mastodon.ie

0 posts0 participants0 posts today

ESET Research<a href="https://infosec.exchange/tags/ESETresearch" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ESETresearch</a> has uncovered the <a href="https://infosec.exchange/tags/MirrorFace" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MirrorFace</a> Operation AkaiRyū, which extends the group’s usual focus beyond Japan into Europe. The initial lure centered around Expo 2025 in Japan, compromising a Central European diplomatic institute. <a href="https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/</a>Surprisingly, <a href="https://infosec.exchange/tags/MirrorFace" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MirrorFace</a> used <a href="https://infosec.exchange/tags/ANEL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ANEL</a> – a backdoor historically linked only to <a href="https://infosec.exchange/tags/APT10" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#APT10</a> – highlighting a shift in the group’s tactics and reinforcing suspicions that MirrorFace could be part of the APT10 umbrella. Operation AkaiRyū began with targeted spearphishing emails referencing the victim’s past correspondence and Expo 2025 , persuading recipients to download malicious attachments. Once the files were opened, a layered compromise chain ensued . Collaborating with the victim allowed us to perform in-depth analysis, shedding light on MirrorFace’s post-compromise behavior – from credential harvesting to dropping additional tools for lateral movement. <a href="https://infosec.exchange/tags/MirrorFace" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MirrorFace</a> used an intricate execution chain to stealthily run a highly tweaked <a href="https://infosec.exchange/tags/AsyncRAT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AsyncRAT</a> within <a href="https://infosec.exchange/tags/WindowsSandbox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WindowsSandbox</a>, hampering detection efforts. This is the first time we’ve seen MirrorFace employ AsyncRAT. In another twist, <a href="https://infosec.exchange/tags/MirrorFace" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MirrorFace</a> utilized <a href="https://infosec.exchange/tags/VSCode" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VSCode</a> remote tunnels, a tactic enabling covert access and command execution on compromised machines. This approach has also been seen with other China-aligned cyberespionage groups. The group primarily leveraged <a href="https://infosec.exchange/tags/ANEL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ANEL</a> as a first-stage backdoor, <a href="https://infosec.exchange/tags/HiddenFace" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HiddenFace</a> – MirrorFace’s flagship backdoor – was dropped later in the attack to bolster persistence . Notably absent this time was <a href="https://infosec.exchange/tags/LODEINFO" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LODEINFO</a>, which <a href="https://infosec.exchange/tags/MirrorFace" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MirrorFace</a> typically employs.We presented our findings about Operation AkaiRyū conducted by <a href="https://infosec.exchange/tags/MirrorFace" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MirrorFace</a> at @jpcert_ac on January 22, 2025: <a href="https://jsac.jpcert.or.jp" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://jsac.jpcert.or.jp</a>. IoCs available in our GitHub repo: <a href="https://github.com/eset/malware-ioc/tree/master/mirrorface" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/eset/malware-ioc/tree/master/mirrorface</a>

Adam ♿look-of-disapproval.png.webm.gif<a href="https://developercommunity.visualstudio.com/t/exe-built-in-a-Windows-Sandbox-shared-pa/10340169" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://developercommunity.visualstudio.com/t/exe-built-in-a-Windows-Sandbox-shared-pa/10340169</a><a href="https://aus.social/tags/VisualStudio" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VisualStudio</a> <a href="https://aus.social/tags/WindowsSandbox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WindowsSandbox</a>

Adam ♿I shouldn't have to throw your <a href="https://aus.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> software into <a href="https://aus.social/tags/WindowsSandbox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WindowsSandbox</a> and disable networking to get it to behave.

annajayne 🏳️‍⚧️🙏🏳️‍🌈I was experimenting with Windows Sandbox over the weekend, and as a result I now have a sandbox config which launches it with drives mapped and both Winget and Chocolatey installed. 😁The only hiccup I've run into is that Winget is being stubborn (there are some dependency issues) on Windows 10. 🤔On Windows 11 however it's absolutely fine. 👍😎👍<a href="https://mastodon.social/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> <a href="https://mastodon.social/tags/Windows11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows11</a> <a href="https://mastodon.social/tags/WindowsSandbox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WindowsSandbox</a> <a href="https://mastodon.social/tags/VirtualMachine" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VirtualMachine</a> <a href="https://mastodon.social/tags/VM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VM</a> <a href="https://mastodon.social/tags/Tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tech</a> <a href="https://mastodon.social/tags/Software" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Software</a> <a href="https://mastodon.social/tags/Scripting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Scripting</a>

Recent searches

Search options

Administered by:

Server stats:

#windowssandbox