Week of March 18, 2024

Fortinet disclosed CVE-2023-48788, a critical SQL injection vulnerability in the FortiClient Enterprise Management Server (EMS) DAS component. The flaw allows unauthenticated remote attackers to execute arbitrary code via crafted requests. Active exploitation has been observed in the wild, with attackers using xp_cmdshell to run commands and download malware.

A new open-source evasion framework named HookChain has been published, designed to bypass Endpoint Detection and Response (EDR) solutions. It uses IAT hooking, dynamic system service number resolution, and indirect system calls to hide malicious payloads. The tool claims to evade detection by several major EDR products.

A new open-source tool called Misery Loader has been published on GitHub, designed to bypass modern EDR solutions. It implements techniques such as NTDLL unhooking, early bird injection, sandbox bypass via API hammering, and compile-time API hashing. The tool is intended for red team operations and demonstrates multiple evasion methods.

A new technique called Voidgate demonstrates bypassing AV/EDR memory scanners by keeping shellcode encrypted except for the single instruction currently executing. It uses hardware breakpoints and a vectored exception handler to decrypt and re-encrypt instructions on the fly. This renders memory scanning ineffective for the protected page, allowing known malicious shellcodes like msfvenom to evade detection.

Russian espionage group Turla compromised a European NGO, deploying the TinyTurla-NG (TTNG) implant. Attackers first added exclusions to Microsoft Defender to evade detection, then established persistence via a malicious service. They used Chisel for tunneling and lateral movement, repeating the process on new systems.