Malware

Investigating an in-the-wild campaign using RCE in CraftCMS

18 April 2025 ~26 min By Nicolas Bourras
Analysis Craft Cms Incident Response Ioc Malware Php Post-Exploitation Threat Hunting Yii Iocs Post Exploitation
In mid-February, Orange Cyberdefense’s CSIRT was tasked with investigating a server that had been hosting a now-unavailable website. The site had been built using CraftCMS running version 4.12.8. The forensic investigation and post-analysis with the Ethical Hacking team led to the discovery of two CVEs: CVE-2024-58136 and CVE-2025-32432. This blog post aims to present: The investigation that led to the finding of those two CVEs, and details of the different…

Masquerading Windows processes like a DoubleAgent.

23 April 2020 ~13 min By Philippe Vogler
Anti-Virus Malware Persistence Post-Exploitation Sysmon Windows
I’ve been spending some time building new content for our Introduction to Red Teaming course, which has been great for diving into AV/EDR bypass techniques again. In this blog post, I will demonstrate how to re-weaponise the old “DoubleAgent” technique, making endpoint security products do the hacking work for us. One known vector to shimmy past AV solutions is to use process injections. At BlackHat 2019, a number of process…

Waiting for goDoH

24 October 2018 ~9 min By Leon Jacobs
Bypass Command Execution Dns Experiment Ioc Malware Research Tools Tunnelling
“Exfiltration Over Alternate Protocol” techniques such as using the Domain Name System as a covert communication channel for data exfiltration is not a new concept. We’ve used the technique for many years at SensePost, including Haroon & Marco’s 2007 BH/DC talk on Squeeza. In the present age this is a well understood topic, at least amongst Infosec folks, with a large number of resources, available, online that aim to enlighten those…

Understanding Locky

19 February 2016 ~6 min By vlad
Research Malware Ransomware
A few days ago I was asked to have a look at the newly emerged crypto-ransomware threat “Locky” which utilises Dridex-like Command and Control (C&C) communications techniques. For some background reading, I recommend you read the following: http://sensorstechforum.com/aes-128-encryption-employed-by-locky-ransomware/ https://nakedsecurity.sophos.com/2016/02/17/locky-ransomware-what-you-need-to-know/) http://www.theinquirer.net/inquirer/news/2447460/dridex-style-locky-ransomware-is-infecting-machines-via-microsoft-word It looks like a new (FEB2016) addition to the crypto-ransomware family : 1. Dirty Decrypt 2. CryptoLocker 3. CryptoWall / Cryptodefense 4. Critroni / CTB Locker 5. TorrentLocker 6. Cryptographic Locker 7. TeslaLocker 8. Locky…