Company Blogs – Page 23 – BackBox.org News

The top-five funny school, social media, and IoT hacks | Kaspersky official blog

July 1, 2025/in Company Blogs

On this here blog of ours we constantly write about all sorts of cyberattacks and their devastating effects — from cryptocurrency theft to personal data leaks. Yet there’s a different category of high-profile hacks: those where the hackers aren’t after money, but instead pull off silly stunts that are mostly harmless enough and just for fun (though some (one in particular — the Ecovacs hack, below) could be more serious than others). Today, we tell you about five of these and discuss the lessons we can learn from them…

“They’re everywhere!” When traffic lights talk to you in the voices of Zuckerberg and Musk

In the spring of 2025, unknown individuals hacked crosswalk buttons on traffic lights across Silicon Valley. These audio-enabled buttons are widely installed on pedestrian signals across the United States. As you might expect, they’re designed for people with visual impairments: their main purpose is to play voice messages that help pedestrians who can’t see well understand when it’s safe to cross the road.

The unknown individuals replaced the standard voice messages on crosswalk buttons in several Silicon Valley towns with their own — featuring AI-generated imitations of the ubiquitous tech-billionaires Mark Zuckerberg and Elon Musk. Videos recorded by local residents show the hacked buttons playing the messages.

In a voice imitating Mark Zuckerberg: “It’s normal to feel uncomfortable or even violated, as we forcefully insert AI into every facet of your conscious experience. I just want to assure you, you don’t need to worry because there’s absolutely nothing you can do to stop it.”

In a voice imitating Elon Musk: “You know, they say money can’t buy happiness… I guess that’s true. God knows I’ve tried. But it can buy a Cybertruck and that’s pretty sick, right? F***, I’m so alone.”

Another message in a simulated Musk voice: “You know, people keep saying cancer is bad, but have you tried being a cancer? It’s f****** awesome. Call me Elonoma. Heh-heh-heh.”

The billionaires’ voices were clearly AI-generated, but exactly how the hackers managed to breach the traffic light audio buttons remains unknown. Security experts have noted, however, that default passwords are often used when connecting these kinds of buttons, and nobody bothers to change them after installation.

It looks like no one was hurt by the prank – except maybe the billionaires’ pride.

In Illinois, students learn a key lesson: never forget about Rick

On the last Friday of the 2021 school year, all the TVs and projectors in classrooms across six schools in Cook County, Illinois, turned on by themselves. A message appeared on the screens: “Please remain where you are. An important announcement will be made shortly.” A five-minute countdown timer was displayed below the unsettling message…

Five minutes later, 500 screens simultaneously started showing the famous Rick Astley video for Never Gonna Give You Up. Later that same day, the song played again over the schools’ public address systems.

The hackers behind this surprise pop… classic’s airing were four American students, and what they did was pull off one of the biggest Rickrolls in history that day. A Rickroll is a popular online prank where an unsuspecting user is sent a seemingly important or exciting link, only to be redirected to the video for English singer Rick Astley’s 1987 hit, Never Gonna Give You Up. Rickrolling achieved cult status back in 2007 after spreading on the 4chan imageboard.

Let’s get back to the four students. Their massive Rickroll was a hi-tech twist on a classic American tradition known as the senior prank: basically, a good-natured prank pulled by high-school, college, or university seniors before graduation.

However, the four Illinois students clearly took it to a new level. To pull off their Rickroll, they exploited fairly basic vulnerabilities in the school’s infrastructure. For example, the pranksters gained access to the system controlling hundreds of projectors and TVs across the entire school district because the default usernames and passwords hadn’t been changed after setup.

Similarly, the students were able to log into the schools’ audio public address systems. The person who originally configured the PAs diligently changed the default system password to the one provided as an example in the user manual, which of course was available online. While they were at it, the hacking team discovered an administrator account with “password” used as the password.

It’s worth highlighting just how responsibly the hackers approached the whole operation. Before carrying out the Rickroll, the prankster team prepared a detailed 26-page report, which they sent to the school administrators immediately after the incident. In it, the students thoroughly described their actions and provided recommendations for improving the schools’ cybersecurity. Additionally, once the Rickroll was over, the script they wrote restored the school systems back to their original state.

We always knew: the rise of the machines would begin with robot vacuums

Last year, reports surfaced online about a series of hacks targeting Chinese-made Ecovacs Deebot X2 robot vacuums in cities across the United States. Pranksters assumed control of the robots’ movements and shouted expletives through the built-in speakers. Additionally, they could spy on the owners through the integrated cameras.

The story seemingly had its beginnings at the DEF CON 32 hacker conference, where cybersecurity researchers Dennis Giese and Braelynn Luedtke presented their talk, Reverse engineering and hacking Ecovacs robots. The presentation described vulnerabilities they’d discovered in Ecovacs robot vacuums and lawnmowers, as well as methods for exploiting them. As part of their study, the researchers were able to gain remote access to the built-in microphones and cameras and control the vacuums’ movements. We previously covered their work in detail in our post Ecovacs robot vacuums get hacked.

(By the way, during their presentation at DEF CON, Giese and Luedtke themselves became the target of a hacker prank: a member of the audience managed to take control of the presenter’s clicker and spent several minutes messing with the speakers by randomly flipping through their slides.)

Giese and Luedtke reported their findings to the vendor in a responsible manner. Ecovacs engineers attempted to patch the vulnerabilities, but didn’t have much luck. Several months after the report went out, unknown tech enthusiasts, likely inspired by the study, were able to recreate the techniques described in it to execute a series of attacks on other people’s robot vacuums. For example, in one such attack in California, a robot chased the owner’s dog around the house while shouting obscenities.

The exact number of victims from this series of hacks remains unknown, as it’s plausible that the pranksters didn’t always make their presence obvious — they might have simply observed the vacuum owners’ lives. That, clearly, would have been a very serious infringement of those owners’ privacy – and could in no way be described as mere “fun and games”; neither could this: what if Ecovacs lawnmowers are next?

Lizard Squad “breaking free”: a defacement free redesign of Lenovo’s website

Here’s another playful attack by teenagers, this time targeting Lenovo. A decade ago, the computer manufacturer’s website was hacked. Visitors were redirected to a slideshow featuring photos of bored-looking adolescents, presumably the hackers themselves, all set to the song Breaking Free from Disney’s High School Musical.

Clicking on the slideshow would lead users to the hacking group Lizard Squad’s account on X, which was still known as Twitter at the time. The hackers left a jab at the webmasters in the source code: “The new and improved rebranded Lenovo website featuring Ryan King and Rory Andrew Godfrey”. These two individuals had previously been linked to Lizard Squad.

The attack was orchestrated via DNS hijacking. The hackers altered the DNS records for lenovo.com, causing all users attempting to reach the official company website to be automatically redirected to a fake page controlled by the pranksters.

The attack was apparently a protest against what was seen as the computer vendor’s lax attitude toward security and user protection. Shortly before the defacement, it was revealed that Lenovo had been selling laptops preloaded with Superfish malware. This made users who purchased infected devices potentially vulnerable to data interception and man-in-the-middle attacks. Thus, the hack seems kind of wrong, but at the same time feels justified.

Bring back 2013, when Twitter accounts were hacked for mischief — not crypto scams

These days, when the X account of a high-profile individual or major company gets hacked, it almost invariably leads to some kind of cryptocurrency scam. But it wasn’t always this way. Just a decade ago, popular accounts on what was then still known as Twitter were more often hijacked for giggles than for illicit financial gain.

Take February 2013, for example. Unknown hackers breached Burger King’s Twitter account to post this gem: “We just got sold to McDonalds! Look for McDonalds in a hood near you.”

On top of that, Burger King’s profile picture was swapped out for the McDonald’s logo, and their bio read: “Just got sold to McDonalds because the whopper flopped.” The bio also included the misspelled line “FREDOM IS FAILURE” and a dead link to a press release.

For about an hour, the attackers posted increasingly outrageous messages before Twitter finally suspended the account. Interestingly, Burger King’s arch-rival, McDonald’s, tweeted a message of support — while making sure to clarify they had nothing to do with the breach.

Fast-forward to August 2017, which was when the Ourmine hacking outfit targeted the Twitter account of soccer giant Real Madrid. The hackers used the club’s account to announce that none other than Lionel Messi, who then played for Real Madrid’s fiercest rival, FC Barcelona, was transferring to Real Madrid.

The post quickly racked up 2800 likes and 3100 retweets. Ourmine also posted a series of tweets claiming responsibility for the hack, with one declaring, “Internet security is s*** and we proved that.” It’s hard to argue with that.

A takeaway from the hacks: protect your password from the start

Perhaps the most crucial lesson to learn from these online shenanigans is this: using weak — or even worse, default — passwords is a surefire way to hand control of your device, account, or website to internet pranksters… if you’re lucky. Weak passwords were what tripped up city infrastructure and school administrators, and it’s highly likely that the Twitter account hacks were also linked to a careless approach to password policies.

This blog has frequently discussed how to create strong passwords. But to wrap things up, let’s reiterate a few basic rules of password hygiene:

Passwords should be at least 16 characters long, or even longer if the website allows it.
When creating a password, it’s good practice to mix uppercase and lowercase letters, numbers, and special characters.
It’s best to avoid easily guessable things like common words or dates in your password. And you definitely shouldn’t use the word “password”.
Ideally, your password should be a random combination of characters.
Create a new, unique password for each website.

Of course, any user today signs up for dozens, if not hundreds, of online services. So, remembering long and unique passwords for each one isn’t feasible. That’s where Kaspersky Password Manager can help you manage this and protect yourself not just from pranks, but from far more serious consequences.

Additionally, the app automatically checks all your passwords for uniqueness, and helps you create truly strong and random combinations of characters. So, when using Kaspersky Password Manager, you don’t need to keep all those complex rules in mind — the password manager does it all for you. Beyond passwords, Kaspersky Password Manager can store and sync two-factor authentication tokens and passkeys. We recently thoroughly explored this new passwordless technology for accessing websites and services in our complete guide to using passkeys in 2025.

Kaspersky official blog – Read More

DEVMAN Ransomware: Analysis of New DragonForce Variant

July 1, 2025/in Company Blogs

Editor’s note: The current article is authored by Mauro Eldritch, offensive security expert and threat intelligence analyst. You can find Mauro on X.

