Indholdsfortegnelse for June 2022 i Hackercool Magazine

All rights reserved. No part of this publication may be reproduced, distributed, or transmitted in any form or by any means, including photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the publisher, except in the case of brief quotations embodied in critical reviews and certain other noncommercial uses permitted by copyright law. For permission requests, write to the publisher, addressed “Attention: Permissions Coordinator,” at the address below. Any references to historical events, real people, or real places are used fictitiously. Names, characters, and places are products of the author’s imagination. Hackercool Cybersecurity (OPC) Pvt Ltd. Banjara Hills, Hyderabad 500034 Telangana, India. Website : www.hackercoolmagazine.com Email Address : admin@hackercoolmagazine.com Information provided in this Magazine is strictly for educational purpose only. Please don't misuse this knowledge…

Sophos Firewalls are hardware devices used by multiple organizations around the world. When one organization that was a frequent target of APTs around the world complained about anomalous activity emanating from its Firewall, Volexity, the big Game malware hunters began forensic investigation into this by collecting live sample of the firewall memory. This is a story of how the researchers investigated and detected the hack. Initial Access Volexity came to the conclusion that the Firewall has been hacked after it saw suspicious traffic starting from the Firewall that was moving towards important systems of the customer’s target network. As the user portal component (used for external login) was the only end point of the company’s network that was exposed to the internet (we saw one such scenario in our July…

Then you will know the truth and the truth will set you free. John 8:32 This Issue got delayed more than the previous Issue. So Sorry. No Editor’s Note. "THE USE OF DROPBOX AND GOOGLE DRIVE SERVICES [...] IS A NEW TACTIC FOR THIS ACTOR AND ONE THAT PROVES CHALLENGING TO DETECT DUE TO THE UBIQUITOUS NATURE OF THESE SERVICES AND THE FACT THAT THEYARE TRUSTED BY MILLIONS OF CUSTOMERS WORLDWIDE."- RESEARCHERS ON HACKERS USING DROPBOX AND GOOGLE DRIVE TO DELIVER PAYLOADS.…

Mohiuddin AhmedLecturer Of Computing & Security,Edith Cowan University M Imran MalikCyber Security Researcher,Edith Cowan University Paul Haskell-Dowland,Professor Of Cyber Security Practice,Edith Cowan University After 27 years, Microsoft has finally bid farewell to the web browser Internet Explorer, and will redirect Explorer users to the latest version of its Edge browser. "On the security front, Explorer exhibited its fair share of weaknesses, which cyber criminals readily and successfully exploited". As of June 15, Microsoft ended support for Explorer several versions of Windows 10 – meaning no more productivity, reliability or security updates. Explorer will remain a working browser, but won’t be protected as new threats emerge. Twenty-seven years is a long time in computing. Many would say this move was long overdue. Explorer has been long outperformed by its competitors, and…

In our Previous Issue, readers have learnt about the Follina Zero day vulnerability and how it can be exploited to gain a reverse shell on a vulnerable target. We have uses Netcat as our payload while exploiting Follina in our previous Issue. In this article, readers will learn how APTs around the world are exploiting Follina vulnerability. 1. TA413 The first APT to start exploiting Follina zero day may be TA413, a Chinese APT known to target international Tibetan diaspora. Before Follina, the group regularly delivered implants like Exile RAT and sepulchre to their targets. It appears that by exploiting Follina, this time around, they are delivering password stealing trojans. The modus operandi of this attack is to deliver a zip archive containing URLS to the malicious payloads. For this…