surveyed companies, cybersecurity concerns have become the main barrier to industrial digital transformation. Nearly 40% of the companies surveyed in the VDC report say they need to resolve this issue to move forward. Other top challenges include budget constraints and outdated equipment that’s too complex and expensive to upgrade for digital projects.

When it comes to security specifically, the top issues include a lack of resources for securing ICS equipment, inadequate security measures in existing infrastructure, and difficulties with regulatory compliance

The cost of an incident

When justifying cybersecurity budgets and planning for further development, experts unanimously recommend a risk-based approach tailored to the organization’s profile, its risk appetite, industry specifics, and other factors. The VDC Research report provides important data for this, documenting the nature and financial impact of security incidents in industrial organizations from 2023 to 2024. For example, 25% of surveyed companies that experienced security incidents with measurable financial consequences reported damages exceeding $5 million.

These costs include response efforts, direct revenue loss, and industrial-company-specific expenses like equipment repairs and losses of raw material or semi-finished goods. One of the top-three costs is unplanned downtime — a critical metric that industrial digitalization specifically aims to reduce. Most incidents resulted in downtime lasting 4–12 hours or 12–24 hours (with each range representing about a third of cases).

The cost breakdown is visualized below:
Distribution of Costs from Cybersecurity Breaches

The challenges of protecting ICS

Despite the recognized need for ICS cybersecurity and regulatory requirements, implementation remains difficult. Almost every surveyed organization faces the following challenges:

  • Limited visibility into OT networks due to numerous specialized communication protocols and incompatibility with standard IT monitoring tools
  • A shortage of specialists skilled in working with proprietary systems and industrial protocols
  • Insufficient network segmentation and the inability to isolate vulnerable equipment due to business needs; emergence of many new connections between IT and OT infrastructure
  • A growing number of IIoT devices with insecure configurations and vulnerable firmware (manufacturers often neglect security)
  • Outdated software and irregular patch releases
  • Delayed patch installation due to the need for extensive testing and coordination with operations teams regarding the installation window
  • Lack of detailed incident response plans that take into account critical events in OT networks

Some of these issues can’t be solved at the company level alone, but investing in specialized and integrated cybersecurity solutions can significantly mitigate the risks.

Specialized protection

While ICS protection projects are inherently complex, deploying specialized solutions purpose-built for OT/IT environments can increase efficiency and reduce risks. Key tools include asset and network traffic monitoring solutions (such as Kaspersky Industrial Cybersecurity for Networks) and endpoint protection solutions (such as Kaspersky Industrial Cybersecurity for Nodes). Organizations with mature cybersecurity programs use these as part of a defense-in-depth strategy — a multilayered security approach.

These solutions have features designed specifically for industrial networks, such as avoiding disruption of critical processes and communication, and operating with limited memory and processing power. This helps avoid meltdowns like the notorious CrowdStrike incident, where a careless security update disabled protected systems.

In the near future, technologies like SD-WAN and then SASE will play a bigger role by embedding security deeply into network architecture while ensuring resilience. Ultimately, the gold standard is a secure-by-design architecture, which should be built into smart industrial equipment by manufacturers at the outset.

Security implementation is a serious project — not just for the cybersecurity team but also for engineers and plant operators. As a result, project approval and rollout are often delayed. To reduce the burden on everyone involved, and also speed up the deployment of protection, companies should avoid a fragmented hodge-podge of security tools, and instead use comprehensive solutions from a single vendor. This simplifies both deployment and ongoing management through better integration. According to VDC’s survey, around 60% of organizations prefer getting all their security solutions from one provider.

How protection saves money

Despite the challenges, companies adopting specialized ICS protection solutions are already seeing clear economic benefits.

The VDC report shows that from 2023 to 2024, the number of incidents decreased in companies that deployed network and device monitoring tools. On average, incident rates dropped from 2.7 to 2.2 per year. Organizations using standard endpoint protection brought incidents down from 2.1 to 1.6. In contrast, industrial companies neglecting IT and OT protection experienced an average of 3.8 incidents — about twice as many as their better-protected competitors.

You can explore more about typical industrial digitalization projects, cyber incident damage estimates, and comprehensive protection recommendations in the full VDC report.

Kaspersky official blog – ​Read More

This month in security with Tony Anscombe – June 2025 edition

/in

From Australia’s new ransomware payment disclosure rules to another record-breaking DDoS attack, June 2025 saw no shortage of interesting cybersecurity news

WeLiveSecurity – ​Read More

Passkey FAQ for power users | Kaspersky official blog

/in

So far in our comprehensive guide to passkeys, we’ve covered how to ditch passwords on popular combinations of Android, iOS, macOS, and Windows smartphones and computers. This post focuses on important specific cases:

  • One-time sign-ins to your account from someone else’s device
  • Tips for frequent computer and smartphone switchers
  • Ways to secure your account when backup password sign-in is enabled
  • Potential issues when traveling internationally
  • What happens when using niche browsers and operating systems

How to use passkeys on public or shared computers?

What if you need to sign in to your passkey-protected account from a library, an airport computer, or a relative’s home? Don’t rush to remember your backup password.

Start the sign-in process on the computer: enter your username and, if prompted, click Sign in with passkey. A QR code will appear on the screen for you to scan with the smartphone that stores your passkey. If the scan is successful, the QR code will disappear, and you’ll be signed in to your account.

