FudModule rootkit burrows deep into Windows, where it can bypass key security defenses.
  • rhabarba@feddit.orgEnglish
    188·
    3 months ago

    A Windows zero-day vulnerability recently patched by Microsoft was exploited by hackers working on behalf of the North Korean government so they could install custom malware that’s exceptionally stealthy and advanced, researchers reported Monday.

    I am always amazed at how easy it is for ‘security researchers’ to speculate about which government is solely responsible for exploiting security vulnerabilities.

    • einkorn@feddit.orgEnglish
      45·
      3 months ago

      Specific groups of hackers often have various markers that appear throughout their various malware.

      Reused code fragments are the most obvious one. Others are specific code styles such as variable naming, even formatting. It’s basically the same stuff that is used to determine whether a specific text was most likely written by a specific person.

      • booly@sh.itjust.worksEnglish
        12·
        3 months ago

        During World War II, the telegraph interception guys would figure out which enemy units were where, even without having broken the codes, because each telegraph operators each had their own “fist,” or distinct patterns in how they punched in the Morse code, and people listening to the signals day in and day out could learn to distinguish them even when dealing entirely in encrypted text.

        In modern times, attribution of hacker groups include other indicators include what time zones certain people seem to be active in, what their targets are (and aren’t), hints about installed language support or keyboard layouts or preferred punctuation or localized representations of numbers. For example, you can tell here on Lemmy when someone uses different types of quotation marks a decent indication of what country that person might be from, even in a totally English language thread.

      • Kecessa@sh.itjust.worksEnglish
        10·
        3 months ago

        For more on that, go listen to Darknet Diaries, episodes where they talk about major hacks are great

  • BlackEco@lemmy.blackeco.comEnglish
    4·
    3 months ago

    Earlier this year, researchers from security firm Avast spotted a newer FudModule variant that bypassed key Windows defenses such as Endpoint Detection and Response, and Protected Process Light. Microsoft took six months after Avast privately reported the vulnerability to fix it, a delay that allowed Lazarus to continue exploiting it.

    Dammit Microsoft, you only had one job!