BlackX bootkit breaches fully patched Windows via Secure Boot gap

BlackX UEFI bootkit infects fully patched Windows via Baton Drop flaw

Kaspersky discovered a new UEFI bootkit, BlackX, infecting organizations running fully patched Windows systems by exploiting Baton Drop, a logic flaw in the Windows boot manager tracked as CVE-2022-21894. Microsoft patched the vulnerability in 2022 but did not revoke trust in the certificate signing older vulnerable boot managers. Its later updates added a new signing certificate and a way to forbid the old one, yet administrators still had to perform an extra manual step buried in a Knowledge Base article. Kaspersky said few organizations realized the patch needed activating, and the actor likely bet on that. Bootkits run early in boot, loading malicious drivers before defenses start, and can survive OS reinstalls. BlackX mirrors BlackLotus, the first documented in-the-wild Secure Boot bypass on fully updated Windows 11.

UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame? - Ars Technica →

Topics: Windows securityZero-day vulnerabilities

CWPdoor backdoor spreads through trojanized Control Web Panel server

Researchers at XLab, QiAnXin’s security arm, found a new Linux malware called CWPdoor distributed via a trojanized version of cwpsrv, the web server behind the Control Web Panel management interface. A script posing as an updater replaced legitimate cwpsrv binaries, versions 1.15.10 and 1.24.0, while restoring timestamps, deleting temp files and wiping command history. CWPdoor stays dormant until the attacker sends a crafted request with encrypted HTTP headers, an RSA signature and a five-minute timestamp window, then executes commands via AES-256-CBC and suppresses access logs. XLab found it on June 29 and later saw it on VirusTotal alongside the Ebury backdoor with zero detections. More than 340,000 CWP instances were exposed publicly in the past month.

Hackers backdoor Linux servers using trojanized CWP web server →

Topics: Malware & infostealers

Discover-Tech used ad networks to spy on and geolocate Starlink users

Israeli spy outfit Discover-Tech surveilled internet users through online ads used to track, spy on and geolocate them, with TrendAI concluding it was one of the biggest sources of digital ads shown to SpaceX Starlink users. Citizen Lab said Discover-Tech posed as a legitimate vendor on ad exchanges while acting as a proxy for outfits including U.S.-blacklisted Candiru, using certified status to target people with zero-click malware across more than 120,000 websites and 75,000 apps. Because ad code can carry user or device identifiers, arbitrary JavaScript can reach a single device, and simply displaying a targeted ad can infect it. Ad-auction data also lets firms track users across cellular, Wi-Fi and VPNs. In May, Haaretz reported Israeli vendors advertising Starlink-user targeting, relevant in Ukraine.

Israeli Spy Company Busted Using Malware Ads To Infect, Locate, And Spy On Starlink Users →

Topics: SpywareOnline tracking

Crédit Mutuel Arkéa loses estimated €118 million in third-party breach

Hackers breached French banking group Crédit Mutuel Arkéa through a third-party service provider’s platform and allegedly siphoned an estimated 118 million euros, about $132.44 million, from corporate accounts. The attackers bypassed client accounts, using the bank’s proprietary accounts to move funds to other banks, where the money was potentially converted to cryptocurrency. The bank did not confirm the figure but validated its order of magnitude, saying part of the funds was blocked and recovery actions are underway. Arkéa, with more than 5.8 million members and clients and a 211.5 billion euro balance sheet, said the theft does not threaten its stability, refuted rumors of a Fortuneo breach or human error, and said no client funds or data were compromised. It suspended some transactions temporarily and is working with police and regulators.

Hackers Steal Estimated 118 Million Euros in Cyberattack on French Bank →

Topics: Third-party and vendor breaches

Filen’s deprecated password hashing and key handling undermine its zero-knowledge claim

A security review of Filen, a German end-to-end encrypted cloud storage provider now on its third crypto protocol, found its oldest accounts still authenticate with deprecated hashes including MD2 and MD4, and that a downgrade attack could push recent accounts onto them. Because the server tells the client which hash version to use, it could claim an account is v1 and harvest the weak hash, potentially exposing files for weak passwords. The review also flagged server-side search hashes that leak filename chunks, unauthenticated recipient public keys enabling man-in-the-middle sharing attacks, and unsigned software updates. Filen says it will address many points in an upcoming fourth protocol version, possibly with post-quantum security.

Filen's password onion made me cry →

Topics: Encryption