Several factors must align for this seemingly simple process to proceed smoothly:

  • The computer must support Bluetooth Low Energy (BLE), which verifies that your smartphone and the computer are indeed nearby.
  • The computer’s operating system and browser must support passkeys.
  • Both the computer and your smartphone need a reliable internet connection.

How to save passkeys to a hardware security key?

You might find using passkeys via QR codes inconvenient if you frequently access your accounts from different devices. If that’s the case, you can store your passkeys not on your computer or smartphone, but on a USB hardware security key — such as a YubiKey, Google Titan Security Key, or a similar device — for secure website sign-in. When you create a passkey, just choose to save it to your hardware key. Then you can sign in to your account from any computer or smartphone by plugging in that security token.

Just make sure it has the right combination of ports (USB-A, USB-C, Lightning) or NFC support to work with all your devices. Some token models even include a fingerprint scanner, which provides an extra layer of protection against account hijacking if your device is stolen or lost.

Unfortunately, there’s a catch: many older and popular token models can store a maximum of only 25 passkeys. Only a few advanced models — like the YubiKey with firmware version 5.7 — have raised this limit to 100.

Additionally, operating system developers view passkeys as a great opportunity to tie users more closely to their ecosystems. By default, depending on your smartphone, you’ll likely be prompted to save your passkey to either iCloud Keychain or Google Password Manager. As a result, the option to use a hardware security key might be hidden deep within the interface.

To create a passkey on a hardware token, you’ll often need to click the not-so-obvious Other options link on macOS/iOS, or Different device on Android, to select the hardware key option.

How to transfer passkeys between iOS and Android?

The biggest headache right now is if you store all your passkeys in your smartphone’s default storage and you want to switch ecosystems — moving from Android to iOS or vice versa. Currently, none of the three major OS developers — Google, Apple, or Microsoft — let you directly transfer passkeys. That’s because no one can guarantee the process will be secure. Both Apple and Google are working on implementing this feature in the future, but if you decide to swap devices today — say, from an iPhone to a Google Pixel — transferring your passkeys won’t be straightforward.

  • First, you’ll need to sign in to the account protected by a passkey on your new device. You can do this either by using your good old password (if it’s still enabled), or by scanning a QR code with your old device that has the active passkey.
  • Next, you’ll need to create and save a new passkey on your new device. Yes, you can have multiple passkeys for each website or online service.
  • Finally, if you plan to get rid of your old gadget, you’ll need to delete the old passkey from it.

To avoid this hassle, it’s best to use a third-party password and passkey manager right from the get-go. With Kaspersky Password Manager, passkey support is already available on Windows, with Android support planned for July, and iOS and macOS support — for August 2025.

How to protect an account with a passkey from being hacked using a backup password?

Most online services that offer to switch to passkeys don’t disable other sign-in methods. If your account was protected by a weak or compromised password before you switched to a passkey, cybercriminals can still bypass your shiny new passkey by simply signing in with that old password.

Creating a passkey for an account that still has a weak password is like installing a bulletproof front door while leaving the flimsy back door unlocked with the key hidden under the mat.

That’s why, before you enable passkeys for any online service, we strongly recommend changing your password as well. Since you won’t be typing this password every day — it’s just a backup for your passkey-protected account — you can really go wild with its complexity. We’re talking strong passwords that are 16 characters or longer, and mixing up letters, numbers, and special characters. These are practically uncrackable. Ideally, generate and save that robust password in the same password manager where you’re planning to store your passkeys. Don’t rely on AI models to generate complex passwords. Our recent research revealed that while these passwords might look complex, LLMs tend to favor certain characters for no obvious reason when creating passwords, which makes their output surprisingly predictable.

Passkey drawbacks?

The underlying WebAuthn standard that powers passkeys can be implemented quite differently across browsers and operating systems. Websites often adopt these capabilities in their own unique ways. This can lead to frustrating challenges — even for tech-savvy users. Here are a few examples of this:

  • When creating passkeys, standard Windows prompts give you plenty of options for where and how to save them. By default, Windows saves passkeys in secure local storage on your computer. If you forget to select your password manager as the save location, that passkey won’t be available on your other devices.
  • Many online services like Kayak or AliExpress have dozens of regional versions, with each one being a separate website: .com, .com.tr, .co.uk, etc. If you create a passkey for, say, your local site, and then for some reason try to access the same online service in a different region, it’s highly likely you won’t be able to sign in with that passkey.
  • Some websites don’t support creating or signing in with passkeys when using Firefox, regardless of the platform. In reality, there’s no technical incompatibility here, and simple tricks can resolve the issue, but it’s unclear why users should have to resort to these workarounds.
  • Some Apple users have reported that all their previously saved passkeys periodically disappear from their Keychain, while certain Android users can’t activate passkeys without re-flashing or factory-resetting their devices.

Any one of these situations is made worse by the fact that errors when creating or signing in with passkeys are either not mentioned at all in help documentation, or described very vaguely. It’s often completely unclear how to fix the problem. However, when passkey issues arise, websites almost always offer a backup option, such as sending a one-time access code to your email.

Despite these challenges, a passwordless future with passkeys is on the horizon. We recommend getting ready now by creating passkeys wherever possible, saving them in your password manager, and remembering to check and update your passwords and contact information on websites to make sure you can recover access if your passkeys ever give you trouble.

