Veganism Social

MalwareLabAnalysis of <a href="https://infosec.exchange/tags/Koske" class="mention hashtag" rel="nofollow noopener" target="_blank">#Koske</a> <a href="https://infosec.exchange/tags/miner" class="mention hashtag" rel="nofollow noopener" target="_blank">#miner</a>.It is an AI-generated <a href="https://infosec.exchange/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> which was hidden in images with pandas. It supports wide variety of coinminers for various cryptocurrencies and for GPU and different CPU architectures. Its another component, <a href="https://infosec.exchange/tags/rootkit" class="mention hashtag" rel="nofollow noopener" target="_blank">#rootkit</a> <a href="https://infosec.exchange/tags/hideproc" class="mention hashtag" rel="nofollow noopener" target="_blank">#hideproc</a>, tries to hide the Koske miner from file listings and processes.<a href="https://malwarelab.eu/posts/koske-panda-ai/" rel="nofollow noopener" translate="no" target="_blank">https://malwarelab.eu/posts/koske-panda-ai/</a>Video from <a href="https://infosec.exchange/tags/anyrun" class="mention hashtag" rel="nofollow noopener" target="_blank">#anyrun</a> analysis:<a href="https://www.youtube.com/watch?v=1OSPp996XQ4" rel="nofollow noopener" translate="no" target="_blank">https://www.youtube.com/watch?v=1OSPp996XQ4</a><a href="https://infosec.exchange/tags/koskeminer" class="mention hashtag" rel="nofollow noopener" target="_blank">#koskeminer</a> <a href="https://infosec.exchange/tags/coinminer" class="mention hashtag" rel="nofollow noopener" target="_blank">#coinminer</a> <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#blueteam</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener" target="_blank">#dfir</a> <a href="https://infosec.exchange/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#malwareanalysis</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/reverseengineering" class="mention hashtag" rel="nofollow noopener" target="_blank">#reverseengineering</a>

OTX BotAI-Generated Malware in Panda Image Hides Persistent Linux ThreatA sophisticated Linux malware campaign called Koske has been discovered, showing signs of AI-assisted development. The threat exploits misconfigured servers to install backdoors and download weaponized JPEG images containing malicious payloads. The malware uses polyglot file abuse to hide shellcode within images, deploys a userland rootkit, and employs various persistence techniques. It aggressively manipulates network settings to ensure command-and-control communication. The malware supports 18 different cryptocurrencies and adapts its mining strategy based on the host's capabilities. The code structure and adaptability suggest AI involvement in its creation, marking a concerning shift in malware development and posing significant challenges for cybersecurity defenses.Pulse ID: 68828d2d536ef213a5f043b8 Pulse Link: <a href="https://otx.alienvault.com/pulse/68828d2d536ef213a5f043b8" rel="nofollow noopener" translate="no" target="_blank">https://otx.alienvault.com/pulse/68828d2d536ef213a5f043b8</a> Pulse Author: AlienVault Created: 2025-07-24 19:44:45Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/BackDoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#BackDoor</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> <a href="https://social.raytec.co/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/RAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#RAT</a> <a href="https://social.raytec.co/tags/Rootkit" class="mention hashtag" rel="nofollow noopener" target="_blank">#Rootkit</a> <a href="https://social.raytec.co/tags/ShellCode" class="mention hashtag" rel="nofollow noopener" target="_blank">#ShellCode</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener" target="_blank">#AlienVault</a>

The New Oil<a href="https://mastodon.thenewoil.org/tags/SonicWall" class="mention hashtag" rel="nofollow noopener" target="_blank">#SonicWall</a> <a href="https://mastodon.thenewoil.org/tags/SMA" class="mention hashtag" rel="nofollow noopener" target="_blank">#SMA</a> devices hacked with <a href="https://mastodon.thenewoil.org/tags/OVERSTEP" class="mention hashtag" rel="nofollow noopener" target="_blank">#OVERSTEP</a> <a href="https://mastodon.thenewoil.org/tags/rootkit" class="mention hashtag" rel="nofollow noopener" target="_blank">#rootkit</a> tied to <a href="https://mastodon.thenewoil.org/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#ransomware</a><a href="https://www.bleepingcomputer.com/news/security/sonicwall-sma-devices-hacked-with-overstep-rootkit-tied-to-ransomware/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/sonicwall-sma-devices-hacked-with-overstep-rootkit-tied-to-ransomware/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a>

