{"uuid": "83ac7183-fb80-4aff-92c1-d8f7d14062a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/3916", "content": "The malware started as a simple keylogger over five years ago (later became known as XLoader in February 2020,) and now can steal data from machines running macOS or Windows. XLoader is offered for purchase on multiple forums from prices ranging from $69 (USD) to $139 depending on the site and additional malware features. Formbook/XLoader is capable of keylogging, stealing credentials from web browsers, taking screenshots, and downloading and executing additional files per communication from a command and control server.\nAnalyst Comment: Information stealing is a common and prevalent threat facing individuals and organizations around the world. Education on frequently-used delivery methods such as malspam and phishing emails can help prevent infection. In addition, maintain efficient log management policies to identify potentially abnormal network activity.\nMITRE ATT&CK: [MITRE ATT&CK] Third-party Software - T1072\nTags: Info stealer, Formbook, XLoader, Windows, macOS\nWindows Elevation of Privilege Vulnerability\n(published: July 20, 2021)\nA new Windows 10 vulnerability, assigned CVE-2021-36934 and referred to as HiveNightmare/SeriousSAM, has been found to affect all Windows 10 versions beginning with build 1809. The issue arises from non-admin users being granted read access to any file in the %windir%\\system32\\config directory that can allow for local privilege escalation. If a virtual shadow copy [service] (VSS), which is a Microsoft Windows feature that can create backups or snapshots of files or volumes, of the system is available, a non-admin user can abuse these files for malicious activity.\nAnalyst Comment: Microsoft has issued workarounds for CVE-2021-36934, specifically, to run a command \u201cicacls %windir%\\system32\\config\\*.* /inheritance:e\u201d to delete VSS shadow copies. However, deleting shadow copies could negatively impact restoring operations for Microsoft and third-party services. Microsoft stated, \u201cYou must restrict access and delete shadow copies to prevent exploitation of this vulnerability.\u201d\nTags: Vulnerability, Windows 10, CVE-2021-36934, Privilege escalation\nNew Attacks on Kubernetes via Misconfigured Argo Workflow\n(published: July 20, 2021)\nA new attack vector has been discovered targeting Kubernetes (K8s) clusters through misconfigured Argo Workflows instances, according to Intezer researchers. Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes, according to its documentation. One misconfigured Argo Workflows cluster was found to running a kannix/monero cryptocurrency miner.\nAnalyst Comment: As any system that stores potentially sensitive information, cloud containers need to be configured properly to avoid threat actors from targeting them. Ensure that environments have security policies in place, such as the principle of least privilege, to ensure that permissions are only granted to those on a need-access basis.\nMITRE ATT&CK: [MITRE ATT&CK] Valid Accounts - T1078 | [MITRE ATT&CK] Resource Hijacking - T1496\nTags: Misconfigured, Cryptomining\nDebugging MosaicLoader, One Step at a Time\n(published: July 20, 2021)\nBitdefender researchers have reported their findings on a new malware family dubbed MosaicLoader. The malware was discovered when researchers noticed \u201cprocesses that add local exclusions in Windows Defender for specific file names (prun.exe, appsetup.exe, etc.), that all reside in the same folder, called \\PublicGaming\\.\u201d The malware is delivered through archives masquerading as cracked software installers. That threat actors are then purchasing Google search engine results to boost their malicious archives\u2019 visibility and potential delivery. MosaicLoader can deliver any other kind of malware and utilizes a unique obfuscation technique that shuffles code chunks creating a mosaic-like structure.\nAnalyst Comment: Cracked software is a well-known and common delivery method for malicious payloads or first-stage infections.", "creation_timestamp": "2026-09-02T01:04:31.822769Z"}