Want to read more about passwords and passkeys?

Kaspersky official blog – ​Read More

Getting a career in cybersecurity isn’t easy, but this can help

/in

Getting a career in cybersecurity isn’t easy, but this can help

Welcome to this week’s edition of the Threat Source newsletter. 

Happy summer, friends! I hope everyone is staying cool and/or warm. 

I am fresh back from an exhaustive but great time in San Diego at Cisco Live U.S. It was so good to see colleagues, meet new friends and pet many therapy dogs in the Splunk booth. As often happens to me, I was approached by someone who was looking for mentorship and guidance in how to get into a cybersecurity career. It’s not unusual for me to be approached by folks looking to get into cybersecurity. I’m the large, bearded guy with the Talos shirt, so I stick out.  

So, I’m often asked how I got the career I have in cybersecurity and how others can do the same. For a guy who often has a quip or answer for most things, I always pause here. I can’t help but think of my entire career and the dumb luck and hard work that landed me where I’m at. Giving that summation to others wouldn’t be fair, because… well, my journey wasn’t a linear one. I think for many of my peers, the same applies. We found cybersecurity as a career through a series of events that organically landed us in this field. In my case, moreso than others, the path isn’t easy to follow because there was no clearly staked path for me to follow, either. 

I’ll explain as best I can: One today might go to school and graduate with a degree in information security and/or some security certificates, then begin the job hunt for an entry level gig. These types of degrees, certificates and even jobs simply didn’t exist in any meaningful way or numbers when I started my career. If you wanted to learn cybersecurity, there weren’t classes to take — you got a computer science degree and figured it out. I, like many in the GenX world, started as an IT professional. As the industry and cyber threats evolved, the career space over the years shifted and we found ourselves helping fight the good fight and keeping folks secure. 

Today is truly different, and I’m so happy about it and the opportunities it can give others. I’m envious of the school degrees, industry certifications and mentorship programs that exist today that did not exist for me. There is also an incredibly helpful information security community that provides hacking tutorials, or Capture the Flag competitions (CTFs) or hackathons that I would have loved to have been a part of in my formative years.  

By now, I know you’re thinking, “Cool story, grandpa, but answer the question: how do I get a job in cybersecurity?” In my estimation, the answers are as follows:  

  1. Have a good attitude. 
  2. Be easy to work with. 
  3. Be a forever student. 
  4. Be bad at giving up. 
  5. Find and join a (preferably local) security community. 
  6. Grow where you are planted. 

Notice that none of those things mention anything specifically technical. No malware reverse engineering, red teaming, threat intelligence or security analyzing. I can tell you that to work at Talos, you must exhibit strong traits of all six of those things I listed. One through five makes sense. Good hackers are tenacious, smart, work well with others and seek out fellow friends to network and hack with. 

Number six though – what’s up with that? Simply put, life deals us all a hand of cards that we must play, and those cards may not be great. For example, you want to get a job in cybersecurity, but you’re a primary care giver of a family member and you don’t have a lot of freedom. You might be financially constrained. You may have health issues or a disability that limits some options. Or you simply just have a job that you don’t like, and a career in security calls out to you, but the bills don’t pay themselves. This is all common, and you’re a bit “stuck.”  

So while you’re stuck, find ways to grow where you’re planted. Study. Network locally or online. Try a CTF or a hacking competition. Whatever you do, just keep growing yourself, your skillset and your network. You can do it. And before you know it, you’ll have that career helping to fight the good fight with the rest of us. 

I believe in you! You got this! 

The one big thing 

Cybercriminals are increasingly exploiting Large Language Models (LLMs) by using uncensored versions, developing their own malicious LLMs or “jailbreaking” legitimate ones to bypass safety protocols. These compromised or malicious LLMs are then used to generate highly convincing phishing campaigns, create harmful code and automate various cybercrime operations, making attacks more sophisticated and scalable. 

Why do I care? 

Cybercriminals’ widespread abuse of LLMs lowers the barrier to entry for sophisticated attacks, making it easier for even less skilled actors to launch effective campaigns. This means you’re more likely to run into highly convincing phishing attempts, scams and malware that are difficult to distinguish from legitimate communications, putting your personal info and company security at higher risk. 

So now what? 

Given this evolving threat landscape, it’s important to be extra vigilant and skeptical online. Treat all online communications with caution, even if they look perfectly authentic. For individuals, that means double-checking emails and messages for anything fishy, no matter how well-written they seem. For businesses, it’s time to beef up your cybersecurity defenses, invest in smart threat detection and keep your employees sharp on how to spot and report these increasingly clever social engineering tricks.

Top security headlines of the week 

New AI Jailbreak Bypasses Guardrails With Ease 
On topic with our latest blog, the new “Echo Chamber” attack bypasses advanced LLM safeguards by subtly manipulating conversational context, proving highly effective across leading AI models. (SecurityWeek)

US insurance giant Aflac says customers’ personal data stolen during cyberattack 
Aflac says hackers stole an unknown quantity of its customers’ personal information from its network during a cyberattack earlier this month. (TechCrunch) 

APT28 Uses Signal Chat to Deploy New Malware in Ukraine  
A new cyber attack campaign by the Russia-linked APT28 (aka UAC-0001) threat actors using Signal chat messages to deliver two new malware families dubbed BEARDSHELL and COVENANT. (The Hacker News) 

UK watchdog fines 23andMe over 2023 data breach 
The U.K. data protection watchdog has fined 23andMe £2.31 million ($3.1 million) for failing to protect U.K. residents’ personal and genetic data prior to its 2023 data breach. (TechCrunch) 

Can’t get enough Talos? 