Kevin Karhan :verified:"<a href="https://infosec.space/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a> maker sponsors a <a href="https://infosec.space/tags/shitpost" class="mention hashtag" rel="nofollow noopener" target="_blank">#shitpost</a> by a <a href="https://infosec.space/tags/TechIlliterate" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechIlliterate</a> <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> n0ob to sell their <a href="https://infosec.space/tags/Rootkit" class="mention hashtag" rel="nofollow noopener" target="_blank">#Rootkit</a> to <a href="https://infosec.space/tags/TechIlliterates" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechIlliterates</a>" would'nt be as clickbaity but a <a href="https://infosec.space/tags/HonestVideoTitle" class="mention hashtag" rel="nofollow noopener" target="_blank">#HonestVideoTitle</a> instead...<a href="https://www.youtube.com/watch?v=UKLTGoftJi8" rel="nofollow noopener" translate="no" target="_blank">https://www.youtube.com/watch?v=UKLTGoftJi8</a><a href="https://infosec.space/tags/Lienus" class="mention hashtag" rel="nofollow noopener" target="_blank">#Lienus</a> <a href="https://infosec.space/tags/LinusTechTips" class="mention hashtag" rel="nofollow noopener" target="_blank">#LinusTechTips</a> <a href="https://infosec.space/tags/LienueStechTips" class="mention hashtag" rel="nofollow noopener" target="_blank">#LienueStechTips</a> <a href="https://infosec.space/tags/Clickbait" class="mention hashtag" rel="nofollow noopener" target="_blank">#Clickbait</a> <a href="https://infosec.space/tags/YouTube" class="mention hashtag" rel="nofollow noopener" target="_blank">#YouTube</a>

WinFuture.deSicherheitsforscher haben ein <a href="https://mastodon.social/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a>-<a href="https://mastodon.social/tags/Rootkit" class="mention hashtag" rel="nofollow noopener" target="_blank">#Rootkit</a> entwickelt, das die <a href="https://mastodon.social/tags/Kernel" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kernel</a>-<a href="https://mastodon.social/tags/API" class="mention hashtag" rel="nofollow noopener" target="_blank">#API</a> io_uring ausnutzt, um unentdeckt zu bleiben. Überwachungstools erkennen etwaige Angriffe darüber nicht. <a href="https://winfuture.de/news,150557.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia" rel="nofollow noopener" translate="no" target="_blank">https://winfuture.de/news,150557.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia</a>

PrivacyDigest<a href="https://mas.to/tags/Hackers" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hackers</a> can now bypass <a href="https://mas.to/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> <a href="https://mas.to/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> thanks to terrifying new Curing <a href="https://mas.to/tags/rootkit" class="mention hashtag" rel="nofollow noopener" target="_blank">#rootkit</a> <a href="https://betanews.com/2025/04/24/hackers-bypass-linux-security-with-armo-curing-rootkit/" rel="nofollow noopener" translate="no" target="_blank">https://betanews.com/2025/04/24/hackers-bypass-linux-security-with-armo-curing-rootkit/</a>

heise Security"Passwort" Folge 25: Staatlich sanktionierte SchnüffelsoftwareDieses Mal nehmen sich die Podcast-Hosts eines kontroversen Themas an: Unternehmen installieren über Sicherheitslücken Malware - und das in staatlichem Auftrag.<a href="https://www.heise.de/news/Passwort-Folge-25-Staatlich-sanktionierte-Schnueffelsoftware-10271855.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/news/Passwort-Folge-25-Staatlich-sanktionierte-Schnueffelsoftware-10271855.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon</a><a href="https://social.heise.de/tags/Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#Android</a> <a href="https://social.heise.de/tags/Exploit" class="mention hashtag" rel="nofollow noopener" target="_blank">#Exploit</a> <a href="https://social.heise.de/tags/iOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#iOS</a> <a href="https://social.heise.de/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a> <a href="https://social.heise.de/tags/PasswortPodcast" class="mention hashtag" rel="nofollow noopener" target="_blank">#PasswortPodcast</a> <a href="https://social.heise.de/tags/Pegasus" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pegasus</a> <a href="https://social.heise.de/tags/Rootkit" class="mention hashtag" rel="nofollow noopener" target="_blank">#Rootkit</a> <a href="https://social.heise.de/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://social.heise.de/tags/Spyware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Spyware</a> <a href="https://social.heise.de/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#news</a>

PrivacyDigestStealthy <a href="https://mas.to/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> <a href="https://mas.to/tags/rootkit" class="mention hashtag" rel="nofollow noopener" target="_blank">#rootkit</a> found in the wild after going undetected for 2 years <a href="https://mas.to/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a><a href="https://arstechnica.com/?p=1989775" rel="nofollow noopener" translate="no" target="_blank">https://arstechnica.com/?p=1989775</a>

