Tag: yara

3 Attack Reports | 0 Vulnerabilities

Attack reports

Tracking FileFix, Shadow Vector, and SideWinder

This intelligence report details collaborative research between Acronis Threat Research Unit and VirusTotal on three emerging cyber threats. FileFix, a variant of ClickFix, uses malicious websites to trick victims into running commands copied to their clipboard. Shadow Vector targets Colombian user…
yara
CVE-2017-0199
CVE-2017-11882
virustotal
clickfix
south asia
svg
colombia
filefix
2025-11-10
clipboard manipulation
shadow vector
document-based attacks
Published: November 10, 2025
Linked vulnerabilities : CVE-2017-11882, CVE-2017-0199
Downloadable IOCs: 16

FlipSwitch: a Novel Syscall Hooking Technique

FlipSwitch introduces a new syscall hooking technique for Linux kernel 6.9+, bypassing traditional methods rendered obsolete by changes in the syscall dispatch mechanism. The technique locates the original syscall function, scans the x64_sys_call function's machine code for a specific call instruct…
rootkit
yara
syscall hooking
2025-09-30
linux kernel
kernel security
flipswitch
x86-64
Published: September 30, 2025
Downloadable IOCs: 1

New Hijack Loader Variant: Uses Process Hollowing, Has Enhanced Anti-Evasion Capabilities

loader
rhadamanthys
2024-05-23
api hooking
hijackloader
hijack loader
yara
tracker
suricata
loader variant
has enhanced
png image
user account
april
Published: May 23, 2024
Downloadable IOCs: 9
Click here to see more Attack Reports