Decrement by one to rule them all: AsIO3.sys driver exploitation 
Learn how our researcher, Marcin Noga, found two critical vulnerabilities in ASUS’ Armory Crate and AI Suite drivers. 

Talos Takes: Teaching LLMs to spot malicious PowerShell scripts 
Hazel chats with Ryan Fetterman from the SURGe team to explore his new research on how LLMs can assist security operations centers in identifying malicious PowerShell scripts.

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos
Wednesday, July 23
11:00 a.m. to 12:00 p.m. PDT
Join us for a discussion around the latest security detections developed for the SOC and how to find and remediate threats, faster.

Upcoming events where you can find Talos 

  • REcon (June 27 – 29) Montreal, Canada 
  • NIRMA (July 28 – 30) St. Augustine, FL 
  • Black Hat USA (Aug. 2 – 7) Las Vegas, NV  

Most prevalent malware files from Talos telemetry over the past week 

SHA 256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
MD5: 2915b3f8b703eb744fc54c81f4a9c67f 
VirusTotal: https://www.virustotal.com/gui/file/9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507  
Typical Filename: VID001.exe 
Claimed Product: N/A 
Detection Name: Win.Worm.Coinminer::1201 

SHA 256: 05883fccb64dd4357c229ccca669afdacbfa0bc9a1c8d857f5205aed0a81e00a 
MD5: 71b973dbdfc7b52ae10afa4d0ad2b78f 
VirusTotal: https://www.virustotal.com/gui/file/05883fccb64dd4357c229ccca669afdacbfa0bc9a1c8d857f5205aed0a81e00a/details 
Typical Filename: PCAppStore.exe 
Claimed Product: PC App Store 
Detection Name: Riskware/VeryFast 

SHA 256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91   
MD5: 7bdbd180c081fa63ca94f9c22c457376   
VirusTotal: https://www.virustotal.com/gui/file/a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91/details
Typical Filename: IMG001.exe  
Claimed Product: N/A 
Detection Name: Simple_Custom_Detection   

SHA 256: c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0 
MD5: 8c69830a50fb85d8a794fa46643493b2  
VirusTotal: https://www.virustotal.com/gui/file/c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0/details  
Typical Filename: AAct.exe  
Claimed Product: N/A  
Detection Name: PUA.Win.Dropper.Generic::1201 

SHA 256: 2a753cdc8c5401dcb67f3be58751a32ce23c875f8720a70459533b30e5ba4f1f 
MD5: 7d5a9a41157fb0002f5234b4512e0ac2 
VirusTotal: https://www.virustotal.com/gui/file/2a753cdc8c5401dcb67f3be58751a32ce23c875f8720a70459533b30e5ba4f1f/details 
Typical Filename: pros.exe 
Claimed Product: N/A 
Detection Name: Trojan.GenericKD.76128711 

Cisco Talos Blog – ​Read More

How to survive digitalization | Kaspersky official blog

/in

Digitalization of business – especially in the small and medium-sized segment – allows for quick upscaling, better customer service, and entry into new markets. On the downside, digitalization amplifies the damage caused by a cyberattack, and complicates the recovery process. Given that company resources are always limited, which attacks should be deflected first?

To answer this question, we studied the INTERPOL Africa Cyberthreat Assessment Report 2025. The document is useful because it collates police cybercrime statistics and data from information security companies – including Kaspersky – allowing us to compare the number and types of attacks with the actual damage they caused. This data can be used to build a company’s information security strategy.

Average ranking of cybercrime types

Average ranking of cybercrime types by reported financial impact across African subregions, based on INTERPOL member country data. Source

Targeted online fraud

Fraudulent operations were the clear leader in terms of damage caused across the continent. They’re gaining momentum in line with the rising popularity of mobile banking, digital commerce, and social media. In addition to mass phishing aimed at personal and payment data theft, targeted attacks are growing at a rapid rate. Scammers are grooming potential victims in messenger apps for months, building trust and guiding them into a money extortion scheme – for example, a fake cryptocurrency investment. Such schemes often exploit romantic relationships and are therefore called romance scams, but there are other variations. In Nigeria and Ivory Coast, for example, scammers were arrested for attacking small media platforms and advertising agencies. Posing as advertisers, they stole almost 1.5 million U.S. dollars from victims.

The fact that 93% of Africans use plain old WhatsApp rather than corporate communication tools for work significantly boosts the success rate of attacks on employees and company owners.

Ransomware incidents

Press headlines may give the impression that ransomware operators mainly target large organizations, but the statistics in the report debunk this theory – showing that both the number of attacks and the actual financial damage caused are significant across all business segments. What’s more, there’s a direct link between the level of digitalization and the number of attacks. So, if a company observes an overall increase in “digitized” business activity in its market segment, the threat level is sure to rise accordingly. In Africa, “affiliates” of the largest and most dangerous ransomware-as-a-service platforms – such as LockBit and Hunters International – are responsible for major incidents on a national scale.