New ransomware strains continue to surface frequently, and many of them are loosely built on or repackaged from existing families. One such case involves a sample resembling DragonForce ransomware, yet bearing several unique traits and identifiers suggesting the involvement of a separate entity known as DEVMAN.

A previously analyzed campaign connected to the Mamona strain, itself linked to BlackLock affiliates and the Embargo group, also intersected with DragonForce activity. During one such attack, DragonForce actors exfiltrated a target’s .env file and published it on their Dedicated Leak Site (DLS) on Tor with the caption: “Is this your .env file?”

This newer sample, uploaded by TheRavenFile, appears related but not entirely identical to the DragonForce lineage. Despite being labeled as a DragonForce or Conti variant by most AV engines, the sample displays unique behaviors that point toward DEVMAN involvement.

*Our DragonForce/Conti sample on VT, but don’t be fooled by appearances*

DEVMAN: Key Takeaways

DEVMAN reuses DragonForce code but adds its own twists: The .DEVMAN extension and unique strings sit on top of a mostly DragonForce codebase.

Attribution is muddy: AV engines label the sample as DragonForce or Conti, yet its behavior and leak-site links point to DEVMAN.

DragonForce’s RaaS model allows affiliates to create spinoff variants:
That’s likely how samples like DEVMAN emerged; built on DragonForce code, but customized and repackaged.

Ransom notes encrypt themselves: This happens likely due to a builder flaw

Most malicious activity takes place offline, aside from SMB probing: No external C2 communication was observed during analysis.

Three encryption modes are built in: full, header-only, and custom.

Behavior varies by OS: Wallpaper change fails on Windows 11 but works on Windows 10.

Dragons as a Service

Some time ago, DragonForce introduced their RaaS (Ransomware-as-a-Service) model, aiming to recruit both aﬃliates to operate their ransomware and others who wanted to use their infrastructure, branding, and reputation as a platform to publish stolen data.

This shift brought new actors into the landscape, increasing overall activity, noise, and irregularities, including the sample analyzed here. Depending on the analyst or tool, it may be labeled as DragonForce, Conti (the base framework for DragonForce), or DEVMAN.

DEVMAN? A relatively new actor has recently emerged under this name, featuring its own Dedicated Leak Site (DLS) called Devman’s Place, a separate infrastructure, and nearly 40 claimed victims, primarily in Asia and Africa, with occasional incidents in Latin America and Europe.

A Hybrid Ransomware Sample

Let’s analyze the sample inside ANY.RUN’s secure interactive sandbox:

View analysis session

This sample, flagged by most antivirus engines as a DragonForce (or Conti), is actually, modified to behave like a new variant belonging to DEVMAN. It uses that name as the file extension for encrypted data but otherwise shares a large part of its codebase with DragonForce, including leftover strings and identifiers. That strongly suggests DEVMAN may be using a DragonForce build for some of its operations.

*Encrypted file with the .DEVMAN extension*

This appears to be a lightly customized version; one that hasn’t attracted much attention, either from the threat intelligence community or from its own operator. The result is a tangled ransomware crossbreed with overlapping traits.

*Automatic detection labels the sample as “DragonForce”*

A closer look reveals more.

Initial Behavior and Detection

First things first — our newborn dragon does what dragons do: it burns down the village. Files are encrypted rapidly and automatically, also attempting to locate SMB shared folders to spread further — but in our lab environment, it wasn’t that lucky.

Two things caught our attention immediately. First, on Windows 11, the sample was unable to change the wallpaper for unknown reasons, while on Windows 10 it worked flawlessly.

Second, although desktop files are the most visible, they are not the last to be encrypted. The process continues beyond them.

*SMB traﬃc attempting to laterally spread the infection*

Ransom Note Issues and Deterministic Renaming

The ransom notes were not dropped as expected. Instead, every location where a note should have appeared contained, quite mysteriously, a file with a scrambled name and the .DEVMAN extension, suggesting the sample might be malfunctioning and targeting its own files.

Fortunately, ANY.RUN logs all activity, not just network traﬃc, but disk writes as well, allowing us to reconstruct one of those files right at the moment it was created. And, interestingly enough, the ransom note isn’t just similar to the ones used by DragonForce. It is, in fact, a DragonForce ransom note.

When retrieving the list of created and modified files, we noticed an interesting pattern: the sample scrambles file names instead of simply appending an extension.

And here’s the most curious part; its own readme.txt files, once encrypted, are always renamed to e47qfsnz2trbkhnt.devman. This strongly suggests the use of a deterministic function that produces static outputs for identical inputs.

*Encrypted Ransom notes, all sharing the same name*

Offline Behavior and Local Footprint

So, let’s focus on those local oddities, and a good place to start it’s the binary itself.

Aside from the aforementioned SMB connections, no suspicious network dialogue was observed, suggesting that all malicious activity takes place locally and offline.

Using FLOSS, a tool by Mandiant, we can decode and extract additional strings to better understand the sample’s internal logic prior to disassembly.

The first thing we notice is that the sample checks for Shadow Copies (probably just to make sure we’ve got a solid backup policy in place) and lists a series of file extensions that it deliberately avoids encrypting.

Encryption Modes and File Targeting

Further analysis reveals multiple encryption modes: full encryption, header-only encryption, and custom encryption, designed to prioritize either speed or complexity, depending on the intended scenario.

Header-only encryption, in particular, allows the malware to corrupt large volumes of data in less time, trading completeness for speed.

*At least 3 diﬀerent encryption modes are available*

SMB Spread and Local Targeting

Further exploration reveals a bit more detail about the sample’s attempts to connect to SMB folders, explicitly referencing local network octets and hardcoding the ADMIN$ share name, along with several error and debug messages.

*Octects belonging to local addresses and direct mention to the ADMIN share*

Persistence and File Lock Evasion via Restart Manager

Another interesting behaviour that further supports the Conti lineage of this sample is its interaction with the Windows Restart Manager. The malware creates temporary sessions under the registry key:

HKEY_CURRENT_USERSoftwareMicrosoftRestartManagerSession0000

There, it logs metadata such as Owner, SessionHash, RegFiles0000, and RegFilesHash, pointing to system-critical files like NTUSER.DAT and its corresponding logs.

Each of these entries is quickly deleted after being written, likely an attempt to avoid leaving persistent forensic traces. This pattern mirrors behaviour seen in Conti and later carried on by DragonForce, which now appears to be inherited by DEVMAN (what a Zoo!).

The goal seems clear: use the Restart Manager to bypass file locks and ensure encrypted access to active user session files. It’s noisy, and somewhat old, but it works.

Learn to analyze cyber threats

See a detailed guide to using ANY.RUN’s Interactive Sandbox for malware and phishing analysis

Read full guide

Mutex Usage and Sample Coordination

Another notable behavior involves the use of synchronization primitives, particularly mutexes, to coordinate the sample’s execution and possibly prevent multiple instances from running in parallel. This is standard among ransomware families derived from Conti, and this case is no exception.

Right from the beginning, the sample creates a mutex named: hsfjuukjzloqu28oajh727190

This mutex is not randomly generated; it is hardcoded into the binary, as confirmed by decoded strings extracted using FLOSS. Its presence suggests that the sample uses it to detect existing instances of itself, a basic anti-reentry mechanism.

The sample also creates several mutexes and interacts with objects under the naming pattern:

LocalRstrMgr[GUID]

LocalRstrMgr-[GUID]-Session0000

These mutexes are tied to the Windows Restart Manager API and match the behaviour seen in previous ransomware families (notably Conti and its derivatives), which use this mechanism to query which processes are holding handles to specific files.

This facilitates forced encryption of locked resources, including user profile data like NTUSER.DAT.

The reuse of fixed strings can serve as a strong indicator of compromise (IOC) for future detection or correlation with other samples likely created using the same packer or builder. However, this is a volatile indicator that is likely to change over time.

When possible, assign a “trust” expiration date (or half-life) to indicators; it can be a valuable practice for maintaining detection accuracy over time.

Final Observations

An Experimental Build with Unusual Behavior

This sample looks more like an aﬃliate testing a new build than something currently being deployed that you’d casually run into in a production environment. While not particularly sophisticated, it presents a number of unusual behaviors worth highlighting, particularly its tendency to encrypt its own ransom notes.

A Critical Flaw in the Builder

While it’s ironic that no one could, at least not easily, pay the ransom without knowing who to pay (because the ransom note gets encrypted), the underlying message here is more serious: there’s a core design flaw in the builder that allows it to self-encrypt key components.

That simple .txt file is often the only clue victims have to identify the threat actor and initiate negotiation; and for the threat actor, it’s the best chance of getting paid.

I spoke with DEVMAN, who stated “[…] we stopped using DragonForce months ago […]”.

Threat Actor Communication

One noteworthy indicator of a threat actor’s maturity is their ability to maintain polite, detailed, and respectful communication; a trait that also applies to DEVMAN. This attitude seems to echo in their technical approach, even in cases where their ransomware encrypts its own ransom notes.

A Familiar Build Beneath the Surface

Now, if we strip this sample of its oddities, there’s not much to talk about it on its own merits (no oﬀense meant to the developers), or at least nothing to say that we haven’t covered in other articles about ransomware.

Still, its oddities make it a valuable case study, not for technical innovation, but for the way it reflects shifting actor dynamics and common development pitfalls in the ransomware ecosystem.

Turning Oddities into Actionable Intelligence

Unusual samples like this DEVMAN variant can easily slip past traditional analysis workflows. With ransom note encrypted, scrambled filenames, and unexpected behavior across operating systems, manual investigation becomes time-consuming and risky to overlook.

This is where ANY.RUN’s Interactive Sandbox proves invaluable. By logging every action in real time, from file system changes to mutex creation and registry modifications, it enables analysts to trace even fragmented or malfunctioning ransomware behavior.

This kind of visibility gives security teams a real operational advantage:

Faster detection and response: Immediate insight into threat behavior, even in offline or misconfigured attacks.

Clearer attribution: Links to reused infrastructure, code similarities, and TTP patterns are surfaced early.

More efficient investigation workflows: Analysts can extract IOCs, map persistence mechanisms, and understand impact without switching tools.

Better collaboration across teams: Findings can be shared easily with SOCs, threat intel units, and communications teams, ensuring faster alignment during incidents.