Fox<a href="https://tech.lgbt/@stonehead" class="u-url mention" rel="nofollow noopener" target="_blank">@stonehead</a> Hi! I'm glad you asked because I'm sure there are many more people wondering about the same thing! :) Yes, there is always a risk when you download something from open sources. However, you really cannot trust official sources as well. A good example is Sony's rootkit scandal. [1][2]Doing basic internet "hygiene" will prevent you from most viruses, though. Having a decent virus scanner will do wonders [3], and the rest comes down to common sense. Be very careful with executables, keep your software (like PDF readers) up to date, look for settings to turn off scripts and perhaps consider sanitizing your PDFs before opening them. [4][5]An interesting point on the aforementioned website is the following:"With budgets getting tighter, we understand the appeal of free antivirus software. While there have been great changes in free subscriptions, the most notable being they now offer real-time malware protection, they are still minimal compared to a full antivirus security suite.There are some exceptions, but most free antivirus programs don't offer web protections. This means they won't stop malware from downloading if you accidentally click on a malicious link. They will snatch it before it has a chance to infract your computer, but we feel better than a threatening file doesn't get that far into the process."I hope this helped you on your way, and if not, do let me know! :)----------[1] <a href="https://www.theregister.com/2005/11/01/sony_rootkit_drm" rel="nofollow noopener" target="_blank">https://www.theregister.com/2005/11/01/sony_rootkit_drm</a> [2] <a href="https://www.theregister.com/2021/12/10/autorunning_away/" rel="nofollow noopener" target="_blank">https://www.theregister.com/2021/12/10/autorunning_away/</a> [3] <a href="https://www.techradar.com/best/best-free-antivirus" rel="nofollow noopener" target="_blank">https://www.techradar.com/best/best-free-antivirus</a> (go to the product's websites manually to avoid tracking through links) [4] <a href="https://github.com/Kerbalnut/Sanitize-PDF" rel="nofollow noopener" target="_blank">https://github.com/Kerbalnut/Sanitize-PDF</a> [5] <a href="https://www.webpdf.de/en/pdf-redact-and-sanitize" rel="nofollow noopener" target="_blank">https://www.webpdf.de/en/pdf-redact-and-sanitize</a>----------<a href="https://cytag.nl/tags/pdf" class="mention hashtag" rel="nofollow noopener" target="_blank">#pdf</a> <a href="https://cytag.nl/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://cytag.nl/tags/virus" class="mention hashtag" rel="nofollow noopener" target="_blank">#virus</a> <a href="https://cytag.nl/tags/script" class="mention hashtag" rel="nofollow noopener" target="_blank">#script</a> <a href="https://cytag.nl/tags/macro" class="mention hashtag" rel="nofollow noopener" target="_blank">#macro</a> <a href="https://cytag.nl/tags/worm" class="mention hashtag" rel="nofollow noopener" target="_blank">#worm</a> <a href="https://cytag.nl/tags/epub" class="mention hashtag" rel="nofollow noopener" target="_blank">#epub</a> <a href="https://cytag.nl/tags/software" class="mention hashtag" rel="nofollow noopener" target="_blank">#software</a> <a href="https://cytag.nl/tags/antivirus" class="mention hashtag" rel="nofollow noopener" target="_blank">#antivirus</a> <a href="https://cytag.nl/tags/rootkit" class="mention hashtag" rel="nofollow noopener" target="_blank">#rootkit</a> <a href="https://cytag.nl/tags/sanitize" class="mention hashtag" rel="nofollow noopener" target="_blank">#sanitize</a>

FreemindReptile is a Linux kernel mode rootkit malware that provides a concealment feature for files, directories, processes, and network communications.<a href="https://mastodon.online/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://mastodon.online/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> <a href="https://mastodon.online/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://mastodon.online/tags/cyberthreat" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberthreat</a> <a href="https://mastodon.online/tags/rootkit" class="mention hashtag" rel="nofollow noopener" target="_blank">#rootkit</a><a href="https://cybersec84.wordpress.com/2023/08/05/linux-malware-reptile-poses-serious-threat-to-south-korean-systems/" rel="nofollow noopener" translate="no" target="_blank">https://cybersec84.wordpress.com/2023/08/05/linux-malware-reptile-poses-serious-threat-to-south-korean-systems/</a>

Recent searches

Search options

Administered by:

Server stats:

#rootkit