Among the main ransomware incidents in Africa – hardly known about outside the continent – we highlight the following: the theft of $7 million from Nigerian fintech company Flutterwave; attacks on Cameroonian electricity supplier ENEO; a large-scale ransomware attack to exfiltrate data from Telecom Namibia; and the targeting of South Africa’s National Health Laboratory Service (NHLS), which led to canceled operations and the loss of millions of lab test results.

Banking Trojans and infostealers

Although the direct losses from banking Trojans and infostealers fell outside the top-three in terms of damage, it’s the “successes” of this criminal industry that have a direct impact on the number and severity of other attacks – primarily ransomware and business email compromise (BEC). After stealing what credentials they can from thousands of users with infostealers, attackers filter and group them by various criteria, then sell curated sets of accounts on the illicit market. This allows other criminals to buy passwords to infiltrate organizations of interest to them.

Business email compromise

For small and medium businesses mainly using public services like Gmail or Office 365, infection with an infostealer gives attackers full access to corporate correspondence and business operations. The attackers can then exploit this to trick customers and counterparties into paying for goods and services to a fraudulent account. BEC attacks have a firm hold at the top of the damage charts, and small businesses can fall victim to them in two ways. First, cybercriminals can extract money from larger clients or partners by impersonating the compromised small business. Second, it’s easier with a small business to persuade the owner or accountant to transfer money than it is with a large organization.

There are several large criminal syndicates based in Africa that are responsible for international BEC operations causing multi-billion-dollar damage. Their targets also include African organizations — primarily those in the financial and international trade sectors.

How to protect business from cyberthreats

To effectively counter digital threats, law enforcement agencies need to share data with commercial information security companies that harness telemetry to identify threat distribution hotspots. Recent successes of such partnerships include operations Serengeti (1000 arrests, 134 000 malicious online resources disabled), Red Card (300 arrests), and Secure (32 arrests, 20 000 malicious resources disabled). These operations, conducted under the auspices of INTERPOL, used cyberthreat intelligence received from partners – including Kaspersky.

But businesses can’t leave cybersecurity solely to the police; they need to implement simple but effective security measures of their own:

  • Enable phishing-resistant multi-factor authentication (MFA) for all online accounts: Google, Microsoft, WhatsApp, etc.
  • Install reliable anti-malware protection on all corporate and personal devices. For corporate devices, centralized security management is recommended – as implemented, for example, in Kaspersky Endpoint Detection and Response.
  • Hold regular cybersecurity training – for example, using our Kaspersky Automated Security Awareness platform. This will reduce the risk of your company falling victim to BEC and phishing. All employees, including management, should participate in training regularly.
  • Back up all company data on a regular basis and in such a way that the backups can’t be destroyed during an attack. This means backing up data either to media that are physically disconnected from the network, or to cloud storage where a policy prohibits data deletion.

Kaspersky official blog – ​Read More

Decrement by one to rule them all: AsIO3.sys driver exploitation

/in

Introduction

Decrement by one to rule them all: AsIO3.sys driver exploitation

Armory Crate and AI Suite are applications used to manage and monitor ASUS motherboards and related components such as the processor, RAM or the increasingly popular RGB lighting. These types of applications often install drivers in the system, which are necessary for direct communication with hardware to configure settings or retrieve critical parameters such as CPU temperature, fan speeds and firmware updates.

Therefore, it is critical to ensure that drivers are well-written with security in mind and designed such that access to the driver interfaces are limited only to certain services and administrators.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 1. Armory Crate application.

During the audit of the code and components related to the aforementioned applications, Cisco Talos discovered two critical vulnerabilities in the AsIO3.sys driver. Both vulnerabilities were discovered in the IRP_MJ_CREATE handler:

The first vulnerability is a stack-based buffer overflow that occurs during the process’s ImagePath conversion from “Win32 Path” to “NT Namespace Path”.

The second vulnerability allowed bypassing the authorization mechanism implemented in the driver, granting access to its functionality not just to the intended service but to any user. With access to a security-critical function within this driver, I successfully developed a fully working exploit that escalates local user privileges to “NT SYSTEM”, which we describe in detail below.

Please keep in mind that I discovered this exploit before the Windows 11 24H2 update arrived. This update prevents regular users from leaking information such as loaded kernel modules and their addresses via “NtQuerySystemInformation.” This is discussed in further detail below.

Recon phase

While looking for drivers installed alongside the Armory Crate software, I noticed two related to ASUS in the DriverView list.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 2. Screenshot presenting driver entries belonging to ASUSTek Computer Inc.

Focusing on AsIO3.sys, I investigated whether this driver creates any devices and, most importantly, whether a regular user can communicate with such a device.

Obtaining a handle to the Asusgio3

Using DeviceTree, we can see the following encouraging picture:

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 3. DeviceTree incorrectly displays that the group “everyone” has full access to the Asusgio3 device.

The AsIO3.sys driver creates the Asusgio3 device, which nearly everyone in the system has full access to. After a quick check with a simple code that attempts to open a handle to the device, I got the error code:
“5 == ERROR_ACCESS_DENIED”.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 4. Part of PoC code responsible for opening a handle to the Asusgio3 device.