Start 14-day trial of ANY.RUN’s Interactive Sandbox in your SOC today

MITRE ATT&CK Mapping

Let’s jump to drafting a quick ATT&CK matrix for this sample, which ANYRUN does automatically for us:

T1204.002 – User Execution: Malicious File

The executable requires user (or threat actor) interaction to launch.

T1053.005 – Scheduled Task/Job: Scheduled Task

Presence of scheduling-related strings implies possible persistence via tasking.

T1027 – Obfuscated Files or Information

Internal file renaming and readme scrambling suggest static obfuscation logic.

T1070 – Indicator Removal on Host

The sample deletes registry keys and values shortly after writing them.

T1135 – Network Share Discovery

Explicit scanning for SMB shares (ADMIN$, IP ranges like 192.x, 172.x).

6T1021.002 – SMB/Windows Admin Shares

Uses netapi32, srvcli, and netutils to interact with administrative shares.

T1005 – Data from Local System

Enumerates and encrypts user data including NTUSER.DAT and log files.

T1486 – Data Encrypted for Impact

Core functionality: encrypting files with .DEVMAN extension.

T1490 – Inhibit System Recovery

Attempts to interact with volume shadow copies.

IOCs

MD5:e84270afa3030b48dc9e0c53a35c65aa

SHA256:df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7

403

FileName:hsfjuukjzloqu28oajh727190

FileName:e47qfsnz2trbkhnt.devman

SHA256:018494565257ef2b6a4e68f1c3e7573b87fc53bd5828c9c5127f31d37ea964f8

References

Analysis: https://app.any.run/tasks/64918027-01e6-415a-85b3-474fca5fc5c4

VirusTotal Analysis (multiple labeling/attribution): https://www.virustotal.com/gui/file/

df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403

Original Intel Pulse (OTX): https://otx.alienvault.com/pulse/

68535853fe15cﬀ17229577d

The post DEVMAN Ransomware: Analysis of New DragonForce Variant appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – Read More

How much an ICS incident costs | Kaspersky official blog

June 30, 2025/in Company Blogs

Despite over a decade of talk about “industrial digital transformation”, it’s only now we’re observing a tipping point. According to the VDC Research report Securing OT with Purpose-built Solutions, only 7.6% of surveyed industrial organizations consider themselves fully digital, but within two years 63.6% expect to be so. This shift is driven by two main factors: economic pressure pushing companies to radically increase efficiency, and the growing accessibility of technologies such as the industrial internet of things (IIoT) and edge computing.

Digitalization helps industrial enterprises boost both their efficiency and safety. Most organizations have already implemented asset, maintenance, and supply-chain management systems that reduce downtime and operating costs. More advanced technologies like digital twins and predictive analytics significantly improve processes, boost production, and cut waste of materials and resources. Integrating data from IT systems and ICS enables real-time decision-making based on up-to-date information.

But with integration comes vulnerability: systems that were once isolated or not digital at all become susceptible to IT failures and direct cyberattacks. Attacks on OT systems can lead to increased defect rates, failure of complex equipment, disruption of downstream production processes, and even catastrophic events that threaten worker safety. Even brief outages can have serious business consequences and damage a company’s reputation.

Major obstacles to industrial digitalization

According to the surveyed companies, cybersecurity concerns have become the main barrier to industrial digital transformation. Nearly 40% of the companies surveyed in the VDC report say they need to resolve this issue to move forward. Other top challenges include budget constraints and outdated equipment that’s too complex and expensive to upgrade for digital projects.

When it comes to security specifically, the top issues include a lack of resources for securing ICS equipment, inadequate security measures in existing infrastructure, and difficulties with regulatory compliance

The cost of an incident

When justifying cybersecurity budgets and planning for further development, experts unanimously recommend a risk-based approach tailored to the organization’s profile, its risk appetite, industry specifics, and other factors. The VDC Research report provides important data for this, documenting the nature and financial impact of security incidents in industrial organizations from 2023 to 2024. For example, 25% of surveyed companies that experienced security incidents with measurable financial consequences reported damages exceeding $5 million.

These costs include response efforts, direct revenue loss, and industrial-company-specific expenses like equipment repairs and losses of raw material or semi-finished goods. One of the top-three costs is unplanned downtime — a critical metric that industrial digitalization specifically aims to reduce. Most incidents resulted in downtime lasting 4–12 hours or 12–24 hours (with each range representing about a third of cases).

The cost breakdown is visualized below:

The challenges of protecting ICS

Despite the recognized need for ICS cybersecurity and regulatory requirements, implementation remains difficult. Almost every surveyed organization faces the following challenges:

Limited visibility into OT networks due to numerous specialized communication protocols and incompatibility with standard IT monitoring tools
A shortage of specialists skilled in working with proprietary systems and industrial protocols
Insufficient network segmentation and the inability to isolate vulnerable equipment due to business needs; emergence of many new connections between IT and OT infrastructure
A growing number of IIoT devices with insecure configurations and vulnerable firmware (manufacturers often neglect security)
Outdated software and irregular patch releases
Delayed patch installation due to the need for extensive testing and coordination with operations teams regarding the installation window
Lack of detailed incident response plans that take into account critical events in OT networks

Some of these issues can’t be solved at the company level alone, but investing in specialized and integrated cybersecurity solutions can significantly mitigate the risks.

Specialized protection

While ICS protection projects are inherently complex, deploying specialized solutions purpose-built for OT/IT environments can increase efficiency and reduce risks. Key tools include asset and network traffic monitoring solutions (such as Kaspersky Industrial Cybersecurity for Networks) and endpoint protection solutions (such as Kaspersky Industrial Cybersecurity for Nodes). Organizations with mature cybersecurity programs use these as part of a defense-in-depth strategy — a multilayered security approach.

These solutions have features designed specifically for industrial networks, such as avoiding disruption of critical processes and communication, and operating with limited memory and processing power. This helps avoid meltdowns like the notorious CrowdStrike incident, where a careless security update disabled protected systems.

In the near future, technologies like SD-WAN and then SASE will play a bigger role by embedding security deeply into network architecture while ensuring resilience. Ultimately, the gold standard is a secure-by-design architecture, which should be built into smart industrial equipment by manufacturers at the outset.

Security implementation is a serious project — not just for the cybersecurity team but also for engineers and plant operators. As a result, project approval and rollout are often delayed. To reduce the burden on everyone involved, and also speed up the deployment of protection, companies should avoid a fragmented hodge-podge of security tools, and instead use comprehensive solutions from a single vendor. This simplifies both deployment and ongoing management through better integration. According to VDC’s survey, around 60% of organizations prefer getting all their security solutions from one provider.

How protection saves money

Despite the challenges, companies adopting specialized ICS protection solutions are already seeing clear economic benefits.

The VDC report shows that from 2023 to 2024, the number of incidents decreased in companies that deployed network and device monitoring tools. On average, incident rates dropped from 2.7 to 2.2 per year. Organizations using standard endpoint protection brought incidents down from 2.1 to 1.6. In contrast, industrial companies neglecting IT and OT protection experienced an average of 3.8 incidents — about twice as many as their better-protected competitors.

You can explore more about typical industrial digitalization projects, cyber incident damage estimates, and comprehensive protection recommendations in the full VDC report.

Kaspersky official blog – Read More

This month in security with Tony Anscombe – June 2025 edition

June 29, 2025/in Company Blogs

From Australia’s new ransomware payment disclosure rules to another record-breaking DDoS attack, June 2025 saw no shortage of interesting cybersecurity news

WeLiveSecurity – Read More

Passkey FAQ for power users | Kaspersky official blog

June 27, 2025/in Company Blogs

So far in our comprehensive guide to passkeys, we’ve covered how to ditch passwords on popular combinations of Android, iOS, macOS, and Windows smartphones and computers. This post focuses on important specific cases:

One-time sign-ins to your account from someone else’s device
Tips for frequent computer and smartphone switchers
Ways to secure your account when backup password sign-in is enabled
Potential issues when traveling internationally
What happens when using niche browsers and operating systems

How to use passkeys on public or shared computers?

What if you need to sign in to your passkey-protected account from a library, an airport computer, or a relative’s home? Don’t rush to remember your backup password.

Start the sign-in process on the computer: enter your username and, if prompted, click Sign in with passkey. A QR code will appear on the screen for you to scan with the smartphone that stores your passkey. If the scan is successful, the QR code will disappear, and you’ll be signed in to your account.

Several factors must align for this seemingly simple process to proceed smoothly:

The computer must support Bluetooth Low Energy (BLE), which verifies that your smartphone and the computer are indeed nearby.
The computer’s operating system and browser must support passkeys.
Both the computer and your smartphone need a reliable internet connection.

How to save passkeys to a hardware security key?

You might find using passkeys via QR codes inconvenient if you frequently access your accounts from different devices. If that’s the case, you can store your passkeys not on your computer or smartphone, but on a USB hardware security key — such as a YubiKey, Google Titan Security Key, or a similar device — for secure website sign-in. When you create a passkey, just choose to save it to your hardware key. Then you can sign in to your account from any computer or smartphone by plugging in that security token.

Just make sure it has the right combination of ports (USB-A, USB-C, Lightning) or NFC support to work with all your devices. Some token models even include a fingerprint scanner, which provides an extra layer of protection against account hijacking if your device is stolen or lost.

Unfortunately, there’s a catch: many older and popular token models can store a maximum of only 25 passkeys. Only a few advanced models — like the YubiKey with firmware version 5.7 — have raised this limit to 100.

Additionally, operating system developers view passkeys as a great opportunity to tie users more closely to their ecosystems. By default, depending on your smartphone, you’ll likely be prompted to save your passkey to either iCloud Keychain or Google Password Manager. As a result, the option to use a hardware security key might be hidden deep within the interface.

To create a passkey on a hardware token, you’ll often need to click the not-so-obvious Other options link on macOS/iOS, or Different device on Android, to select the hardware key option.

How to transfer passkeys between iOS and Android?

The biggest headache right now is if you store all your passkeys in your smartphone’s default storage and you want to switch ecosystems — moving from Android to iOS or vice versa. Currently, none of the three major OS developers — Google, Apple, or Microsoft — let you directly transfer passkeys. That’s because no one can guarantee the process will be secure. Both Apple and Google are working on implementing this feature in the future, but if you decide to swap devices today — say, from an iPhone to a Google Pixel — transferring your passkeys won’t be straightforward.

