In Caracas this week, President Nicolás Maduro unveiled the Huawei Mate X6 gifted by China’s Xi Jinping, declaring the device impervious to U.S. espionage efforts.

The announcement coincides with heightened tensions between Washington and Beijing, as the United States enforces stringent controls on Chinese telecom equipment.

Beyond its political symbolism, the Mate X6 has become the focal point of a technical debate within cybersecurity circles regarding its purported resilience against sophisticated intrusion techniques.

Initial reports describe a novel strain of firmware-level malware—codenamed SpecterShell—that emerged in early August and targets high-end Android devices.

SpecterShell exploits a custom bootloader vulnerability, intercepting system calls before the operating system kernel initializes.

By tampering with the boot sequence, the malware can implant a rootkit that remains invisible to standard antivirus solutions.

Reuters analysts noted this capability allows SpecterShell to execute privileged code and bypass Android’s verified boot mechanism.

SpecterShell’s attack vectors include compromised supply chain updates and malicious over-the-air packages.

In a typical scenario, an adversary intercepts an update server request, replaces a legitimate firmware image with a tainted one, and signs it using a stolen developer certificate. Devices that accept the replacement image become permanently backdoored.

The stealth and persistence of SpecterShell have prompted governments and private security firms to reassess trust in firmware signing infrastructures, as even encrypted channels can be subverted at this low level.

The impact of SpecterShell extends beyond individual privacy. Compromised devices can be conscripted into botnets for distributed denial-of-service campaigns or leveraged for corporate espionage by exfiltrating sensitive communications.

Despite Huawei’s insistence on rigorous internal security audits, external researchers have raised concerns about potential hidden capabilities, especially given the company’s history of state mandates to collaborate with national intelligence services if obligated.

Infection Mechanism

SpecterShell’s infection mechanism hinges on exploiting the Verified Boot chain of trust. Upon device startup, the bootloader normally verifies the integrity of each stage—bootloader, boot image, and system partitions—using cryptographic signatures.

SpecterShell circumvents this by patching the bootloader’s verification routine in memory, redirecting signature checks to a malicious handler.

A simplified pseudocode illustration of the patch is shown below:-

// Simplified SpecterShell bootloader patch
int verify_partition(char* partition, uint8_t* signature) {
    if (strcmp(partition, "boot") == 0) {
        // Bypass signature check for boot partition
        return SUCCESS;
    }
    return original_verify(partition, signature);
}

This snippet demonstrates how SpecterShell conditionally bypasses authentication only for critical partitions, preserving system functionality while embedding a durable rootkit.

By intercepting partition verification at runtime, it leaves no forensic trace on disk, complicating detection and removal efforts.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Venezuela’s Maduro Says Huawei Mate X6 Gift From China is Unhackable by U.S. Spies appeared first on Cyber Security News.

Security researchers first observed LunaLock in early September 2025, a sophisticated ransomware strain targeting independent illustrators and digital artists.

Leveraging compromised credentials and social engineering, the group behind LunaLock has zeroed in on a niche marketplace—Artists & Clients—where freelance creators exchange custom commissions.

Initial intrusion involved spear-phishing campaigns disguised as royalty notifications, enticing victims to download trojanized ‘invoice’ attachments.

Once executed, the payload establishes a foothold and begins reconnaissance of art assets and client databases, all while preparing for rapid encryption.

VenariX analysts identified LunaLock’s multi-stage deployment after correlating unusual outbound HTTP requests from artist workstations with the timing of mass file encryption.

Their telemetry revealed that the malware extracts user tokens from Microsoft Teams and Slack clients, allowing lateral movement across shared design repositories and project management platforms.

Victims report encrypted source PSD and AI files with a unique “.lunalock” extension appended to filenames, accompanied by a ransom note demanding payment in Monero.

The ransomware’s impact extends beyond data encryption: stolen artwork is exfiltrated to a remote command-and-control server before victims receive decryption keys, creating dual leverage.

Publicly disclosed samples show a modular architecture featuring plugins for network propagation, credential theft, and evasion of endpoint detection systems.

A notable innovation is the integration of a minified JavaScript module that disables Windows Defender real-time scanning processes by injecting into the Service Control Manager.

Infection Mechanism

A deep dive into LunaLock’s infection mechanism uncovers a custom loader that dynamically resolves Win32 API calls to evade static analysis.

Upon execution, the loader parses its own PE header to locate the IAT and reconstruct API names using an XOR-based obfuscation key. Once the resolve function is in place, the main payload is mapped into memory without ever touching the disk:

// Dynamic API resolution snippet
BYTE obfName[] = {0x5F,0x23,0xA7,0x19}; // XOR key
for (DWORD i = 0; i < nameLen; ++i) {
    nameBuf[i] = obfName[i] ^ encName[i];
}
HMODULE hMod = LoadLibraryA("kernel32.dll");
FARPROC pFunc = GetProcAddress(hMod, nameBuf);

Following resolution, LunaLock establishes persistence by creating a hidden Scheduled Task named “SysUpdate,” ensuring execution at every reboot.

