1
Malware in Panda Image Hides Persistent Linux Threat - "This technique isn’t steganography but rather polyglot file abuse or malicious file embedding. " - ignore the AI (www.aquasec.com)
submitted 1 year ago by to c/blueteamsec@infosec.pub
comment fedilink hide all child comments

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
8 comments in c/cybersecurity@infosec.pub view that post
[–] 13 points 1 year ago (1 child)

Researchers from AquaSec have noted its ability to automatically switch to backup mining pools if a primary one becomes unavailable, ensuring continuous operation. This level of sophistication has led security experts to believe that large language models or other automation frameworks may have played a role in its development.

Is it just me or is this not a very convincing rationale.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 4 points 1 year ago

    Not whatsoever.

    Practically any mining software would allow you to change a pool whenever you felt like it, and making a script that just goes "oh, x.x.x.x isn't responding anymore, I should point my hashrate to y.y.y.y now" is... not hard, to say the least.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 4 points 1 year ago

    ...and this is where sanitizing inputs becomes even more important...

  • permalink
  • fedilink
  • source
    •
    [+] 1 point 1 year ago (1 child)
    [deleted]
  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 1 point 1 year ago* (last edited 1 year ago)

    "Impersonation and psychological warfare will be a big thing in the coming years," warns Rem Dudas from Palo Alto Networks, noting how AI enables malware to mimic other threat actors' techniques

    Might be <%your country%>?

    AquaSec identified Serbia-based IP addresses used in the attacks, Serbian phrases in the scripts, and Slovak language in the GitHub repository hosting the miners, but it could make no confident attribution.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 0 points 1 year ago (2 children)

    What the fuck are polyglot files and whoever the fuck thought it was a good idea to invent stuff like that?

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 7 points 1 year ago

    It's just a consequence of independent file formats. There's bound to be overlap in what counts as technically a valid X and also technically a valid Y. It's pretty much unavoidable. The tricky part is figuring out what fits in that sliver of the venn diagram but is also useful as malware.

  • permalink
  • fedilink
  • source
  • parent