First, you’ll need to sign in to the account protected by a passkey on your new device. You can do this either by using your good old password (if it’s still enabled), or by scanning a QR code with your old device that has the active passkey.
Next, you’ll need to create and save a new passkey on your new device. Yes, you can have multiple passkeys for each website or online service.
Finally, if you plan to get rid of your old gadget, you’ll need to delete the old passkey from it.

To avoid this hassle, it’s best to use a third-party password and passkey manager right from the get-go. With Kaspersky Password Manager, passkey support is already available on Windows, with Android support planned for July, and iOS and macOS support — for August 2025.

How to protect an account with a passkey from being hacked using a backup password?

Most online services that offer to switch to passkeys don’t disable other sign-in methods. If your account was protected by a weak or compromised password before you switched to a passkey, cybercriminals can still bypass your shiny new passkey by simply signing in with that old password.

Creating a passkey for an account that still has a weak password is like installing a bulletproof front door while leaving the flimsy back door unlocked with the key hidden under the mat.

That’s why, before you enable passkeys for any online service, we strongly recommend changing your password as well. Since you won’t be typing this password every day — it’s just a backup for your passkey-protected account — you can really go wild with its complexity. We’re talking strong passwords that are 16 characters or longer, and mixing up letters, numbers, and special characters. These are practically uncrackable. Ideally, generate and save that robust password in the same password manager where you’re planning to store your passkeys. Don’t rely on AI models to generate complex passwords. Our recent research revealed that while these passwords might look complex, LLMs tend to favor certain characters for no obvious reason when creating passwords, which makes their output surprisingly predictable.

Passkey drawbacks?

The underlying WebAuthn standard that powers passkeys can be implemented quite differently across browsers and operating systems. Websites often adopt these capabilities in their own unique ways. This can lead to frustrating challenges — even for tech-savvy users. Here are a few examples of this:

When creating passkeys, standard Windows prompts give you plenty of options for where and how to save them. By default, Windows saves passkeys in secure local storage on your computer. If you forget to select your password manager as the save location, that passkey won’t be available on your other devices.
Many online services like Kayak or AliExpress have dozens of regional versions, with each one being a separate website: .com, .com.tr, .co.uk, etc. If you create a passkey for, say, your local site, and then for some reason try to access the same online service in a different region, it’s highly likely you won’t be able to sign in with that passkey.
Some websites don’t support creating or signing in with passkeys when using Firefox, regardless of the platform. In reality, there’s no technical incompatibility here, and simple tricks can resolve the issue, but it’s unclear why users should have to resort to these workarounds.
Some Apple users have reported that all their previously saved passkeys periodically disappear from their Keychain, while certain Android users can’t activate passkeys without re-flashing or factory-resetting their devices.

Any one of these situations is made worse by the fact that errors when creating or signing in with passkeys are either not mentioned at all in help documentation, or described very vaguely. It’s often completely unclear how to fix the problem. However, when passkey issues arise, websites almost always offer a backup option, such as sending a one-time access code to your email.

Despite these challenges, a passwordless future with passkeys is on the horizon. We recommend getting ready now by creating passkeys wherever possible, saving them in your password manager, and remembering to check and update your passwords and contact information on websites to make sure you can recover access if your passkeys ever give you trouble.

Want to read more about passwords and passkeys?

16 billion passwords leaked: what should I do?

Lessons learned from the trojanized KeePass incident

Kaspersky Password Manager gets a new look

Passkeys for your Google account: what, where, how, and why

Password standards: 2024 requirements

Kaspersky official blog – Read More

Getting a career in cybersecurity isn’t easy, but this can help

June 26, 2025/in Company Blogs

Welcome to this week’s edition of the Threat Source newsletter.

Happy summer, friends! I hope everyone is staying cool and/or warm.

I am fresh back from an exhaustive but great time in San Diego at Cisco Live U.S. It was so good to see colleagues, meet new friends and pet many therapy dogs in the Splunk booth. As often happens to me, I was approached by someone who was looking for mentorship and guidance in how to get into a cybersecurity career. It’s not unusual for me to be approached by folks looking to get into cybersecurity. I’m the large, bearded guy with the Talos shirt, so I stick out.

So, I’m often asked how I got the career I have in cybersecurity and how others can do the same. For a guy who often has a quip or answer for most things, I always pause here. I can’t help but think of my entire career and the dumb luck and hard work that landed me where I’m at. Giving that summation to others wouldn’t be fair, because… well, my journey wasn’t a linear one. I think for many of my peers, the same applies. We found cybersecurity as a career through a series of events that organically landed us in this field. In my case, moreso than others, the path isn’t easy to follow because there was no clearly staked path for me to follow, either.

I’ll explain as best I can: One today might go to school and graduate with a degree in information security and/or some security certificates, then begin the job hunt for an entry level gig. These types of degrees, certificates and even jobs simply didn’t exist in any meaningful way or numbers when I started my career. If you wanted to learn cybersecurity, there weren’t classes to take — you got a computer science degree and figured it out. I, like many in the GenX world, started as an IT professional. As the industry and cyber threats evolved, the career space over the years shifted and we found ourselves helping fight the good fight and keeping folks secure.

Today is truly different, and I’m so happy about it and the opportunities it can give others. I’m envious of the school degrees, industry certifications and mentorship programs that exist today that did not exist for me. There is also an incredibly helpful information security community that provides hacking tutorials, or Capture the Flag competitions (CTFs) or hackathons that I would have loved to have been a part of in my formative years.

By now, I know you’re thinking, “Cool story, grandpa, but answer the question: how do I get a job in cybersecurity?” In my estimation, the answers are as follows:

Have a good attitude.
Be easy to work with.
Be a forever student.
Be bad at giving up.
Find and join a (preferably local) security community.
Grow where you are planted.

Notice that none of those things mention anything specifically technical. No malware reverse engineering, red teaming, threat intelligence or security analyzing. I can tell you that to work at Talos, you must exhibit strong traits of all six of those things I listed. One through five makes sense. Good hackers are tenacious, smart, work well with others and seek out fellow friends to network and hack with.

Number six though – what’s up with that? Simply put, life deals us all a hand of cards that we must play, and those cards may not be great. For example, you want to get a job in cybersecurity, but you’re a primary care giver of a family member and you don’t have a lot of freedom. You might be financially constrained. You may have health issues or a disability that limits some options. Or you simply just have a job that you don’t like, and a career in security calls out to you, but the bills don’t pay themselves. This is all common, and you’re a bit “stuck.”

So while you’re stuck, find ways to grow where you’re planted. Study. Network locally or online. Try a CTF or a hacking competition. Whatever you do, just keep growing yourself, your skillset and your network. You can do it. And before you know it, you’ll have that career helping to fight the good fight with the rest of us.

I believe in you! You got this!

The one big thing

Cybercriminals are increasingly exploiting Large Language Models (LLMs) by using uncensored versions, developing their own malicious LLMs or “jailbreaking” legitimate ones to bypass safety protocols. These compromised or malicious LLMs are then used to generate highly convincing phishing campaigns, create harmful code and automate various cybercrime operations, making attacks more sophisticated and scalable.

Why do I care?

Cybercriminals’ widespread abuse of LLMs lowers the barrier to entry for sophisticated attacks, making it easier for even less skilled actors to launch effective campaigns. This means you’re more likely to run into highly convincing phishing attempts, scams and malware that are difficult to distinguish from legitimate communications, putting your personal info and company security at higher risk.

So now what?

Given this evolving threat landscape, it’s important to be extra vigilant and skeptical online. Treat all online communications with caution, even if they look perfectly authentic. For individuals, that means double-checking emails and messages for anything fishy, no matter how well-written they seem. For businesses, it’s time to beef up your cybersecurity defenses, invest in smart threat detection and keep your employees sharp on how to spot and report these increasingly clever social engineering tricks.

Top security headlines of the week

New AI Jailbreak Bypasses Guardrails With Ease
On topic with our latest blog, the new “Echo Chamber” attack bypasses advanced LLM safeguards by subtly manipulating conversational context, proving highly effective across leading AI models. (SecurityWeek)

US insurance giant Aflac says customers’ personal data stolen during cyberattack
Aflac says hackers stole an unknown quantity of its customers’ personal information from its network during a cyberattack earlier this month. (TechCrunch)

APT28 Uses Signal Chat to Deploy New Malware in Ukraine
A new cyber attack campaign by the Russia-linked APT28 (aka UAC-0001) threat actors using Signal chat messages to deliver two new malware families dubbed BEARDSHELL and COVENANT. (The Hacker News)

UK watchdog fines 23andMe over 2023 data breach
The U.K. data protection watchdog has fined 23andMe £2.31 million ($3.1 million) for failing to protect U.K. residents’ personal and genetic data prior to its 2023 data breach. (TechCrunch)

Can’t get enough Talos?

Decrement by one to rule them all: AsIO3.sys driver exploitation
Learn how our researcher, Marcin Noga, found two critical vulnerabilities in ASUS’ Armory Crate and AI Suite drivers.

Talos Takes: Teaching LLMs to spot malicious PowerShell scripts
Hazel chats with Ryan Fetterman from the SURGe team to explore his new research on how LLMs can assist security operations centers in identifying malicious PowerShell scripts.

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos
Wednesday, July 23
11:00 a.m. to 12:00 p.m. PDT
Join us for a discussion around the latest security detections developed for the SOC and how to find and remediate threats, faster.

