Red Teaming & Jazz: Creativity as a Service
Red Teaming & Jazz: Creativity as a Service Foreword I had been missing on this blog for a bit and I told myself it was time to go back to writing something. If in the previous article (here is the link) I wanted to make a sort of small professional contribution to the sector, in this case...
Elons (Proxima/Black Shadow related) ransomware attack via Oracle DBS External Jobs
Premise As Yarix’s Incident Response Team, our responsibilities are to manage critical issues related to cyber-attacks carried out by cybercriminals, intervening promptly in order to guarantee security to victim companies and to minimize latent risks, analyzing the systems within their infrastructures and indicating precise remediation actions capable of re-establishing a state of security sufficient for normal...
Doppelganger: An Advanced LSASS Dumper with Process Cloning
Github Repo: https://github.com/vari-sh/RedTeamGrimoire/tree/main/Doppelganger What is LSASS? The Local Security Authority Subsystem Service (LSASS) is a core component of the Windows operating system, responsible for enforcing the security policy on the system. LSASS is a process that runs as lsass.exe and plays a fundamental role in: User authentication: It verifies users logging into the system, interacting with authentication protocols such as NTLM...
Behind The Scenes: Yarix Approach to Physical Security
TL;DR: In our experience, even organizations that you'd think are really solid often have serious gaps in their physical securitys—simply because they’ve never put their defenses to the test. And those that have invested heavily in technology frequently overlook the human factor, which remains one of the weakest links. In this post, we share a practical...
Inside the Attack: The Javascript Code Behind Credit Card Theft
Introduction This paper will describe the analysis of a JavaScript script found during the activities of the Incident Response Team. The script found turned out to be designed to steal credit card data to exfiltrate sensitive information during online transactions on an e-commerce site. The script was later found to be connected to a type of...
The rise of Savastan0: a look into a growing carding marketplace
Introduction Carding is a sort of fraud in which unauthorized individuals, referred to as "carders," utilize stolen payment card information for their own benefit. This can involve not only making unlawful withdrawals and transactions, but also selling card information to other criminals in order to make money. First of all, it is useful giving a look to...
Zyxel vulnerability exploited by “Helldown” ransomware group
Introduction As Yarix's Incident Response Team, our responsibilities are to manage critical issues related to cyber-attacks carried out by cybercriminals, intervening promptly in order to guarantee security to victim companies and to minimize latent risks, analyzing the systems within their infrastructures and indicating precise remediation actions capable of re-establishing a state of security sufficient for normal...
Behind The Scenes: Yarix Approach to Mobile Security
TLDR: This article highlights the Yarix Red Team’s daily challenges and internal work done to improve the quality of our outcomes. We will explore the topic by taking the Mobile Security field as a case: we will start with the common reporting problems every red team faces day after day, as well as those arising...