This was unexpected based on the DeviceTree interface, so I re-checked the privileges to that device using Sysinternals “accesschk” and got completely opposite results.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 5. Checking permissions for Asusgio3 with “accesschk”.

Which is the truth? To find out, I reversed fragments in the AsIO3 driver responsible for handling the “IRP_MJ_CREATE” request.

Analyzing “IRP_MJ_CREATE” handler

By loading the driver and beginning the reversing process, we see a single function handles IRP requests for three different request types.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 6. Driver initialization routine where IRP request handlers are assigned to DriverObject.

Diving into “callback_irp_dispatch”, I found a fragment responsible for handling the “IRP CREATE” request:

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 7. Part of “callback_irp_dispatch” function code. Functions’ names have been added by the author.

Authorization mechanism 

Checking the “ImageHashCheck” function, we can see the following:

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 8. ImageHashCheck function body.

Using the API “ZwQueryInformationProcess” with the flag “ProcessImageFileNameWin32” (lines 8 and 19), ASUS developers attempt to obtain the image path (the path to the executable file) of the current process — specifically, the process that is trying to obtain a handle to the device.  

Next, in line 26, we see the translation of the path from the “Win32 File Namespace” to the “NT Namespace”. Hold tight — we will return to this line in a moment.

In lines 35-46, there is a typical SHA256 hash calculation for the current process’s executable file. In line 47, the calculated hash is compared with a hardcoded hash in the driver, and if they match, the function returns “true”, allowing the process to obtain a handle to the device.

When we dump the hash from the global variable “g_sha256Hash” (visible on line 47), it appears as follows:

python
Python>binascii.b2a_hex(idc.get_bytes(0x0000000140009150,32))
B'c5c176fc0cbf4cc4e37c84b6237392b8bea58dbccf5fbbc902819dfc72ca9efa'

I calculated the SHA256 hash for “AsusCertService.exe” and saw that it was the same hash:

powershell
PS C:Usersicewall> Get-FileHash -Path "C:Program Files (x86)ASUSAsusCertServiceAsusCertService.exe" -Algorithm SHA256

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
SHA256          C5C176FC0CBF4CC4E37C84B6237392B8BEA58DBCCF5FBBC902819DFC72CA9EFA       C:Program Files (x86)ASUSAsusCertServiceAsusCertService.exe

With this new understanding, only the “AsusCertService.exe” service and processes whose PIDs are added by it to the allowed list can obtain a handle to the Asusgio3 device. Otherwise, the operation returns the status “Access is denied.”

Win32PathToNtPath – stack based buffer overflow

This article will not spend much time on the vulnerability discovered in the “Win32PathToNtPath” function, as it will not be used in the later stages of exploitation. However, it is interesting enough to mention.

The developers assumed that a Windows path could have a maximum length of approximately “MAX_PATH” (260) characters. Based on this assumption, they copied the received Image Path into a fixed-size 255-character buffer located on the stack, without first checking the actual length of the path. However, this assumption is incorrect, as a path can exceed ~260 characters. As Microsoft documents here, “The maximum path of 32,767 characters is approximate, because the “\?” prefix may be expanded to a longer string by the system at run time, and this expansion applies to the total length.”

For more information about this vulnerability, read this advisory: CVE-2025-1533/TALOS-2025-2144 – Asus Armoury Crate AsIO3.sys stack-based buffer overflow vulnerability

Authorization bypass

Knowing that the authorization mechanism is based on the “ImagePath” returned by the “ZwQueryInformationProcess” API and the SHA256 hash calculated for the executable file at this path, we can start considering potential bypasses.

By examining the implementation of “(Nt/Zw)QueryInformationProcess” in the “Windows Research Kernel (WRK)”, I learned that the information about the current process’s “ImagePath” is retrieved from the “EPROCESS” structure. Therefore, there is no chance to manipulate its value from User-Mode, but there are still options for potential bypass. 

Hardlinks to the rescue

Using a hardlink, we can bypass the “ImageHashCheck” routine. First, we create a hardlink to the PoC.exe file.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 9. Creation of a hard link pointing to “PoC.exe”.

The “PoC.exe” won’t do much for now — it will simply wait for user input before attempting to open a handle to the Asusgio3 device.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 10. Image presenting part of the PoC.exe file responsible for opening a handle to the Asusgio3 device.

Instead of running our “PoC.exe” directly, we then execute “run.exe” hardlink. As a result, in the EPROCESS structure, ImagePath will point to a hardlink.

While the run.exe (PoC.exe) is executed and waiting for user input, we then delete the hardlink and create a new one with the same name, but pointing to AsusCertService.exe. However, trying to create a direct hard link to the original AsusCertService.exe location returns the following:

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 11. Due to implemented mitigations, the attempt to create a hardlink to the direct location of AsusCertService.exe failed.

Because of mitigations Microsoft introduced years ago, a user can only create a hard link to a file that they have permission to overwrite. This is not a problem in this case, as I can simply copy the file to a temporary location and then create a hard link.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 12. Successful attempt to create a hardlink to the local copy of AsusCertService.exe.

Now I can further run the previously executed PoC.exe process. In this scenario, at the moment when PoC.exe attempts to open a handle to the Asusgio3 device, the run.exe hard link points to the AsusCertService.exe file, and the SHA256 hash matches. When this occurs, we can bypass this authorization mechanism.

