Security

Reconstructing an Akira Ransomware Kill Chain from Perimeter and Endpoint Logs, (Wed, May 27th)

Leave a comment
This post was originally published on this site

Most Akira write-ups focus on the ransom note or the encryption routine. By the time those show up the interesting forensic work is over. The questions that matter to defenders sit earlier. How did they get in. When did they get domain admin. What did they touch before the binary fired. Those answers live in the days before impact. They sit in two log sources that almost never get joined. The perimeter firewall and the Windows event channel.

Security

Possible ACR Stealer From Page Impersonating Claude, (Tue, May 26th)

Leave a comment
This post was originally published on this site

Introduction

In recent weeks, I've searched for pages impersonating Claude that distribute malware. In recent weeks, I've reliably found these sites through malicious ads in Google searches that lead to these pages, often concealed in URLs for sites.google[.]com, such as this example from 2026-05-11.

These fake Claude pages generally show instructions for macOS malware when viewed through a macOS system, and they will show instructions for Windows malware when viewed through a Windows system. Today's dairy shows an example of Windows malware from one of these pages seen on Monday, 2026-05-25. Based on the C2 domain for post-infection traffic, this appears to be an infection for ACR Stealer.

Images


Shown above: Web page impersonating Claude with a button to "Download for Windows."


Shown above: Instructions to install Claude on Windows are actually instructions that will infect a vulnerable computer with malware.


Shown above: Traffic from a Windows host when following instructions from the fake Claude download page.

Indicators of Compromise

Fake Claude download page:

  • hxxps[:]//fairpoint29.com/

From the above page, URL for the initial download:

  • hxxps[:]//primemetricsa[.]com/1518925

Follow-up download:

  • hxxps[:]//6ryuefl.creativecommunityinfo[.]art/Camel-91267b64-989f-49b4-89b4-9e015844d42d

A further download:

  • hxxps[:]//i.ibb[.]co/Xx16sbMz/init-block.jpg

Domain for post-infection HTTPS traffic to C2 server:

  • yw.enhanceblabber[.]cc

Initial download:

SHA256 hash: 70b5ecc110e074dbca92932c0e840ea3492ea0a43c3f215b71392c12b02213b2

  • File size: 2,416,902 bytes
  • File type: Zip archive data, at least v1.0 to extract
  • File location: hxxps[:]//primemetricsa[.]com/1518925
  • NOTE: There's an issue with this zip archive, so its contents will not extract correctly using typical extraction tools.

Follow-up download, PowerShell script:

SHA256 hash: a14c3ecf5eb3d2543358482e43dc765dbf9ee7a4bec7571f5ecb8829ca719692

  • File size: 4,177,395 bytes
  • File type: ASCII text, with very long lines, with CRLF line terminators
  • File location: hxxps[:]//6ryuefl.creativecommunityinfo[.]art/Camel-91267b64-989f-49b4-89b4-9e015844d42d

A further download:

SHA256 hash: 47fa746422f1bf6b7712dc6803378e6a995488007193a7441d790f70d204728f

  • File size: 628,035 bytes
  • File type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1×1, segment length 16, baseline, precision 8, 5256×5256, components 3
  • File location: hxxps[:]//i.ibb[.]co/Xx16sbMz/init-block.jpg
  • NOTE: This image doesn't appear to be malicious, nor could I find any obvious signs of embedded data, but it's somehow related to this infection chain.

—
Bradley Duncan
brad [at] malware-traffic-analysis.net

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Security

An Example of Stack String in High Level Language, (Sat, May 23rd)

Leave a comment
This post was originally published on this site

This week, I’m attending the SEC670[1] training (“Red Teaming Tools – Developing Windows Implants, Shellcode, Command and Control”). From my point of view, this training fits perfectly with FOR610 or FOR710 (malware analysis) because it addresses malware from the opposite: Instead of performing reverse engineering, you write malicious code! Always interesting to have another point of view.

Powershell

PowerShell is now notarized and hardened for macOS

Leave a comment
This post was originally published on this site

We’re excited to announce that the PowerShell packages for macOS are now properly notarized and
hardened, meeting both Apple’s security requirements and Microsoft’s internal compliance standards.

This has been one of the most consistently requested improvements from our macOS community, and
we’re glad to finally deliver it.

What changed

Starting with the next release, the PowerShell .pkg installer and tarball for macOS are:

  • Notarized by Apple — macOS no longer warns you that PowerShell is from an unidentified
    developer
  • Hardened — the PowerShell binary and its libraries are built with the security entitlements
    Apple recommends for distributed software

This update also includes a fix that properly sets the file permissions on files contained in the
tarball. These fixes are included in the next maintenance releases of PowerShell 7.4 and higher.

What this means for you

If you’ve been working around Gatekeeper warnings, adjusting security settings, running xattr
commands, or guiding users through extra steps to install PowerShell, you no longer need to.

For most users, no action is required. Install or update PowerShell as you normally would.

Documentation

For installation instructions and the latest release, see the Install PowerShell 7 on macOS.

Thank you

This work closes more than 14 long-standing GitHub issues. Thank you to everyone in the community
who filed issues, tested workarounds, and kept this on our radar.

Jason Helmick

Sr. Product Manager, PowerShell

The post PowerShell is now notarized and hardened for macOS appeared first on PowerShell Team.