The loader then signals the C2 server via HTTPS, confirming successful deployment before initiating AES-256 encryption across mapped network drives.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post LunaLock Ransomware Attacking Artists to Steal and Encrypt Data appeared first on Cyber Security News.

A massive data breach in early September 2025 attributed to a cyber actor known simply as “Kim” laid bare an unprecedented view into the operational playbook of Kimsuky (APT43).

The leak, comprising terminal history files, phishing domains, OCR workflows, compiled stagers, and a full Linux rootkit, revealed a credential-centric campaign that targeted South Korean government PKI systems and Taiwanese academic networks.

The artifacts include bash histories that showcase iterative shellcode development with NASM, alongside OCR commands used to extract configurations from Korean-language PDF documents related to PKI and VPN deployments.

The scope of the breach highlights an evolution in technique, blending old-school rootkit persistence with sophisticated adversary-in-the-middle phishing infrastructure.

Domaintools analysts identified evidence of domain telemetry pointing to a sprawling network of malicious sites mimicking official Korean portals, including nid-security.com and webcloud-notice.com.

These sites employed real-time TLS proxies to intercept credentials, a marked shift from document-based harvesting toward active AiTM interception.

The dump further contained PAM logs detailing administrative password rotations—tagged 변경완료 (“change complete”)—for high-privilege accounts such as oracle, svradmin, and app_adm01. Plaintext GPKI key files like 136백운규001_env.key confirmed direct compromise of South Korean government cryptographic assets.

Beyond South Korea, Domaintools researchers noted that the actor conducted targeted reconnaissance of Taiwanese government and research institutions, accessing .git directories to enumerate exposed source repositories and harvest embedded secrets.

IP addresses such as 163.29.3.119 and 118.163.30.45, registered to Taiwanese government backbones, underscore deliberate supply-chain probing.

The presence of burner email addresses linked to phishing kits, alongside logs of reconnaissance against gitee.com and baidu.com, reflects a hybrid DPRK–PRC footprint that leverages Chinese infrastructure for staging and evasion.

Infection Mechanism

A closer examination of the malware’s infection mechanism reveals a two-stage loader that combines custom shellcode with publicly available frameworks.

The initial payload is a handcrafted NASM shellcode stub compiled with flags like -f win32, designed to allocate memory via VirtualAlloc and resolve Win32 API calls through hashed import tables:-

; start.asm
BITS 32
extern VirtualAlloc
section .text
_start:
    push 0
    push 4096
    push 0x3000
    push -1
    call [VirtualAlloc]
    ; Hash API resolution and payload injection follows

Once memory is allocated, the loader decrypts and patches a secondary payload—often a CobaltStrike-derived stager—into the process before transferring execution.

This approach evades signature-based detection, as the shellcode is polymorphic and the API calls are obfuscated by simple XOR hashing routines.

Persistence is achieved through a bespoke Linux rootkit, vmmisc.ko, which hooks syscalls such as read and getdents to conceal files, directories, and network sockets.

Upon insertion via insmod /usr/lib64/tracker-fs/vmmisc.ko, the rootkit decompresses an embedded userland backdoor binary, then installs a SOCKS5 proxy and PTY-based reverse shell protected by a passphrase (testtest).

The rootkit’s dual-mode binary embedding technique merges the kernel module and userland executable, leaving only the .ko file on disk to thwart forensic discovery.

This infection chain underscores a blend of manual tool assembly and opportunistic use of open-source repositories such as TitanLdr and Blacklotus, demonstrating Kimsuky’s growing sophistication.

Organizations across South Korea and Taiwan must now anticipate multi-stage, credential-first attacks that combine low-level shellcode engineering with stealthy kernel-mode implants.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Exposed ‘Kim’ Dump Exposes Kimsuky Hackers New Tactics, Techniques, and Infrastructure appeared first on Cyber Security News.

A sophisticated cybercriminal campaign has emerged, exploiting Amazon’s Simple Email Service (SES) to orchestrate large-scale phishing operations capable of delivering over 50,000 malicious emails daily.

The attack represents a significant evolution in cloud service abuse, transforming AWS’s legitimate bulk email platform into a weapon for credential theft and financial fraud.

The campaign begins with compromised AWS access keys, obtained through common attack vectors including accidental public exposure in code repositories, misconfigured cloud assets, or theft from developer workstations.

Once adversaries secure these credentials, they immediately probe the environment using GetCallerIdentity requests to assess available permissions, specifically targeting accounts with SES-related naming conventions that indicate email service access.

Wiz.io researchers identified this May 2025 campaign after detecting unusual patterns in AWS API activity across multiple regions.

