Renato Marinho – Medium

Renato Marinho

Renato Marinho

Guildma is now abusing colorcpl.exe LOLBIN

While analyzing a Guildma sample recently uploaded to MalwareBazaar [1], we came across a chain of LOLBIN abuse. It is not uncommon to see…

May 5, 2023

Guildma is now abusing colorcpl.exe LOLBIN

May 5, 2023

Renato Marinho

Log4Shell campaigns are using Nashorn to get reverse shell on victim’s machines

Almost one year later, Log4Shell attacks are still alive and making victims. Log4shell, as you may remember, was the name given to a remote…

Nov 22, 2022

Log4Shell campaigns are using Nashorn to get reverse shell on victim’s machines

Nov 22, 2022

Renato Marinho

Translating Saitama’s DNS tunneling messages

Content initially posted at SANS ISC

Jun 13, 2022

Translating Saitama’s DNS tunneling messages

Jun 13, 2022

Renato Marinho

WSO2 RCE exploited in the wild

While investigating a malicious crypto-mining case, I discovered that attackers implanted the payload exploiting a recently patched RCE…

Apr 26, 2022

WSO2 RCE exploited in the wild

Apr 26, 2022

Renato Marinho

Vulnerabilidade 0-day no Spring Framework

Update — 31/03/2022:

Mar 30, 2022

Mar 30, 2022

Renato Marinho

PwnKit: Vulnerabilidade crítica e de fácil exploração permite elevação de privilégios em sistemas…

Acaba de ser divulgada uma vulnerabilidade crítica (CVE-2021–4034) numa ferramenta chamada ‘pkexec’, presente em praticamente todas as…

Jan 25, 2022

Jan 25, 2022

Renato Marinho

Attackers are abusing MSBuild to evade defenses and implant Cobalt Strike beacons

Microsoft Build Engine is the platform for building applications on Windows, mainly used in environments where Visual Studio is not…

Dec 27, 2021

Attackers are abusing MSBuild to evade defenses and implant Cobalt Strike beacons

Dec 27, 2021

Renato Marinho

Example of how attackers are trying to push crypto miners via Log4Shell

Article initially posted at SANS ISC

Dec 24, 2021

Example of how attackers are trying to push crypto miners via Log4Shell

Dec 24, 2021

Renato Marinho

Log4Shell exploited to implant coin miners

Article initially posted at SANS ISC

Dec 13, 2021

Log4Shell exploited to implant coin miners

Dec 13, 2021

Renato Marinho

Log4shell: vulnerabilidade crítica afeta biblioteca log4j (URGENTE)

Update 18/12/2021 08:10

Dec 11, 2021

Dec 11, 2021

Renato Marinho

Renato Marinho

Chief Research Officer at Morphus Labs; SANS ISC Handler; PhD candidate; Professor; Writer; Speaker. @renato_marinho

Following

Help
Status
About
Careers
Press
Blog
Privacy
Terms
Text to speech
Teams