Security

Selective HTTP Proxying in Linux, (Thu, May 21st)

Leave a comment
This post was originally published on this site

Recently, Rob wrote about a tool, Proxifier, that can intercept requests from specific processes. Proxifier is available for Windows, macOS, and Android. But I have not seen a generic Linux option yet. The advantage of a tool like Proxifier is the ability to target specific software. For debugging, reverse engineering, and similar tasks, selecting a specific process is quite useful, as it creates less noise to sift through and simplifies analysis.

Security

Simple bypass of the link preview function in Outlook Junk folder, (Thu, May 14th)

Leave a comment
This post was originally published on this site

Besides serving as a place where Microsoft Outlook places suspected spam, the Outlook Junk folder has one additional function that can be quite helpful when it comes to identifying malicious messages. Any e-mail placed in this folder is stripped of all formatting, and destinations of all links included in the message become visible to the user, as you can see in the following images which show the same e-mail when it is placed in the inbox, and when it is placed in the Junk folder.

AWS

Amazon Redshift introduces AWS Graviton-based RG instances with an integrated data lake query engine

Leave a comment
This post was originally published on this site

Since 2013, Amazon Redshift has given the full power of a data warehouse in the cloud, at a fraction of the on-premises cost. Every architectural generation—from dense compute to Amazon RA3 instances, from provisioned to Amazon Redshift Serverless—has made each query cheaper, faster, and more efficient than the last.

For over a decade, as data volumes have grown and analytics requirements have evolved, organizations increasingly leverage both data warehouse tables for structured, frequently-accessed data and data lakes for cost-effective storage of diverse datasets. Add AI agents to the mix and they query your data warehouse at a scale that dwarfs typical human usage, leading to spiraling operational costs.

Amazon Redshift has doubled down on its core strengths to meet the demands of any workload — whether driven by humans or AI agents. For example, in March 2026, Amazon Redshift improved the performance of business intelligence (BI) dashboards and ETL workloads by speeding up new queries by up to 7 times. This significantly improves the response times of low-latency SQL queries, such as those used in near-real-time analytics applications, BI dashboards, ETL pipelines, and autonomous, goal-seeking AI agents.

Today, we’re announcing Amazon Redshift RG instances, a new instance family powered by AWS Graviton. RG instances deliver better performance, running data warehouse workloads up to 2.2x as fast as RA3 instances at 30% lower price per vCPU. Their integrated data lake query engine lets you run SQL analytics across your data warehouse and data lake from a single engine with performance up to 2.4x as fast as RA3 for Apache Iceberg and up to 1.5x as fast as RA3 for Apache Parquet. This blend of speed, cost efficiency, and an integrated data lake query engine makes Redshift RG instances well-suited to handle the high query volumes and low-latency requirements of today’s analytics and agentic AI workloads.

You can compare new RG instances and current RA3 instances:

Current RA3 Instance Recommended RG instance vCPU Memory (GB) Primary Use Case
ra3.xlplus rg.xlarge 4 32 Small cluster departmental analytics
ra3.4xlarge rg.4xlarge 12 → 16 (1.33:1) 96 GB → 128 GB (1.33:1) Standard production workloads, medium data volumes

This approach reduces total analytics costs for customers running combined data warehouse and data lake workloads, while simplifying operations through a single system for querying both warehouse tables and Amazon Simple Storage Service (Amazon S3) data lakes. We recommend using the AWS Pricing Calculator with your specific workload patterns to estimate savings.

Getting started with Amazon Redshift RG instances
You can launch new clusters or migrate existing clusters through the AWS Management Console, AWS Command Line Interface (AWS CLI), or AWS API. The integrated data lake query engine is enabled by default.

In the Amazon Redshift console, you can choose new RG instances when you create a cluster.

You can migrate previous-generation instances to RG instances with optimal paths based on your cluster configuration to estimate costs, validate compatibility, and automate execution.

  • Elastic Resize—in-place migration with 10-15 minutes downtime for compatible configurations
  • Snapshot and Restore—create a RG cluster from an RA3 snapshot. This is best for customers who want to make configuration changes during the migration

Your external tables, schemas, and query syntax—including existing Spectrum queries—remain unchanged. There is no need to recreate external tables or modify application code. To learn more, visit the Redshift Management Guide.

Amazon Redshift now executes data lake queries on cluster nodes—the same compute that processes data warehouse workloads. As a result, Amazon Redshift Spectrum is no longer required. Data lake queries stay within your VPC boundary, use existing IAM roles, and incur zero per-terabyte scanning charges. This removes the $5/TB Spectrum scanning fees that previously added to total Redshift costs.

Now available
Amazon Redshift RG instances are now available in the following AWS Regions: US East (N. Virginia, Ohio), US West (N. California, Oregon), Asia Pacific (Hong Kong, Hyderabad, Jakarta, Malaysia, Melbourne, Mumbai, Osaka, Seoul, Singapore, Sydney, Taiwan, Tokyo), Canada (Central), Europe (Frankfurt, Ireland, Milan, London, Paris, Spain, Stockholm), Middle East (UAE), and South America (São Paulo). For Regional availability and a future roadmap, visit the AWS Capabilities by Region. For Redshift Provisioned, you can select On-Demand Instances with hourly billing and no commitments or choose Reserved Instances for cost savings. To learn more, visit the Amazon Redshift Pricing page.

Give RG instances a try in the Redshift console and send feedback to AWS re:Post for Amazon Redshift or through your usual AWS Support contacts.

— Channy