Upcoming events where you can find Talos

REcon (June 27 – 29) Montreal, Canada
NIRMA (July 28 – 30) St. Augustine, FL
Black Hat USA (Aug. 2 – 7) Las Vegas, NV

Most prevalent malware files from Talos telemetry over the past week

SHA 256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
MD5: 2915b3f8b703eb744fc54c81f4a9c67f
VirusTotal: https://www.virustotal.com/gui/file/9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
Typical Filename: VID001.exe
Claimed Product: N/A
Detection Name: Win.Worm.Coinminer::1201

SHA 256: 05883fccb64dd4357c229ccca669afdacbfa0bc9a1c8d857f5205aed0a81e00a
MD5: 71b973dbdfc7b52ae10afa4d0ad2b78f
VirusTotal: https://www.virustotal.com/gui/file/05883fccb64dd4357c229ccca669afdacbfa0bc9a1c8d857f5205aed0a81e00a/details
Typical Filename: PCAppStore.exe
Claimed Product: PC App Store
Detection Name: Riskware/VeryFast

SHA 256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91
MD5: 7bdbd180c081fa63ca94f9c22c457376
VirusTotal: https://www.virustotal.com/gui/file/a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91/details
Typical Filename: IMG001.exe
Claimed Product: N/A
Detection Name: Simple_Custom_Detection

SHA 256: c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0
MD5: 8c69830a50fb85d8a794fa46643493b2
VirusTotal: https://www.virustotal.com/gui/file/c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0/details
Typical Filename: AAct.exe
Claimed Product: N/A
Detection Name: PUA.Win.Dropper.Generic::1201

SHA 256: 2a753cdc8c5401dcb67f3be58751a32ce23c875f8720a70459533b30e5ba4f1f
MD5: 7d5a9a41157fb0002f5234b4512e0ac2
VirusTotal: https://www.virustotal.com/gui/file/2a753cdc8c5401dcb67f3be58751a32ce23c875f8720a70459533b30e5ba4f1f/details
Typical Filename: pros.exe
Claimed Product: N/A
Detection Name: Trojan.GenericKD.76128711

Cisco Talos Blog – Read More

How to survive digitalization | Kaspersky official blog

June 26, 2025/in Company Blogs

Digitalization of business – especially in the small and medium-sized segment – allows for quick upscaling, better customer service, and entry into new markets. On the downside, digitalization amplifies the damage caused by a cyberattack, and complicates the recovery process. Given that company resources are always limited, which attacks should be deflected first?

To answer this question, we studied the INTERPOL Africa Cyberthreat Assessment Report 2025. The document is useful because it collates police cybercrime statistics and data from information security companies – including Kaspersky – allowing us to compare the number and types of attacks with the actual damage they caused. This data can be used to build a company’s information security strategy.

Average ranking of cybercrime types by reported financial impact across African subregions, based on INTERPOL member country data. Source

Targeted online fraud

Fraudulent operations were the clear leader in terms of damage caused across the continent. They’re gaining momentum in line with the rising popularity of mobile banking, digital commerce, and social media. In addition to mass phishing aimed at personal and payment data theft, targeted attacks are growing at a rapid rate. Scammers are grooming potential victims in messenger apps for months, building trust and guiding them into a money extortion scheme – for example, a fake cryptocurrency investment. Such schemes often exploit romantic relationships and are therefore called romance scams, but there are other variations. In Nigeria and Ivory Coast, for example, scammers were arrested for attacking small media platforms and advertising agencies. Posing as advertisers, they stole almost 1.5 million U.S. dollars from victims.

The fact that 93% of Africans use plain old WhatsApp rather than corporate communication tools for work significantly boosts the success rate of attacks on employees and company owners.

Ransomware incidents

Press headlines may give the impression that ransomware operators mainly target large organizations, but the statistics in the report debunk this theory – showing that both the number of attacks and the actual financial damage caused are significant across all business segments. What’s more, there’s a direct link between the level of digitalization and the number of attacks. So, if a company observes an overall increase in “digitized” business activity in its market segment, the threat level is sure to rise accordingly. In Africa, “affiliates” of the largest and most dangerous ransomware-as-a-service platforms – such as LockBit and Hunters International – are responsible for major incidents on a national scale.

Among the main ransomware incidents in Africa – hardly known about outside the continent – we highlight the following: the theft of $7 million from Nigerian fintech company Flutterwave; attacks on Cameroonian electricity supplier ENEO; a large-scale ransomware attack to exfiltrate data from Telecom Namibia; and the targeting of South Africa’s National Health Laboratory Service (NHLS), which led to canceled operations and the loss of millions of lab test results.

Banking Trojans and infostealers

Although the direct losses from banking Trojans and infostealers fell outside the top-three in terms of damage, it’s the “successes” of this criminal industry that have a direct impact on the number and severity of other attacks – primarily ransomware and business email compromise (BEC). After stealing what credentials they can from thousands of users with infostealers, attackers filter and group them by various criteria, then sell curated sets of accounts on the illicit market. This allows other criminals to buy passwords to infiltrate organizations of interest to them.

Business email compromise

For small and medium businesses mainly using public services like Gmail or Office 365, infection with an infostealer gives attackers full access to corporate correspondence and business operations. The attackers can then exploit this to trick customers and counterparties into paying for goods and services to a fraudulent account. BEC attacks have a firm hold at the top of the damage charts, and small businesses can fall victim to them in two ways. First, cybercriminals can extract money from larger clients or partners by impersonating the compromised small business. Second, it’s easier with a small business to persuade the owner or accountant to transfer money than it is with a large organization.

There are several large criminal syndicates based in Africa that are responsible for international BEC operations causing multi-billion-dollar damage. Their targets also include African organizations — primarily those in the financial and international trade sectors.

How to protect business from cyberthreats

To effectively counter digital threats, law enforcement agencies need to share data with commercial information security companies that harness telemetry to identify threat distribution hotspots. Recent successes of such partnerships include operations Serengeti (1000 arrests, 134 000 malicious online resources disabled), Red Card (300 arrests), and Secure (32 arrests, 20 000 malicious resources disabled). These operations, conducted under the auspices of INTERPOL, used cyberthreat intelligence received from partners – including Kaspersky.

But businesses can’t leave cybersecurity solely to the police; they need to implement simple but effective security measures of their own:

Enable phishing-resistant multi-factor authentication (MFA) for all online accounts: Google, Microsoft, WhatsApp, etc.
Install reliable anti-malware protection on all corporate and personal devices. For corporate devices, centralized security management is recommended – as implemented, for example, in Kaspersky Endpoint Detection and Response.
Hold regular cybersecurity training – for example, using our Kaspersky Automated Security Awareness platform. This will reduce the risk of your company falling victim to BEC and phishing. All employees, including management, should participate in training regularly.
Back up all company data on a regular basis and in such a way that the backups can’t be destroyed during an attack. This means backing up data either to media that are physically disconnected from the network, or to cloud storage where a policy prohibits data deletion.

Kaspersky official blog – Read More

Decrement by one to rule them all: AsIO3.sys driver exploitation

June 26, 2025/in Company Blogs

Introduction

Armory Crate and AI Suite are applications used to manage and monitor ASUS motherboards and related components such as the processor, RAM or the increasingly popular RGB lighting. These types of applications often install drivers in the system, which are necessary for direct communication with hardware to configure settings or retrieve critical parameters such as CPU temperature, fan speeds and firmware updates.

Therefore, it is critical to ensure that drivers are well-written with security in mind and designed such that access to the driver interfaces are limited only to certain services and administrators.

Decrement by one to rule them all: AsIO3.sys driver exploitation — *Figure 1. Armory Crate application.*

During the audit of the code and components related to the aforementioned applications, Cisco Talos discovered two critical vulnerabilities in the AsIO3.sys driver. Both vulnerabilities were discovered in the IRP_MJ_CREATE handler:

The first vulnerability is a stack-based buffer overflow that occurs during the process’s ImagePath conversion from “Win32 Path” to “NT Namespace Path”.

The second vulnerability allowed bypassing the authorization mechanism implemented in the driver, granting access to its functionality not just to the intended service but to any user. With access to a security-critical function within this driver, I successfully developed a fully working exploit that escalates local user privileges to “NT SYSTEM”, which we describe in detail below.

Please keep in mind that I discovered this exploit before the Windows 11 24H2 update arrived. This update prevents regular users from leaking information such as loaded kernel modules and their addresses via “NtQuerySystemInformation.” This is discussed in further detail below.

Recon phase

While looking for drivers installed alongside the Armory Crate software, I noticed two related to ASUS in the DriverView list.

Focusing on AsIO3.sys, I investigated whether this driver creates any devices and, most importantly, whether a regular user can communicate with such a device.

Obtaining a handle to the Asusgio3

Using DeviceTree, we can see the following encouraging picture:

The AsIO3.sys driver creates the Asusgio3 device, which nearly everyone in the system has full access to. After a quick check with a simple code that attempts to open a handle to the device, I got the error code:
“5 == ERROR_ACCESS_DENIED”.

This was unexpected based on the DeviceTree interface, so I re-checked the privileges to that device using Sysinternals “accesschk” and got completely opposite results.

Which is the truth? To find out, I reversed fragments in the AsIO3 driver responsible for handling the “IRP_MJ_CREATE” request.

Analyzing “IRP_MJ_CREATE” handler

By loading the driver and beginning the reversing process, we see a single function handles IRP requests for three different request types.

Diving into “callback_irp_dispatch”, I found a fragment responsible for handling the “IRP CREATE” request:

Authorization mechanism

Checking the “ImageHashCheck” function, we can see the following:

Using the API “ZwQueryInformationProcess” with the flag “ProcessImageFileNameWin32” (lines 8 and 19), ASUS developers attempt to obtain the image path (the path to the executable file) of the current process — specifically, the process that is trying to obtain a handle to the device.

Next, in line 26, we see the translation of the path from the “Win32 File Namespace” to the “NT Namespace”. Hold tight — we will return to this line in a moment.

In lines 35-46, there is a typical SHA256 hash calculation for the current process’s executable file. In line 47, the calculated hash is compared with a hardcoded hash in the driver, and if they match, the function returns “true”, allowing the process to obtain a handle to the device.

When we dump the hash from the global variable “g_sha256Hash” (visible on line 47), it appears as follows:

python
Python>binascii.b2a_hex(idc.get_bytes(0x0000000140009150,32))
B'c5c176fc0cbf4cc4e37c84b6237392b8bea58dbccf5fbbc902819dfc72ca9efa'

I calculated the SHA256 hash for “AsusCertService.exe” and saw that it was the same hash:

powershell
PS C:Usersicewall> Get-FileHash -Path "C:Program Files (x86)ASUSAsusCertServiceAsusCertService.exe" -Algorithm SHA256

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
SHA256          C5C176FC0CBF4CC4E37C84B6237392B8BEA58DBCCF5FBBC902819DFC72CA9EFA       C:Program Files (x86)ASUSAsusCertServiceAsusCertService.exe

With this new understanding, only the “AsusCertService.exe” service and processes whose PIDs are added by it to the allowed list can obtain a handle to the Asusgio3 device. Otherwise, the operation returns the status “Access is denied.”

