Author: Daejin Lee, Seunghoe Kim, Donguk Kim, Eugene Jang Basic Information Tested OS: Windows 10 1809, 2009 x64, Windows 11 x64 Severity: Important Target module version: <1.1.19100.5(mpengine.dll) First updated version: 1.1.19100.5(mpengine.dll) This vulnerability allows remote attackers to trigger heap out-of-bounds read on default installation of Windows Defender. We tested this vulnerability with…

Author: Hotsauce | S2W TALON (Threat Research & Intelligence Center) Last Modified: Nov 24, 2022 Executive Summary Bjorka, who has uploaded databases related to the Indonesian government and companies, started his activities by exposing a database of Indonesian gambling sites on Raidforums on November 9, 2020 Bjokra resumed his activities on Breached…

Author: Sebin, Lee & Yeongjae, Shin | S2W TALON Last Modified : Oct 24, 2022 Executive Summary S2W’s threat research and intelligence center, Talon, recently identified three new types of malware that target Android devices. We named the malicious APKs FastFire, FastViewer, and FastSpy by adding ‘Fast’ included in the package name…

Talon: Center for Threat Research and Intelligence of S2W S2W 에서 공식적으로 침해 사고 대응 서비스를 시작합니다. 침해사고대응센터는 S2W 내 세계적 수준의 사이버위협 인텔리전스(CTI) 분석 조직인 탈론 (TALON)의 숙련된 사고 조사 전문가들로 운영되며, 침해사고와 관련된 전 과정에서 대응을 지원합니다. 침해사고대응센터(S2W 위협분석센터 센터장, 곽경주) 에서는 멀웨어 및 취약점 분석, 디지털 포렌식…

Author: HuiSeong, Yang & Hyunsik, Jeong | S2W TALON Last Modified : Sep 22, 2022 Executive Summary According to a tweet from 3xp0rt, Ali Qushji was able to infiltrate LockBit’s server and acquire the builder for the ransomware According to vx-underground, Proton, one of the programmers for the LockBit ransomware group, mentioned…

Author: HOTSAUCE | S2W TALON First Publihsed: July 6, 2022. Last Modified : July 8, 2022. As @CrazymanArmy and @ShadowChasing1 pointed out, our conclusion is also same that there is no concrete evidence to connect Teng Snake with the previously known APT-C-61. Executive Summary The “Teng Snake” team has created Telegram channels…

Author: S2W TALON Last Modified : June 30, 2022. Executive Summary As LockBit ransomware group has been updated twice without rebranding for a long time and continues to strengthen their brand reputation with their recently announced update to 3.0. As a result, the copycat groups that imitate LockBit ransomware’s logo or the…

Author: HOTSAUCE | S2W TALON Executive Summary LockBit ransomware was previously known as ABCD ransomware and belonged to the Maze ransomware cartel, but started independent activity in September 2019 as the Maze gang announced its retirement. Instead of rebranding the existing name like other ransomware groups, LockBit updated its own brand to…

Author : HOTSAUCE | S2W TALON Executive Summary On June 15th, 2022, a user who is operating the carding market “BidenCash” uploaded an advertisement with a link for downloading free carding information on underground forums. From April 27, 2022, until now, the user has been active on underground forums that trade carding…