med-mastodon.com is one of the many independent Mastodon servers you can use to participate in the fediverse.
Medical community on Mastodon

Administered by:

Server stats:

411
active users

#powershell

7 posts6 participants1 post today

COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs

Russian government-backed threat group COLDRIVER has developed a new malware called LOSTKEYS, capable of stealing files and system information. The group targets high-profile individuals, NGOs, and former intelligence officers through credential phishing and malware delivery. LOSTKEYS is delivered through a multi-step infection chain, starting with a fake CAPTCHA and involving PowerShell commands. The malware evades detection in VMs and uses a substitution cipher for decoding. COLDRIVER's primary goal is intelligence collection for Russia's strategic interests, targeting Western governments, militaries, journalists, and Ukraine-related individuals. The group has been linked to hack-and-leak campaigns in the UK and against NGOs.

Pulse ID: 681ba0e01c36344c7ac60892
Pulse Link: otx.alienvault.com/pulse/681ba
Pulse Author: AlienVault
Created: 2025-05-07 18:05:20

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

I have a dream. [No, nothing that earthshaking or inspiring.]

Picture a tool that could use ssh and winrm to pull all scheduled tasks, systemd timers and cronjobs, and put them on a time line.

So you could see where your backups overlap, or if half your machines are all downloading something at the same time...

Anybody seen any sort of a 'time line builder' kind of thing? Getting the data is a secondary issue, if I could easily display it sanely.

I finally figured out how to automate a certificate request on #Windows that also requires the csr to be signed by a user certificate. Man alive, it should not be that difficult.

As far as I can tell, certreq has no ability to do this natively, so I ended up using certreq to generate the initial csr, then leveraging the COM object to sign it, then back to certreq again for the actual submission/ acceptance.

If you know of a way to do this easier, please let me know!

I've come to the conclusion that the command line is peak UI. It's fast, and it doesn't freeze as often. I had an issue where I tried to delete a task in the Windows Task Scheduler and every time I would try, the UI froze on me. I piped the below into Powershell and it was deleted! No lag, no nothing!

Unregister-ScheduledTask -TaskName "RClone Backup Writings"