Win32PathToNtPath – stack based buffer overflow

This article will not spend much time on the vulnerability discovered in the “Win32PathToNtPath” function, as it will not be used in the later stages of exploitation. However, it is interesting enough to mention.

The developers assumed that a Windows path could have a maximum length of approximately “MAX_PATH” (260) characters. Based on this assumption, they copied the received Image Path into a fixed-size 255-character buffer located on the stack, without first checking the actual length of the path. However, this assumption is incorrect, as a path can exceed ~260 characters. As Microsoft documents here, “The maximum path of 32,767 characters is approximate, because the “\?” prefix may be expanded to a longer string by the system at run time, and this expansion applies to the total length.”

For more information about this vulnerability, read this advisory: CVE-2025-1533/TALOS-2025-2144 – Asus Armoury Crate AsIO3.sys stack-based buffer overflow vulnerability

Authorization bypass

Knowing that the authorization mechanism is based on the “ImagePath” returned by the “ZwQueryInformationProcess” API and the SHA256 hash calculated for the executable file at this path, we can start considering potential bypasses.

By examining the implementation of “(Nt/Zw)QueryInformationProcess” in the “Windows Research Kernel (WRK)”, I learned that the information about the current process’s “ImagePath” is retrieved from the “EPROCESS” structure. Therefore, there is no chance to manipulate its value from User-Mode, but there are still options for potential bypass.

Hardlinks to the rescue

Using a hardlink, we can bypass the “ImageHashCheck” routine. First, we create a hardlink to the PoC.exe file.

Figure 9. Creation of a hard link pointing to “PoC.exe”.

The “PoC.exe” won’t do much for now — it will simply wait for user input before attempting to open a handle to the Asusgio3 device.

Instead of running our “PoC.exe” directly, we then execute “run.exe” hardlink. As a result, in the EPROCESS structure, ImagePath will point to a hardlink.

While the run.exe (PoC.exe) is executed and waiting for user input, we then delete the hardlink and create a new one with the same name, but pointing to AsusCertService.exe. However, trying to create a direct hard link to the original AsusCertService.exe location returns the following:

Figure 11. Due to implemented mitigations, the attempt to create a hardlink to the direct location of AsusCertService.exe failed.

Because of mitigations Microsoft introduced years ago, a user can only create a hard link to a file that they have permission to overwrite. This is not a problem in this case, as I can simply copy the file to a temporary location and then create a hard link.

Now I can further run the previously executed PoC.exe process. In this scenario, at the moment when PoC.exe attempts to open a handle to the Asusgio3 device, the run.exe hard link points to the AsusCertService.exe file, and the SHA256 hash matches. When this occurs, we can bypass this authorization mechanism.

Finding strong exploitation primitives

Analyzing the driver’s functionality

Browsing through the code of the AsIO3.sys driver’s IOCTL handlers, I came across the following functionality, which serves as a good primitive for exploit development. As a regular user, I performed the following actions (among others) using proper IOCTL:

Read/write to Model-specific registers (MSR)
Map arbitrary physical memory [address,size] into our process virtual memory
Read/write I/O ports

However, the exploitation turned out to be more challenging than this originally indicated.

Exploitation attempt with MSR modification

There are at least two crucial MSR registers from a security perspective:

IA32_LSTAR (0xC0000082)
IA32_SYSENTER_EIP (0x00000176)

These MSR registers define the addresses in the kernel where execution is redirected when the SYSCALL or SYSENTER instructions are triggered. By modifying these registers, we can potentially hijack control flow and execute arbitrary code with privileged access, making them an important vector in kernel exploitation. I found a promising-looking handler for IOCTL 0xA040A45C, which allows overwriting the MSR register with arbitrary data.

In line 16, the “_writemsr” instruction, where the data we control, coming from “SystemBuffer” (line 8), is used as the MSR register index (“msrReg”) and value (“msrRegVal”).

At first glance, this looks promising; however, there is a call in line 11 that checks the “msrReg” value (index). Take a closer look:

The MSR index is checked against the list of allowed MSR indexes located in the “MSR_allowedList” array. Unfortunately, this list does not show the crucial registers mentioned earlier: “IA32_LSTAR (0xC0000082)” or “IA32_SYSENTER_EIP (0x00000176)”. Instead, after decoding the indexes to register names and their purposes, we can only manipulate registers without security implications.

With these discoveries, we must look for alternative exploitation methods.

Physical memory mapping

Looking for other code that could be useful during the exploitation process, I found a few IOCTL handlers giving the possibility to map physical memory into the virtual address space of our process. One of them is “0xA040200C”.

We fully control the values of arguments passed to this function: “phyAddress”, “memSize”. At first glance, it seems as though we can map arbitrary physical memory into our user space. We can leverage this primitive in a few different ways, some of which are below:

Try to translate the virtual address of important kernel data that we want to modify into a physical address, then use the above code to map it to our user space. Since this address translation cannot be done from User-Mode, we need to use the Kernel-Level API “MmGetPhysicalAddress”.
Consistently map successive portions of physical memory and search for structures such as the EPROCESS structure of the SYSTEM process to later replace our process’s security token with the token belonging to the SYSTEM process.
Using knowledge about “Low Stub” (PPROCESSOR_START_BLOCK structure), read the value of the CR3 register (PML4 base address) and then, by reading other entries from the memory paging structures, manually translate any virtual address to a physical one.

Russell Sanford’s “Exploiting LOLDrivers” presentation provides more information about these methods, but I had to choose one adequate for the situation.

Unfortunately, I can’t directly translate virtual addresses to physical ones via MmGetPhysicalAddress because there is no way to call this API directly in this driver. Searching through physical memory is very time-consuming and might be problematic (see other examples of implementations and the issues people encountered when choosing this path).

In the end, I chose to implement the “Low Stub” method to manually translate virtual addresses to physical ones. Before doing this, I looked at the function called in line 18, which I named “checkPhyMemoryRange”.

Developers defined certain physical memory address ranges located under the “g_goodRanges” variable. If the specified range does not fit pre-defined ranges, the function returns true, continues execution and results in an error code.

When checking the location of the “Low Stub” “PPROCESSOR_START_BLOCK structure”, we’re able to read it. In the same way, we could read the value of the CR3 register pointing to the PML4 base address.

The next entry from the memory mapping structures pointed to a location outside the allowed address ranges. As a result, I abandoned this approach.

Decrement by one to rule them all

Looking for new useful piece of code, I spotted the following “IOCTL 0xa0402450” handler:

Users can fully control all three arguments. At first glance, this code might look quite harmless, but when I dove into internals of “ObfDereferenceObject”, I saw the following:

Being able to pass arbitrary addresses to “ObfDereferenceObject”, I can decrement any memory value by 1. To be precise, using “ObfDereferenceObject” I decrement by 1 memory located at “Object – 0x30”. I kept this in mind when writing the exploit.

Are there enough puzzles?

But how can we turn these primitives into something useful? Do we need an additional memory leak? When I decided to create a fully working exploit, I assumed a scenario where the code would be executed by a local user (process integrity level: medium). Those familiar with the exploitation process on Windows know that NtQuerySystemInformation can provide very useful information about kernel structures.

However, it’s 2025 and Windows 11 is in use. I remembered news about an upcoming mitigation that would prevent regular users from leaking information such as loaded kernel modules and their addresses via “NtQuerySystemInformation”.

At the beginning of February, when I wrote a fully working exploit, my Windows 11 still did not get the 24H2 update. It was still “ntoskrnl.exe – 10.0.22621.4890 (WinBuild.160101.0800)”.

After I finished writing this article in March 2025, I could see that my 24H2 update finally arrived (“ntoskrnl.exe -10.0.26100.3476 (WinBuild.160101.0800)”). Leaking kernel addresses with “NtQuerySystemInformation” is no longer possible.

Exploitation

Armed with all the knowledge mentioned above, I began writing the exploit.

Leak own thread KTHREAD structure address

As mentioned in the previous paragraph, users can utilize the “NtQuerySystemInformation” API to leak, among others, the address of the “KTHREAD” structure for its own thread. This is where such a simple primitive as “decrement by one” becomes useful.

The “KTHREAD” structure at offset “0x232” has a field called “PreviousMode”, which for User-Mode threads is set to 1. That field is very important and is checked by multiple kernel-level APIs, eventually limiting their functionality if a user calls a particular syscall from User-Mode.

For example, examine what happens when the API calls “ReadProcessMemory,” which calls syscall “NtReadVirtualMemory (MiReadWriteVirtualMemory)”.

As we can see at the beginning, the syscall obtains the current thread structure at line 11. Next, in line 13, there is a special condition for the case when PreviousMode is set to 1 (User-Mode). In line 23, there is a check verifying whether the address pointed to by the user (“BaseAddress”), when increased by the requested memory size, exceeds the maximum address where user-mode components are mapped. This ensures that a user making a call from User-Mode cannot read any memory from the Kernel-Mode address space.

Based on this fact, I changed PreviousMode for my own thread by decrementing its value from “1” to “0”, effectively changing its status from User-Mode to Kernel-Mode. This allows me, among other things, to read and write across the entire address space.

To find the address of “KTHREAD” for my own thread, I followed these steps:

To identify my own thread, I opened a handle to it in line 8. (I later used the handle value to spot related to its structure.) Calling “NtQuerySystemInformation” with “SystemHandleInformation” class, I obtained information about all handles in the system. To spot my own thread handle, I filtered the results looking for a handle value, process ID and object type (thread).

Change PreviousMode

Now that I had the “KTHREAD” address and primitive to change the “PreviousMode” field, I combined it together:

I obtained a pointer to the EPROCESS structure simply by using information about its location from KTHREAD. EPROCESS will be discussed in more detail shortly. Remember that “ObfDereferenceObject” subtracts 0x30 from the address passed as an argument, which is why in line 900, 0x30 is added to the PreviousMode address.

Next, thanks to line 903, we have time to swap the symlink destination and bypass the authorization mechanism before opening a handle to the Asusgio3 device. Inside the “DecrementPreviousMode” function, I simply opened a handle to “Asusgio3” and sent a properly formatted buffer to trigger the primitive.