Finding strong exploitation primitives

Analyzing the driver’s functionality

Browsing through the code of the AsIO3.sys driver’s IOCTL handlers, I came across the following functionality, which serves as a good primitive for exploit development. As a regular user, I performed the following actions (among others) using proper IOCTL:

  • Read/write to Model-specific registers (MSR)
  • Map arbitrary physical memory [address,size] into our process virtual memory
  • Read/write I/O ports

However, the exploitation turned out to be more challenging than this originally indicated.

Exploitation attempt with MSR modification

There are at least two crucial MSR registers from a security perspective:

  • IA32_LSTAR (0xC0000082) 
  • IA32_SYSENTER_EIP (0x00000176)

These MSR registers define the addresses in the kernel where execution is redirected when the SYSCALL or SYSENTER instructions are triggered. By modifying these registers, we can potentially hijack control flow and execute arbitrary code with privileged access, making them an important vector in kernel exploitation. I found a promising-looking handler for IOCTL 0xA040A45C, which allows overwriting the MSR register with arbitrary data.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 13. IOCTLT handler providing limited way to modify MSR registers.

In line 16, the “_writemsr” instruction, where the data we control, coming from “SystemBuffer” (line 8), is used as the MSR register index (“msrReg”) and value (“msrRegVal”).

At first glance, this looks promising; however, there is a call in line 11 that checks the “msrReg” value (index). Take a closer look:

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 14. MSR filtering function, allowing modification of only a limited set of MSR registers.

The MSR index is checked against the list of allowed MSR indexes located in the “MSR_allowedList” array. Unfortunately, this list does not show the crucial registers mentioned earlier: “IA32_LSTAR (0xC0000082)” or “IA32_SYSENTER_EIP (0x00000176)”. Instead, after decoding the indexes to register names and their purposes, we can only manipulate registers without security implications.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 15. Table presenting part of allowed MSR indexes.

With these discoveries, we must look for alternative exploitation methods.

Physical memory mapping

Looking for other code that could be useful during the exploitation process, I found a few IOCTL handlers giving the possibility to map physical memory into the virtual address space of our process. One of them is “0xA040200C”.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 16. Function body responsible for physical memory mapping into caller virtual memory.

We fully control the values of arguments passed to this function: “phyAddress”, “memSize”. At first glance, it seems as though we can map arbitrary physical memory into our user space. We can leverage this primitive in a few different ways, some of which are below:

  • Try to translate the virtual address of important kernel data that we want to modify into a physical address, then use the above code to map it to our user space. Since this address translation cannot be done from User-Mode, we need to use the Kernel-Level API “MmGetPhysicalAddress”.
  • Consistently map successive portions of physical memory and search for structures such as the EPROCESS structure of the SYSTEM process to later replace our process’s security token with the token belonging to the SYSTEM process.
  • Using knowledge about “Low Stub” (PPROCESSOR_START_BLOCK structure), read the value of the CR3 register (PML4 base address) and then, by reading other entries from the memory paging structures, manually translate any virtual address to a physical one.

Russell Sanford’s “Exploiting LOLDrivers” presentation provides more information about these methods, but I had to choose one adequate for the situation.

Unfortunately, I can’t directly translate virtual addresses to physical ones via MmGetPhysicalAddress because there is no way to call this API directly in this driver. Searching through physical memory is very time-consuming and might be problematic (see other examples of implementations and the issues people encountered when choosing this path).

In the end, I chose to implement the “Low Stub” method to manually translate virtual addresses to physical ones. Before doing this, I looked at the function called in line 18, which I named “checkPhyMemoryRange”.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 17. checkPhyMemoryRange body, allowing mapping only certain ranges of physical memory.

Developers defined certain physical memory address ranges located under the “g_goodRanges” variable. If the specified range does not fit pre-defined ranges, the function returns true, continues execution and results in an error code.

When checking the location of the “Low Stub” “PPROCESSOR_START_BLOCK structure”, we’re able to read it. In the same way, we could read the value of the CR3 register pointing to the PML4 base address.

The next entry from the memory mapping structures pointed to a location outside the allowed address ranges. As a result, I abandoned this approach.

Decrement by one to rule them all

Looking for new useful piece of code, I spotted the following “IOCTL 0xa0402450” handler:

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 18. IOCTL handler allowing for a call “ObfDereferenceObject” with an arbitrary address controlled by the user.

Users can fully control all three arguments. At first glance, this code might look quite harmless, but when I dove into internals of “ObfDereferenceObject”, I saw the following:  

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 19. A small part of the implementation of the “ObfDereferenceObject” API.

Being able to pass arbitrary addresses to “ObfDereferenceObject”, I can decrement any memory value by 1. To be precise, using “ObfDereferenceObject” I decrement by 1 memory located at “Object – 0x30”. I kept this in mind when writing the exploit.

Are there enough puzzles?

But how can we turn these primitives into something useful? Do we need an additional memory leak? When I decided to create a fully working exploit, I assumed a scenario where the code would be executed by a local user (process integrity level: medium). Those familiar with the exploitation process on Windows know that NtQuerySystemInformation can provide very useful information about kernel structures.

However, it’s 2025 and Windows 11 is in use. I remembered news about an upcoming mitigation that would prevent regular users from leaking information such as loaded kernel modules and their addresses via “NtQuerySystemInformation”.

