[local-logs] Fail2ban jail apache-modsecurity ha bannato 59 IP per tentativi di attacco rilevati tramite pattern matching su log di sicurezza
[https://isc.sans.edu/diary/rss] Since last week, I detected a wave of similar emails that deliver the same kind of payload
[https://isc.sans.edu/diary/rss] Indeed, it can perform all the required actions to inject a payload into a remote process as you ll see below
[https://isc.sans.edu/diary/rss] Last Updated : 2026-07-28 07:42:27 UTC by Xavier Mertens (Version: 1) 0 comment(s) For a long time, AutoIT[ 1 ] has been pretty common in the malware ecosystem
[https://isc.sans.edu/diary/rss] exe, inject and launch the payload via the following API calls: $V_04 : OpenProcess $V_05 : VirtualAllocEx $V_06 : WriteProcessMemory $V_07 : CreateRemoteThread $V_08 : CloseHandle Yes, AutoIT is able to invoke any API call
[https://isc.sans.edu/diary/rss] The archive contains a VBS script (SHA256:f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f) This first script is pretty simple: it decodes a Base64 payload, dumps it on disk with a random name and invokes a PowerShell interpreter to decompress it (I beautified the script a bit): C:\Windows\System32\WindowsPowerShell\v1
[https://isc.sans.edu/diary/rss] Internet Storm Center Diary 2026-07-28 - SANS ISC Handler on Duty: Xavier Mertens Threat Level: green AutoIT Payload Injector Published : 2026-07-28
[https://isc.sans.edu/diary/rss] com/medusahvnc-a-hidden-desktop/ Xavier Mertens (@xme) Senior ISC Handler | SANS Principal Instructor | Freelance Consultant Xameco | PGP Key Keywords: charmapexe Injection VIPKeylogger Malware AutoIT 0 comment(s) ISC Stormcast For Tuesday, July 28th, 2026 https://isc
[https://isc.sans.edu/diary/rss] exe is an AutoIT3 interpreter (SHA256: bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1) wwman is the AutoIT script that will perform the injection of the shellcode stored in Ennnn: #NoTrayIcon Func _O($s) Local $d = For $i = 1 To StringLen($s) Step 2 $d = Chr(Dec(StringMid($s, $i, 2))) Next Return $d EndFunc Global $V_01 = ( \Ennnn ) Global $V_02 = ( C:\Windows\Syswow64\charmap
[https://isc.sans.edu/diary/rss] It seems that AutoIT is back on stage because I found another malware analysis report that describes the same infection path[ 3 ]
[https://isc.sans.edu/diary/rss] To wrap up the infection chain: The shellcode will deliver a VIPKeylogger[ 2 ] malware that will talk to cphost17[
[https://cert-agid.gov.it/feed/] Phishing ai danni de Il Portale dell Automobilista indicizzato tra i primi risultati Google
[https://caddy.community/latest.rss] waf or xcaddy build --with github
[https://caddy.community/latest.rss] com/fabriziosalmi/caddy-waf caddy list-modules | grep waf # http
[https://caddy.community/latest.rss] I successfully submitted my waf kid into the street jungle
[https://caddy.community/latest.rss] Caddy-waf is available as module now :)
[https://caddy.community/latest.rss] com/fabriziosalmi/caddy-waf or via the Caddy download page, adding it as plugin before to download the bundle binary
[https://www.infosecurity-magazine.com/rss/news/] Coca Cola claims data was stolen from its Fairlife business after a recent ransomware attack NVIDIA’s Open Secure AI Alliance Is Missing Some Big Names
[https://www.redhotcyber.com/feed/] Carolina Vivianti - 26 Luglio 2026 Successivo » Scopri le ultime CVE critiche emesse e resta aggiornato sulle vulnerabilità più recenti
[https://www.redhotcyber.com/feed/] Cybersecurity, Cybercrime e Intelligenza Artificiale | Red Hot Cyber Vai al contenuto News Discover Newsletter L era del sistemista copia-incolla è arrivata
[https://www.redhotcyber.com/feed/] Ma il cloud è sempre dietro la porta Microsoft ha introdotto il primo modello di sicurezza informatica specializzato MAI-Cyber-1-Flash e la nuova piattaforma di agenti Perception
[https://www.redhotcyber.com/feed/] Luigi Zullo 5 anni, 119 estensioni, 2,6 milioni di vittime: la campagna steganografica scoperta da Microsoft su Edge Luigi Zullo Massimo allarme per WordPress: RCE critica nel core, 500 milioni di siti potenzialmente vulnerabili '> Microsoft lancia Perception: la sua IA agentica contro gli hacker criminali
[https://vulners.com/rss.xml] This could lead to unauthorized information disclosure
[https://vulners.com/rss.xml] This could lead to unauthorized control over the affected system
[https://vulners.com/rss.xml] An arbitrary file read risk was identified in the backup restore functionality
[https://vulners.com/rss.xml] This could lead to unauthorized modifications or disruptions within the quiz
[https://vulners.com/rss.xml] An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request
[https://vulners.com/rss.xml] The quiz feature, which allows users to add section headings, did not include a necessary security token
[https://vulners.com/rss.xml] com - Unauthenticated remote code execution in Balbooa Forms 2
[https://vulners.com/rss.xml] The flaw occurs when the application fails to properly limit or throttle resource allocation, leading to potential system instability or unresponsiveness