Connect with us

Press Release

You become infected with RedLine malware through fake Windows 11 upgrade installers.

Published

on

You become infected with RedLine malware through fake Windows 11 upgrade installers.

Users of Windows 10 have begun to get phoney Windows 11 upgrade installers, tricking them into downloading and running RedLine stealer software.

The attacks took place at the same time that Microsoft announced the broad deployment phase for Windows 11. As a result, the attackers were well-prepared for this move and waited for the ideal time to maximise the effectiveness of their operation.

As the most extensively used password, browser cookie, credit card, and cryptocurrency wallet information thief at the moment, RedLine stealer infections can have serious negative effects on the victims.

The initiative

The attackers exploited the “windows-upgraded.com” domain for the malware distribution portion of their campaign, according to HP experts who have detected this effort.

When a visitor selected the “Download Now” button on the website, a 1.5 MB ZIP archive with the name “Windows11InstallationAssistant.zip” was downloaded directly from a Discord CDN. The website looks to be an official Microsoft website.

Decompressing the file yields a folder with a size of 753MB and a remarkable compression ratio of 99.8%, which was made possible by the executable’s inclusion of padding.

An encoded parameter starts a PowerShell process when the victim runs the programme in the folder.

A.jpg file is then retrieved from a distant web server when a cmd.exe process with a 21-second timeout has finished running.

The DLL in this file is organised in reverse, maybe to avoid detection and analysis.

The first process then loads the DLL and swaps it out for the current thread context. That DLL is a RedLine stealer payload that uses a TCP connection to communicate with the command-and-control server to receive instructions on what malicious operations should be performed next on the recently compromised system.

Outlook
Nothing prevents the actors from registering a new domain and continuing their campaign even though the distribution site is currently unavailable. In fact, it’s quite likely that this is already taking place in nature.

Due to hardware compatibility issues, many Windows 10 customers are unable to download Windows 11 via the official distribution channels. Malware operators see this as a great opportunity to recruit new victims.

The strategies disclosed by HP are not surprising at this time, as threat actors are also use Windows’ legitimate update clients to execute malicious code on compromised Windows systems, as BleepingComputer discovered in January.

Remember that these risky websites are advertised through forum postings, posts on social media, and instant messages, so only rely on the official Windows upgrade system alerts.

Continue Reading

Press Release

Russian processor manufacturers are prohibited from using ARM because of UK sanctions.

Published

on

Russian processor manufacturers are prohibited from using ARM because of UK sanctions.

On Wednesday, the UK government expanded its list of sanctioned Russian organisations by 63. The two most significant chip manufacturers in Russia, Baikal Electronics and MCST (Moscow Center of SPARC Technologies), are among them.

Since the licensee, Arm Ltd., is situated in Cambridge, England, and must abide by the penalties, the two sanctioned firms will now be denied access to the ARM architecture.

contacting inactive entities

The UK government provided the following justification for the restrictive measures put in place against Baikal and MCST:

The clause’s goal is to persuade Russia to stop acting in a way that threatens Ukraine’s territorial integrity, sovereignty, or independence or that destabilises Ukraine.

The two companies are important to Russia’s ambitions to achieve technical independence since they are anticipated to step up and fill the gaps left by the absence of processors built by Western chip manufacturers like Intel and AMD.

The two currently available most cutting-edge processors are:

Eight ARM Cortex A57 cores running at 1.5 GHz and an ARM Mali-T628 GPU running at 750 MHz make up the 35 Watt Baikal BE-M1000 (28nm) processor.
MCST Elbrus-16S (28nm), a 16-core processor clocked at 2.0 GHz, is capable of 1.5 TFLOP calculations, which is a tenth of what an Xbox Series X can do. Baikal BE-S1000 (16nm), a 120 Watt processor featuring 48 ARM cores clocked at 2.0 GHz, MCST Elbrus-8C (28nm), a 70 Watt processor featuring eight cores clocked at 1.3 GHz,
Russian businesses and organisations that evaluated these chips in demanding applications claim that they fall short of industry standards and are even unacceptably priced.

Although the performance of these processors and the far poorer mid-tier and low-tier chips with the Baikal and MCST stickers is not very spectacular, they could keep some crucial components of the Russian IT sector operating amid shortages.

In reality, MCST recently bragged that it was “rushing to the rescue” of vital Russian enterprises and organisations, successfully filling the void left in the domestic market.

sanctions’ effects
Given that Russia has previously demonstrated its willingness to relax licencing requirements in order to mitigate the consequences of Western-imposed limitations, it is simple to discount the application and impact of the UK’s sanctions.

It is crucial to keep in mind that the Baikal and MCST processors are produced in foreign foundries, such as those owned by Samsung and TSMC, and that neither of them would violate Arm’s licencing policies or international law to serve Russian objectives.

The only option is to bring the production home and break the law as Baikal, which has a legitimate licence to produce at 16nm, only has a design licence for its next products.

The fact that chip fabrication in Russia can only now be done at the 90nm node level presents yet another significant issue. That was the same technology NVIDIA employed in 2006 for its GeForce 7000-series GPUs.

To combat this in April 2022, the Russian government has already approved an investment of 3.19 trillion rubles (38.2 billion USD), although increasing domestic production will take many years. In the best-case scenarios, 28nm circuits will be able to be produced by Russian foundries by 2030.

Continue Reading

Press Release

PE firm Insight Allies spends $290M for a bulk risk in CivicPlus, which provides software and also various other innovation to greater than 4,000 municipal governments (AJ Dome/Manhattan Mercury).

Published

on

PE firm Insight Allies spends

PE firm Insight Partners invests $290M for a majority stake in CivicPlus, which provides software and other technology to more than 4,000 municipal governments (AJ Dome/Manhattan Mercury)

AJ Dome / Manhattan Mercury:
PE firm Insight Partners invests $290M for a majority stake in CivicPlus, which provides software and other technology to more than 4,000 municipal governments  —  A Manhattan software business owner says a multimillion-dollar investment into the company will not change the company’s makeup.

Continue Reading

Press Release

EXAMINING THE LINKS BETWEEN THE RATIONALIST COMMUNITY, WITH SLATE STAR CODEX BLOG AS ITS EPICENTER, AND INFLUENTIAL LEADERS IN TECH, INCLUDING OPENAI’S FOUNDERS (CADE METZ/NEW YORK TIMES)

Published

on

EXAMINING THE LINKS BETWEEN THE RATIONALIST COMMUNITY

Examining the links between the Rationalist community, with Slate Star Codex blog as its epicenter, and influential leaders in tech, including OpenAI’s founders  —  Slate Star Codex was a window into the psyche of many tech leaders building our collective future.  Then it disappeared.

Continue Reading

Trending