Windows-Malware · CuraSec

tag: Windows-Malware · 2 items

Engineer — Learn: Novel DLL side-loading backdoor with a magic-packet trigger and custom bytecode interpreter — no KEV, PoC, or active exploitation reported. Worth understanding the side-loading pattern to evaluate unsigned DLL monitoring and application allowlisting posture, but no immediate patch or config change is required.
SOC/IR — Learn: The dormant-until-triggered approach and custom bytecode execution are evasion techniques worth noting for future DLL side-loading hunt logic, but no IOCs, campaign attribution, or active exploitation are documented in this single-researcher report — nothing actionable to hunt or tune against today.
Leader — Skip

Engineer — Learn: No patch or configuration action required; this is a delivery-side evasion technique exploiting the browser as an assembler using Bun runtime, relevant for understanding how malware bypasses file-hash detections on endpoints you defend.
SOC/IR — Plan: Build or tune detections for Bun runtime executing assembled payloads and browser-initiated process chains; hunt for SourTrade IOCs published by Confiant since late 2024, focusing on impersonation of TradingView, Solana, and Luno lures in web traffic and endpoint telemetry.
Leader — Skip