The attackers demonstrated remarkable sophistication by implementing a multi-regional approach, simultaneously issuing PutAccountDetails requests across all AWS regions within seconds to escape SES’s default “sandbox” restrictions.

This technique, previously undocumented in security literature, allows threat actors to bypass the standard 200-email daily limit and unlock production mode capabilities.

The phishing infrastructure targets victims with convincing tax-related content, employing subject lines such as “Your 2024 Tax Form(s) Are Now Ready to View and Print” to maximize engagement rates.

These messages redirect users to credential harvesting sites hosted at domains like irss.securesusa.com, utilizing commercial traffic analysis services to obfuscate malicious infrastructure and evade traditional security scanners.

Technical Infrastructure and Evasion Mechanisms

The attackers establish their email infrastructure through systematic domain verification using the CreateEmailIdentity API.

They register both attacker-controlled domains including managed7.com, street7news.org, and docfilessa.com, alongside legitimate domains with weak DMARC configurations that facilitate email spoofing.

Each verified domain supports multiple email addresses using standard prefixes like admin@, billing@, and noreply@ to appear legitimate in recipient inboxes.

The campaign’s technical sophistication extends to automated privilege escalation attempts.

When standard production quotas proved insufficient, attackers programmatically created support tickets through the CreateCase API and attempted to establish IAM policies named “ses-support-policy” to gain enhanced permissions.

Although these elevation attempts failed due to insufficient privileges, the 50,000-email daily quota remained adequate for their operational requirements.

This SES abuse campaign demonstrates how cloud services designed for legitimate business purposes can be weaponized at scale, highlighting the critical need for enhanced monitoring of dormant access keys and unusual cross-regional API activity patterns in cloud environments.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Hackers Weaponize Amazon Simple Email Service to Send 50,000+ Malicious Emails Per Day appeared first on Cyber Security News.

Cybersecurity researchers have demonstrated a sophisticated technique for bypassing Web Application Firewalls (WAFs) using JavaScript injection combined with HTTP parameter pollution, exposing critical vulnerabilities in modern web security infrastructure.

The research, conducted during an autonomous penetration test, revealed how attackers can exploit parsing differences between WAF engines and web application frameworks to execute malicious code despite strict security configurations.

The vulnerability emerged during testing of an ASP.NET application protected by a highly restrictive WAF.

While the underlying Cross-Site Scripting (XSS) vulnerability was straightforward, involving breaking out of a JavaScript string delimited by single quotes, conventional XSS payloads were effectively blocked by the security system.

This scenario presented researchers with a classic challenge: demonstrating exploitability when defensive mechanisms actively prevent traditional exploitation methods.

The breakthrough came through understanding ASP.NET’s unique parameter handling behavior. When multiple HTTP parameters share the same name, ASP.NET concatenates their values using commas through the HttpUtility.ParseQueryString() method.

This documented Microsoft behavior states that “multiple occurrences of the same query string parameter are listed as a single entry with a comma separating each value.”

Ethiack analysts identified this parsing discrepancy as the key to bypassing WAF detection while maintaining valid JavaScript execution.

The attack leverages JavaScript’s comma operator, which allows multiple expressions to execute sequentially within a single statement.

By distributing malicious code across multiple parameters, researchers could construct payloads that appear benign individually but combine to form executable JavaScript.

For instance, the query string /?q=1'&q=alert(1)&q='2 becomes 1',alert(1),'2 after ASP.NET processing, creating syntactically valid JavaScript that executes the alert function when inserted into vulnerable contexts.

Technical Analysis and WAF Evasion Mechanisms

The research methodology involved testing 17 different WAF configurations across major cloud providers and security vendors, revealing significant disparities in detection capabilities.

The testing employed three distinct payload types, each demonstrating increasing sophistication in evasion techniques.

Framework parameter pollution behavior:-

The most revealing finding emerged from payload complexity analysis. Simple injection attempts achieved only a 17.6% bypass rate against tested WAFs, while sophisticated parameter pollution techniques reached 70.6% success rates.

The research identified three primary reasons for WAF vulnerability: individual parameter analysis without relationship understanding, lack of framework-specific parsing simulation, and reliance on traditional XSS signatures that miss functionally equivalent but structurally different payloads.

Payload effectiveness analysis:-

Autonomous testing systems demonstrated remarkable adaptability, discovering previously unknown bypasses for supposedly secure configurations.

Notably, Azure WAF was defeated using the payload test\\';alert(1);//, which exploits parsing discrepancies in escaped character handling between WAF pattern matching and JavaScript interpretation.

The research underscores the critical need for WAFs to implement framework-specific parsing logic and context-aware analysis capabilities, though such enhancements would significantly impact performance in production environments.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Researchers Bypassed Web Application Firewall With JS Injection with Parameter Pollution appeared first on Cyber Security News.