Stealing token

The “PreviousMode” field of the thread has now been changed to “Kernel-Mode”, allowing me to read the entire virtual address space. With this capability, the first step is to read and store the address location of the EPROCESS structure.

Having the address of my own EPROCESS structure, I started to search the linked list of processes for the SYSTEM process (PID == 4). To achieve this, I used a specific field within the EPROCESS structure called “ActiveProcessLinks”, which is a double-linked list of all processes in the system.

Finding the EPROCESS structure belonging to the SYSTEM process allows me to read its security token and replace the token with the one just read. Remember to increment the reference count of the SYSTEM token!

Run escalated console

Now I can run the escalated console:

This reveals the following:

Success! This exploit results in a console with escalated privileges to SYSTEM level. Watch the video here.

Summary

During the reversal process, I noticed that the developers had patched some previously discovered vulnerabilities and exploitation primitives by restricting certain driver functionalities. However, relying on a disallowed list approach is never a good security practice, as an attacker only needs to find one function that isn’t explicitly blocked to exploit it. Instead, a more effective approach is to implement an allowed list, limiting functionality to only what is necessary.

More importantly, access to a driver with such critical and potentially dangerous functionality should be strictly controlled through multiple layers of security and made available only to a limited number of privileged system users.

Lastly, this research has demonstrated that attackers can leverage even seemingly simple primitives — such as “decrement by one” — to develop a fully functional privilege escalation exploit. This highlights the importance of careful security design in kernel-mode components.

Cisco Talos Blog – Read More

Kaspersky’s FAQ on using and managing passkeys | Kaspersky official blog

June 25, 2025/in Company Blogs

Imagine ditching passwords and SMS verification codes, and instead signing in to apps and websites with a simple fingerprint scan or even a smile at your camera. That’s the promise of passkeys. What’s more, unlike passwords, passkeys are resistant to theft. This means you could read news about data breaches — like the recent one affecting 16 billion accounts — without your heart sinking.

Under various names, this sign-in method is strongly recommended by WhatsApp, Xbox, Microsoft 365, YouTube, and dozens of other popular online services. But what does using passkeys look like in practice? We’ve covered this in detail for Google accounts, and today, we’ll explore how other online services and platforms support passkeys. In this first post, we’ll cover the basics of using passkeys on one or multiple devices. In our next post, we’ll dive into more complex scenarios, such as signing in to your account on a public computer, using Linux, or storing your passkeys on a dongle.

What’s a passkey?

A passkey is a unique digital login key created for a specific website or app. It’s securely stored on your device: your smartphone, computer, or a dedicated USB dongle such as a YubiKey or Google Titan Security Key. When you sign in, your device uses biometrics or a PIN to verify it’s really you. After verification, your device sends a secure response, generated from that unique passkey, to the website. This mechanism offers strong protection against account theft, which is possible with traditional passwords — be that through phishing attacks or website breaches. Passkeys are supported across Apple, Google, and Microsoft devices, and theoretically, with cloud synchronization, they should be accessible across all your devices. For a deeper dive into the internal workings of passkeys, check out our previous article on the subject.

How secure and user-friendly are passkeys?

Before you fully commit to using passkeys, it’s worth considering how convenient they’d be for your specific setup. While the technology is becoming widely adoption, each website and platform implements it differently, using varying terminology for the same features. Additionally, transferring or syncing passkeys can present challenges.

If your smartphone is your only gadget, you are all-in on Apple devices, or you have a couple of recent Android or ChromeOS devices, passkeys will likely save you time when signing in to websites and apps, with minimal hassle.

However, if you use multiple platforms and own many devices, we strongly recommend a third-party password and passkey manager, such as Kaspersky Password Manager, for a smoother experience. Even then, you might still encounter occasional incompatibilities or quirky interfaces on some sites and apps.

For those using less common browsers, Linux-based operating systems, or older computers and smartphones, switching to passkeys might be entirely impracticable, or come with significant limitations.

Keep in mind that very few, if any, services deactivate password-based sign-in when you enable a passkey. This means that, in reality, the enhanced protection against account compromise isn’t as strong as advertised — unless you proactively disable password sign-in yourself. On the flip side, having a password as a backup sign-in method minimizes instances where you might lose access to your account due to passkey issues — but we’ll get into more detail about that later.

Where passkeys are supported in 2025?

Passkeys can be used across major operating systems and browsers, and you don’t necessarily need the absolute latest versions.

Windows 11: supported from version 22H2 onward, though also partially usable on Windows 10 with updates.
macOS: supported from Ventura onward.
iOS/iPadOS: supported from version 16 onward.
Android: passkeys are usable from version 9, but crucial additional settings — including integration with external password managers and passkey providers — only became available in version 14.
Linux: most major distributions lack native passkey support; however, you can still use the technology by leveraging Chrome, Edge, or Firefox browsers in conjunction with an external password manager or a USB token. We’ll dive deeper into how to use passkeys on Linux in our second post on the topic.
Chrome/Edge/Opera: basic passkey capabilities have been around since Chromium version 108, but some conveniences and important features only appeared starting with version 128.
Firefox: supported from version 122 onward. Despite the browser support, passkeys often don’t work on many websites specifically with Firefox.
Safari: supported from version 16 onward, with certain features only available in version 18 or later.

For you to use a passkey, the website or application you’re signing in to must also support the technology. Hundreds already do, so we’ll just mention some of the major players.

Microsoft: passkeys are supported for all personal Microsoft and Xbox accounts. Starting in spring 2025, when creating a new account, the primary option offered is to create a passkey rather than setting a password.
iCloud: passkey sign-in is supported for iCloud, but the passkey itself must be stored on an Apple device.
Google: passkeys are supported for all personal Google accounts, including YouTube.
Meta: supports passkeys for signing in to Facebook and WhatsApp.
You can also ditch passwords in favor of passkeys on X/Twitter, LinkedIn, Amazon, PayPal, TikTok, Yahoo, Discord, Adobe Creative Cloud, GitHub, and more.

Popular services that don’t currently support passkeys notably include ChatGPT, Claude, DeepSeek, Reddit, Spotify, Instagram, AliExpress, Temu, and Shein.

What are the downsides of passkeys?

When considering the switch to passkeys and deciding how to store them, there are a few important drawbacks to keep in mind. The first two are unlikely to ever be fully resolved, while others may become less significant over time.

Anyone who can unlock your device (by knowing your PIN or looking enough like you to bypass Face ID) can potentially access all your accounts. This is especially critical for shared household computers.
If your passkeys are stored on a single device, and that device is damaged or stolen, you could lose access to your accounts. If you haven’t set up alternative sign-in methods, like a password or a backup email or phone number, you’ll have to go through an account recovery process. For some online services, this could take days or even weeks. And if you’ve set up passkey-only sign-in for your primary email, which receives recovery codes for other services, you could potentially lose your accounts forever.
Users with multiple devices running various operating systems or using different browsers might encounter difficulties syncing their passkeys. More on this below.
If you need to sign in to an account from someone else’s device (like a library or hotel computer), outdated software on that machine might prevent passkey sign-in. So it’s crucial to have a plan B.
A less obvious drawback stems from the points above: most online services that offer to switch to passkeys don’t disable other sign-in methods. So, if you protected your account with a weak or reused password before switching to passkeys, attackers could still compromise your account by signing in with the password instead of the passkey.

How to create and use passkeys on a single device?

If you’re rocking just one device that fully supports passkeys (like Apple, Google, or Samsung smartphones released in the last couple of years), making the switch to passkeys is a breeze.

Simply head to the settings of each service you use, find the “Security” section, and look for a “Create a passkey” option.

Here are detailed instructions for Google, Microsoft, Facebook, WhatsApp, TikTok, Discord, Amazon, PayPal, Adobe, Linkedin, and Yahoo.

You won’t find instructions for creating a passkey for your iCloud account here because it happens automatically. Whenever you connect any device running iOS 16 or later, or macOS Ventura or later, to your account, a passkey is created. While you won’t see this in your settings, when you sign in to the iCloud website from an unfamiliar device, you’ll be able to use your passkey instead of a password.

Once created, passkeys are saved locally on your device: on iOS/macOS, they’re in Keychain, and on Android, they can be found in Google Password Manager. Windows is a bit more complex, as passkeys can use either the computer’s built-in storage (accessible via Windows Hello) or other storage options.

Going forward, to sign in to a website or app, just select “Sign in with passkey”, and complete the standard device verification — whether that’s a fingerprint, face scan, or PIN.

The latest versions of Safari on iOS and macOS, as well as Chrome on Windows and macOS (version 136 and later, with Android support “coming soon”), now offer an automatic upgrade option. If your browser has a saved password for a website that now supports passkeys, after you sign in, the browser might automatically create and save a passkey, then prompt you to use it for future passwordless sign-in.

How to use passkeys across multiple devices?

If you’ve got more than one device, you’ll need to figure out how to sync your passkeys across all of them.

If you use only Macs and iPhones, or exclusively Android and ChromeOS devices, you won’t need to go through the hassle of manually setting up passkeys on each gadget. Simply create all your passkeys on one device and ensure that the sync option is enabled in the settings.

For iOS, you can enable this in the iPhone settings under Settings → [your name] → iCloud → Saved to iCloud → Passwords & Keychain → Sync this iPhone (complete guide). On Android, data saved in Google Password Manager automatically syncs with your Google account. Windows and Linux, however, currently lack a built-in passkey sync tool, although Microsoft has said it will develop one soon.

Things get a bit trickier for those who mix and match — especially with popular combinations like Windows + Android or macOS + Android. While you can use passkeys saved on an Android smartphone on your computer, it’s generally limited to Chrome, and only as long as you’re signed in to your Google account in the browser. Given Chrome’s significant drawbacks regarding privacy and user tracking, this solution won’t appeal to everyone. Besides, on a computer, this only allows you to sign in to websites with passkeys; app logins remain exclusive to your Android smartphone.

If you’re an iPhone user with a Windows computer, your iPhone passwords are accessible through the iCloud for Windows app, but it doesn’t support passkeys just yet.

