A lot of focus on the malware itself, but not so much on the misconfigurations and vulnerabilities which enable it. Would love to see that list. Other than that, the evasion techniques look pretty traditional.
And of course the privilege escalation is done by a polkit vulnerability...
Comments
A lot of focus on the malware itself, but not so much on the misconfigurations and vulnerabilities which enable it. Would love to see that list. Other than that, the evasion techniques look pretty traditional.
And of course the privilege escalation is done by a polkit vulnerability...
It seems to be a RocketMQ vuln; it's described further down the page.
Also more interested in what the misconfigs are.