Week of May 20, 2024

BOAZ is a modular evasion framework that combines signature, heuristic, and behavioral bypass techniques to generate undetectable payloads. It was tested against 14 desktop AVs and 7 EDRs, including Sophos, Windows Defender, and ESET. The tool serves as both an evasion testing utility and a packer/obfuscator for researchers.

A state-sponsored threat actor compromised MITRE's NERVE network via Ivanti zero-days, then abused VMware VPXUSER privileged account to create rogue VMs directly on ESXi hypervisors, evading vCenter detection. The actor deployed BRICKSTORM backdoor and BEEFLUSH web shell for persistence and C2. This technique bypasses centralized management visibility, allowing stealthy operations.

A sophisticated cryptojacking campaign named GHOSTENGINE leverages vulnerable drivers to terminate endpoint detection and response (EDR) processes before deploying a cryptocurrency miner. The attack demonstrates a practical method for defeating security agents through BYOVD (Bring Your Own Vulnerable Driver) techniques.

Tenable Research discovered a critical memory corruption vulnerability in Fluent Bit's built-in HTTP server, tracked as CVE-2024-4323. The flaw arises from improper validation of input data types in the /api/v1/traces endpoint, potentially leading to denial of service, information disclosure, or remote code execution. Fluent Bit is widely used in cloud monitoring infrastructures, with over 3 billion downloads.