Fortunately, an effective alternative has been available since late 2024. Third-party password managers have gradually added passkey management features across all major platforms. Therefore, the most reliable and universal way to store passkeys, regardless of how many devices you own or what type they are, is to use a robust password manager that supports passkeys and is NOT developed by Apple, Google, or Microsoft. For example, Kaspersky Password Manager already supports passkeys on Windows, with Android support planned for July, and iOS/macOS support for August 2025.

A password manager also solves the backup and recovery problem described above. If your only device with passkeys stored in a third-party password manager is lost or damaged, you can restore your passkeys to a new device from the password manager secure cloud storage.

To use a password manager for passkeys, you’ll need to install it on all your devices and add its browser extension to all browsers on your computer.

How to manage your passkeys?

Managing your saved passkeys is done centrally. If you’re not using a third-party password manager, you can check, delete, or replace outdated passkeys as follows:

iOS: for versions through 17, go to Settings → Passwords. Starting with iOS 18, use the dedicated Passwords
macOS Sequoia and later: use the Passwords For earlier versions, find Passwords in System Settings.
Android: menu structures vary by manufacturer, but look for a setting like Passwords, passkeys, and accounts, or Password Manager. For Samsung devices, open the Samsung Pass
Windows: go to settings, then Accounts → Passkeys.
If you save your passkeys in Google’s password manager, you can manage them from your computer via google.com.

If you’re using a third-party password manager , all passkey management is handled within that application.

In our next post, we’ll dive into more complex situations when using passkeys, including:

How to sign in to your account from a public computer (like at a hotel or library).
Whether you can transfer passkeys between iOS and Android.
How to store passkeys on hardware security keys (like YubiKey or Google Titan Security Key tokens).
Challenges that arise when using passkeys on multilingual international websites.
How to protect your account if it also supports password-based sign-in as a backup.

Meanwhile, be sure to subscribe to our Telegram channel to catch the announcement for the next part!…

Kaspersky official blog – Read More

Top 3 Cyber Attacks in June 2025: GitHub Abuse, Control Flow Flattening, and More

June 25, 2025/in Company Blogs

June 2025 saw several sophisticated and stealthy cyber attacks that relied heavily on obfuscated scripts, abuse of legitimate services, and multi-stage delivery techniques. Among the key threats observed by ANY.RUN’s analysts were malware campaigns using GitHub for payload hosting, JavaScript employing control-flow flattening to drop Remcos, and obfuscated BAT scripts delivering NetSupport RAT. Let’s see how ANY.RUN’s Interactive Sandbox and Threat Intelligence Lookup can help security teams detect, investigate, and understand these threats.

1. Braodo Stealer Abuses GitHub for Payload Staging and Hosting

Original post on X and LinkedIn

A new campaign distributing Braodo stealer leverages public GitHub repository, including raw file content, to host payloads. The primary goal of this stealer is data exfiltration, and at the time of analysis, its detection rate was low. The BAT files used in the campaign include misleading comments to complicate analysis.

ANY.RUN’s Script Tracer simplifies the analysis by logging the multi-stage execution flow step by step, without the need for manual deobfuscation. Let’s take a closer look at this threat’s behavior using ANY.RUN Interactive Sandbox, which provides full visibility into process activity and persistence mechanisms.

View analysis

*Braodo stealer detonated in Interactive Sandbox*

The first BAT file executes a CMD command that launches PowerShell in hidden mode to avoid displaying a visible window. It then downloads a second BAT file from github[.]com, disguised as a .PNG file, saves it to the %temp% folder, and executes it.

This image has an empty alt attribute; its file name is image2-7.png — *Pseudo .png file downloaded from GitHub*

The second BAT file launches a new PowerShell script file, that removes components from the earlier stages, enforces TLS 1.2, retrieves an additional payload from raw.githubusercontent[.]com, saving it in the Startup folder, and downloads main payload in a ZIP file. This behavior is captured in ANY.RUN’s Script Tracer.

*Script Tracer: TLS 1.2 protocol launched, .zip file downloaded*

The final payload, Braodo Stealer, is extracted from a ZIP file, stored in the Public directory, and executed using python.exe. After execution, it deletes the initial archive to reduce artifacts. The Python file is obfuscated with pyobfuscate and contains non-encrypted, custom Base64-encoded payload strings appended to the script.

*The whole attack chain detailed in the Interactive Sandbox*

ANY.RUN’s Threat Intelligence Lookup allows analysts to discover recent Braodo attacks and fresh samples of this stealer dissected by the users of the Interactive Sandbox. Search by the malware’s name and view analyses:

threatName:”Braodo”

*Braodo analyses in the Sandbox found via Threat Intelligence Lookup*

The search results contain a selection of Brado samples recently analyzed by the Sandbox users. Each analysis session can be explored in depth for harvesting IOCs and observing the malware’s behavior.

2. Control Flow Flattening Obfuscated JavaScript Drops Remcos

Original post on X and LinkedIn

Another tricky piece of malicious Java script has been observed using a technique called control-flow flattening obfuscation to secretly deliver Remcos malware. The JS contains multiple self-invoking functions that loop arrays of strings and numbers in a while(!![]) loop until a calculated checksum matches a predefined value. This obfuscation technique forces static analyzers to parse through the array’s content instead of returning the required string directly.

ANY.RUN’s Script Tracer enables easy analysis of heavily obfuscated scripts by logging their execution in real time, with no need for manual deobfuscation.

View analysis

*A Remcos malware sample including the obfuscated JavaScript*

The script:

Invokes #PowerShell using ActiveXObject(“http://WScript.Shell”) with parameters;

Creates a http://System.Net.WebClient object;

Specifies the URL to download the binary;

Downloads the binary data and passes it to #MSBuild;

Downloads and executes the Remcos malware module.

*The script’s architecture and behavior exposed in ANY.RUN’s sandbox*

PowerShell-abusing script attacks are becoming more widespread and sophisticated. It is extremely important for threat hunters to be able to investigate and analyze such attacks, see what malware and malefactors are using them, and how.

A guest article by Clandestine, threat hunter and researcher, has recently been published in our blog highlighting a number of advanced tips for leveraging Threat Intelligence Lookup for malware data gathering and analysis (a guide to main TI Lookup features and their use is included, so we recommend to read and take note).

Clandestine demonstrates how one can find malware samples that use scripting languages to hide malicious code or execute obfuscated commands:

commandLine:”powershell” and fileExtension:”js”

*JavaScript files executing PowerShell commands*

This query identifies scripts that run system commands, the pattern commonly observed in multi-stage attacks where script files act as initial droppers that subsequently execute obfuscated PowerShell commands.

The combination of file extension parameters (you can search for other script types like Visual Basic Script (.vbs) files) with command-line indicators helps security analysts identify and analyze this obfuscation technique.

Learn to Track Emerging Cyber Threats

Check out expert guide to collecting intelligence on emerging threats with TI Lookup

Read full guide

3. Obfuscated BAT file used to deliver NetSupport RAT

Original post on X and LinkedIn

Cybercriminals continue to rely on BAT files (batch scripts) to sneak malware into systems and evade detection. ANY.RUN team has studied one such case where an obfuscated BAT file was used to deliver the NetSupport Remote Access Trojan (RAT) – a tool originally designed for remote IT support but now abused by attackers to gain full control over victims’ machines.

View analysis

*NetSupport attack exploiting PowerShell sandbox analysis*

The key execution chain stages are:

Cmd.exe runs an obfuscated BAT file which launches PowerShell scripts.

PowerShell downloads and executes client32.exe — the NetSupport client.

The malware uses a ‘client32’ process to run NetSupport RAT and add it to autorun in registry via reg.exe.

*ANY.RUN’s Sandbox Process Graph showing NetSupport penetrating network*

Creates an ‘Options’ folder in %APPDATA % if missing.

NetSupport client downloads a task .zip file, extracts, and runs it from %APPDATA%Application.zip.

*Options folder created, .zip archive delivered: Script Tracer in the Sandbox*

Deletes ZIP files after execution.

As attackers develop new ways to penetrate networks and evade detection, threat hunting becomes more challenging and demands to follow trends to keep ahead of possible disasters.

Threat Intelligence Lookup allows you to search for small, seemingly benign artifacts in the network that can be traces of malicious activities, like a folder creation in the system directory AppDataRoaming by a command line-run script:

commandLine:”AppData\Roaming\Options”

*A number of NetSupport trojan samples found by their creating a folder on endpoint*

With the CommandLine search parameter, you can find malware samples based on any script artifacts found in system logs, for example, registry key changes.

How TI Lookup Benefits SOC

ANY.RUN’s Threat Intelligence Lookup is a critical ally for security teams facing an ever-growing variety of evasive malware. With attackers increasingly relying on multi-stage scripts, living-off-the-land binaries (LOLBins), and public infrastructure like GitHub, traditional indicators often go unnoticed.

With Threat Intelligence Lookup your team can:

Speed up threat investigations by letting analysts quickly pivot from indicators and suspicious behaviors to related malware samples and campaigns.

Shorten response times by providing contextual threat insights essential for fast, informed security decisions.

Enhance alert triage by prioritizing detections based on real-world behavior and threat prevalence.

Support proactive threat hunting through flexible search queries that uncover evolving obfuscation and delivery techniques.

Improve detection coverage by uncovering patterns like scripting abuse, LOLBins, and infrastructure used in multi-stage attacks.

The cyber incidents in June 2025 underscore a clear trend: adversaries are refining their methods with obfuscation, open-source abuse, and layered execution chains. To combat these threats effectively, security teams need both visibility and context. Our Interactive Sandbox and TI Lookup empower analysts to deconstruct complex attacks and proactively hunt emerging threats before they become breaches.

About ANY.RUN

ANY.RUN supports over 15,000 organizations across industries such as banking, manufacturing, telecommunications, healthcare, retail, and technology, helping them build stronger and more resilient cybersecurity operations.

With our cloud-based Interactive Sandbox, security teams can safely analyze and understand threats targeting Windows, Linux, and Android environments in less than 40 seconds and without the need for complex on-premise systems. Combined with TI Lookup, YARA Search, and TI Feeds, we equip businesses to speed up investigations, reduce security risks, and improve team’s efficiency.

Integrate ANY.RUN’s Threat Intelligence suite in your organization

The post Top 3 Cyber Attacks in June 2025: GitHub Abuse, Control Flow Flattening, and More appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – Read More