At the beginning of February, when I wrote a fully working exploit, my Windows 11 still did not get the 24H2 update. It was still “ntoskrnl.exe – 10.0.22621.4890 (WinBuild.160101.0800)”.

After I finished writing this article in March 2025, I could see that my 24H2 update finally arrived (“ntoskrnl.exe -10.0.26100.3476 (WinBuild.160101.0800)”). Leaking kernel addresses with “NtQuerySystemInformation” is no longer possible.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 20. ntoskrnl.exe before mitigation visible at the top, where bottom part presents ntoskrnl.exe with implemented mitigation.

Exploitation

Armed with all the knowledge mentioned above, I began writing the exploit.

Leak own thread KTHREAD structure address

As mentioned in the previous paragraph, users can utilize the “NtQuerySystemInformation” API to leak, among others, the address of the “KTHREAD” structure for its own thread. This is where such a simple primitive as “decrement by one” becomes useful.

The “KTHREAD” structure at offset “0x232” has a field called “PreviousMode”, which for User-Mode threads is set to 1. That field is very important and is checked by multiple kernel-level APIs, eventually limiting their functionality if a user calls a particular syscall from User-Mode.

For example, examine what happens when the API calls “ReadProcessMemory,” which calls syscall “NtReadVirtualMemory (MiReadWriteVirtualMemory)”.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 21. Part of NtReadVirtualMemory implementation showing meaning of PreviousMode field.

As we can see at the beginning, the syscall obtains the current thread structure at line 11. Next, in line 13, there is a special condition for the case when PreviousMode is set to 1 (User-Mode). In line 23, there is a check verifying whether the address pointed to by the user (“BaseAddress”), when increased by the requested memory size, exceeds the maximum address where user-mode components are mapped. This ensures that a user making a call from User-Mode cannot read any memory from the Kernel-Mode address space.

Based on this fact, I changed PreviousMode for my own thread by decrementing its value from “1” to “0”, effectively changing its status from User-Mode to Kernel-Mode. This allows me, among other things, to read and write across the entire address space.

To find the address of “KTHREAD” for my own thread, I followed these steps:

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 22. Using “NtQuerySystemInformation” to obtain information about all opened handles in the system.

To identify my own thread, I opened a handle to it in line 8. (I later used the handle value to spot related to its structure.) Calling “NtQuerySystemInformation” with “SystemHandleInformation” class, I obtained information about all handles in the system. To spot my own thread handle, I filtered the results looking for a handle value, process ID and object type (thread).

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 23. Searching for structure related to their own thread.

Change PreviousMode

Now that I had the “KTHREAD” address and primitive to change the “PreviousMode” field, I combined it together:

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 24. Initial part of the exploit code.

I obtained a pointer to the EPROCESS structure simply by using information about its location from KTHREAD. EPROCESS will be discussed in more detail shortly. Remember that “ObfDereferenceObject” subtracts 0x30 from the address passed as an argument, which is why in line 900, 0x30 is added to the PreviousMode address.  

Next, thanks to line 903, we have time to swap the symlink destination and bypass the authorization mechanism before opening a handle to the Asusgio3 device. Inside the “DecrementPreviousMode” function, I simply opened a handle to “Asusgio3” and sent a properly formatted buffer to trigger the primitive.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 25. Code responsible for sending IRP requests triggering a call to a “ObfDereferenceObject” API with the arbitrary address.

Stealing token

The “PreviousMode” field of the thread has now been changed to “Kernel-Mode”, allowing me to read the entire virtual address space.  With this capability, the first step is to read and store the address location of the EPROCESS structure.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 26. Read the address location of the EPROCESS structure.

Having the address of my own EPROCESS structure, I started to search the linked list of processes for the SYSTEM process (PID == 4). To achieve this, I used a specific field within the EPROCESS structure called “ActiveProcessLinks”, which is a double-linked list of all processes in the system.

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 27. Traversing the linked list of processes, looking for the SYSTEM process.

Finding the EPROCESS structure belonging to the SYSTEM process allows me to read its security token and replace the token with the one just read. Remember to increment the reference count of the SYSTEM token!

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 28. Swapping the user’s own security token with SYSTEM one.

Run escalated console

Now I can run the escalated console:

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 29. Execution of the console, which should be run with escalated privileges to the SYSTEM level.

This reveals the following:

Decrement by one to rule them all: AsIO3.sys driver exploitation
Figure 30. Image showing a fully functional exploit in action and its result.

Success! This exploit results in a console with escalated privileges to SYSTEM level. Watch the video here.

Summary

During the reversal process, I noticed that the developers had patched some previously discovered vulnerabilities and exploitation primitives by restricting certain driver functionalities. However, relying on a disallowed list approach is never a good security practice, as an attacker only needs to find one function that isn’t explicitly blocked to exploit it. Instead, a more effective approach is to implement an allowed list, limiting functionality to only what is necessary.

More importantly, access to a driver with such critical and potentially dangerous functionality should be strictly controlled through multiple layers of security and made available only to a limited number of privileged system users.  

Lastly, this research has demonstrated that attackers can leverage even seemingly simple primitives — such as “decrement by one” — to develop a fully functional privilege escalation exploit. This highlights the importance of careful security design in kernel-mode components.

Cisco Talos Blog – ​Read More