Technical

[Asyn]

Shadow Attacks: Hiding and Replacing Content in Signed PDFs (July 2020)
https://pdf-insecurity.org/index.html
https://pdf-insecurity.org/signature-shadow/evaluation_2020.html
https://pdf-insecurity.org/download/report-pdf-signatures-2020-03-02.pdf

[Asyn]

SharePoint and Pwn :: Remote Code Execution Against SharePoint Server Abusing DataSet
https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html

[Asyn]

A vigilante is sabotaging the Emotet botnet by replacing malware payloads with GIFs
https://www.zdnet.com/article/a-vigilante-is-sabotaging-the-emotet-botnet-by-replacing-malware-payloads-with-gifs

[Asyn]

Prometei botnet and its quest for Monero
https://blog.talosintelligence.com/2020/07/prometei-botnet-and-its-quest-for-monero.html

[Asyn]

Ensiko: A Webshell With Ransomware Capabilities
https://blog.trendmicro.com/trendlabs-security-intelligence/ensiko-a-webshell-with-ransomware-capabilities/

[Asyn]

Lazarus on the hunt for big game
https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/

[Asyn]

Watch Your Containers: Doki Infecting Docker Servers in the Cloud
https://www.intezer.com/container-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/

[Asyn]

Telling China’s Story: The Chinese Communist Party’s Campaign to Shape Global Narratives
https://fsi-live.s3.us-west-1.amazonaws.com/s3fs-public/sio-china_story_white_paper-final.pdf

[Asyn]

CVE-2020–9934: Bypassing the macOS Transparency, Consent, and Control (TCC) Framework for unauthorized access to sensitive user data
https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consent-and-control-tcc-framework-for-4e14806f1de8

[Asyn]

UAC bypass via dll hijacking and mock directories
http://daniels-it-blog.blogspot.com/2020/07/uac-bypass-via-dll-hijacking-and-mock.html

[Asyn]

Take a “NetWalk” on the Wild Side
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/take-a-netwalk-on-the-wild-side

[Asyn]

Malware Analysis Report (AR20-216A)
MAR-10292089-1.v1 – Chinese Remote Access Trojan: TAIDOOR
https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a

[Asyn]

WastedLocker’s techniques point to a familiar heritage
https://news.sophos.com/en-us/2020/08/04/wastedlocker-techniques-point-to-a-familiar-heritage/

[Asyn]

What to do about the BootHole vulnerability
https://blog.avast.com/an-overview-of-the-boothole-vulnerability-avast
https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/

[bob3160]

What to do about the BootHole vulnerability
https://blog.avast.com/an-overview-of-the-boothole-vulnerability-avast
https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/

There's nothing to do till sometime next year.