Podcast Detail

SANS Stormcast Wednesday, July 29th, 2026: AutoIT Payload Injector; Appele Patches; SourTrade Malware; NGINX Exploit

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10028.mp3

previous
Podcast Logo
AutoIT Payload Injector; Appele Patches; SourTrade Malware; NGINX Exploit
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Wednesday, July 29th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu undergraduate certificate program in applied
 cybersecurity. Well, and AutoIT is back. I'm not sure
 if it ever left, but Xavier found an AutoIT sample that
 actually sort of has a new trick up its sleeve. Xavier
 noticed a large number of emails, that's of these fake
 bank emails that claim to have some kind of statement,
 account details also attached. That's a RAR file. Now, once
 unpacked, and then it turns out that there is several
 levels of PowerShell obfuscation to go through in
 this particular script. But what you end up with in the
 end is a PowerShell script that is interesting because it
 will actually inject shell code into a binary. The binary
 that's being used here is charmap.exe. If you're not
 familiar with Windows, it's like the little sort of
 keyboard picker that you have as an option to basically
 select some of the less used characters if you ever would
 like to type them. Now, it launches charmap.exe and then
 injects the malicious shell code in it, basically sort of
 using it as a vessel to hide the malicious activity.
 Interesting kind of strategy. And of course, we have seen
 similar sort of shell code injections in different tools
 before, but using scripting language like auto IT for it.
 And to me, at least, the use of charmap.exe is also kind of
 unique here. And probably they're using this tool
 because it's not that often used, but also does not
 necessarily raise a suspicion if it's running on a system.
 And Apple yesterday did its usual update of everything.
 And with this did again patch multiple security
 vulnerabilities, close to 200 if you sort of count across
 the different operating systems. There are updates now
 for iOS, macOS, iPadOS, tvOS, watches, essentially anything
 Apple publishes. So we are now up to iOS and macOS version 26
 .6. And we also got updates for macOS 14 and 15. The
 vulnerabilities themselves are not very remarkable. It's sort
 of the usual mix that they get from Apple. What's sort of
 interesting is that there's actually no zero date this
 time, nothing that is already being exploited. The number is
 a little bit higher than what we have seen sort of in prior
 similar releases. Also, remember, that was a few weeks
 ago, sort of a just security release without any functional
 updates that was sort of released to patch more
 vulnerabilities. There's certainly a little bit of
 impact here of sort of not AI reported vulnerabilities, but
 overall, it's not as drastic as we have seen it from other
 companies like Microsoft or Oracle lately. Maybe Apple is
 a little bit still behind here and sort of picking up on the
 AI stuff or maybe some of the minor vulnerabilities were not
 included here. Can't really tell from the release. As
 usual, the descriptions are very short. And Confiant, a
 company that is dealing with intelligence and information
 around advertising risks, so malware-like, has published a
 blog post with an interesting piece of malware that they're
 calling sour trade. Now, where sour trade is different is how
 it actually creates the malware on the victim's
 system. It starts out with the usual, it's malware-tizing,
 particular crypto traders are being targeted here, not with
 the usual crypto scams, but instead with malware. When the
 malware starts to get downloaded, it first downloads
 a configuration file. This configuration file does
 actually install or deliver a unique seed that's then being
 used to create a pseudorandom stream of bytes that is then
 being used to decrypt the malware as it's being pulled
 from various servers and then assembled in the client. Now,
 with this particular technology, the attacker is
 able to essentially deliver a unique byte stream to every
 victim. And that, of course, makes it more difficult to
 detect this attack on the network. And also, since it's
 assembled then in the browser on the endpoint, that makes it
 a bit more difficult for any endpoint protection products
 to intercept the malware before it's being executed.
 Overall, interesting and fairly complex scheme. I
 wonder if maybe it's a little bit too fragile and how well
 this all works. But yeah, if you're into malware analysis,
 definitely something to look at in case you're running into
 some variation of this particular system in your
 environment. And researchers from Application Security Lab
 Depth First have created a proof of concept exploit for
 an NGINX vulnerability that was patched around the 15th. I
 think I mentioned it back then because it's a remote code
 execution vulnerability. It is a heat-based buffer overflow.
 So there was no some idea that address space layout
 randomization may prevent effective exploitation. Well,
 this proof of concept exploit does work around address space
 layout randomization. So it is a reliable exploit for this
 vulnerability even on most larger servers and the like
 that often do employ this defensive mechanism. So it's
 not just one of those IoT vulnerabilities as was
 originally sort of proposed. Interesting to have a proof of
 concept that soon in particular one that's as
 complete as this one. So definitely make sure that
 you're patching NGINX as quickly as possible if you
 haven't done that yet. Well, and this is it for today. So
 thanks for listening. Thanks for liking. Thanks for
 recommending this podcast and thanks for subscribing to it
 and talk to you again tomorrow. Bye.