Lokibot

Detection: Windows Suspicious Child Process of Consent.EXE | Splunk Security Content

Splunk published a Windows endpoint analytic that detects suspicious child processes launched by consent.exe, a behavior strongly associated with User Account Control (UAC) bypass and privilege escalation. Because consent.exe normally displays the UAC elevation prompt rather than spawning executables, the detection treats such process creation as anomalous, excluding WerFault.exe as a known crash-related exception. The analytic maps to MITRE ATT&CK techniques T1548.002, T1068, and T1059, and is designed for telemetry from Sysmon, Windows Security Event ID 4688, and CrowdStrike ProcessRollup2 data normalized into Splunk's Endpoint data model. The release aligns with MITRE ATT&CK documentation showing UAC bypass remains a widely used post-compromise technique across ransomware operators, commodity malware, and state-linked intrusion groups. ATT&CK lists methods including COM abuse through CMSTPLUA, scheduled task abuse such as SilentCleanup, registry hijacks involving ms-settings and mscfile, and abuse of trusted Windows binaries including fodhelper.exe, eventvwr.exe, and sdclt.exe. Splunk also published supporting attack simulation data for suspicious child processes of consent.exe, giving defenders a way to test visibility for this privilege-escalation pattern, although the analytic is disabled by default and generates intermediate risk events rather than direct notable alerts.

Windows Suspicious Child Of Consent.exe | Splunk Security Content

404 Keylogger (Malware Family)

Elastic added behavioral Windows keylogger detection to Elastic Defend 8.12, using Event Tracing for Windows (ETW) to observe API activity associated with keystroke collection through polling, keyboard hooks, Raw Input, and DirectInput. Prebuilt endpoint rules identify suspicious use of APIs including GetAsyncKeyState, SetWindowsHookEx, and RegisterRawInputDevices. In testing on Windows 10, Elastic Defend detected a proof-of-concept Raw Input keylogger soon after it executed, flagging an untrusted process that registered for keyboard input. The telemetry captures API arguments, call-stack context, process-signature status, and related process metadata, enabling defenders to investigate credential- and information-theft activity while reducing false positives from legitimate accessibility and input software.

More_eggs Malware Disguised as Resumes Targets Recruiters in Phishing Attack

Security firms reported multiple spearphishing campaigns that used LinkedIn job applications, fake job offers, and poisoned resumes to deliver the More_eggs malware to recruiters, hiring managers, and other business professionals. In observed intrusions, victims were directed through legitimate-looking resume workflows that ended with a malicious archive or shortcut file, often disguised as a document, which launched obfuscated activity and installed the JavaScript-based backdoor. The campaigns were seen across sectors including industrial services, aerospace and defense, legal, accounting, staffing, and healthcare technology, showing a sustained focus on personnel involved in recruiting and hiring. The malware and delivery chain were linked to Golden Chickens (also known as Venom Spider) and associated tooling such as VenomLNK, TerraLoader, and TerraPreter, though the specific operators behind individual incidents were not always confirmed. The attacks abused signed Windows binaries including regsvr32, wmic, msxsl.exe, ie4uinit.exe, and in earlier cases cmstp to evade detection, establish execution, perform discovery, and communicate with command-and-control infrastructure. Defenders said More_eggs can support credential theft, data exfiltration, lateral movement, remote access, and follow-on ransomware activity, and in at least one case endpoint telemetry caught suspicious XSL script processing and related malicious behavior before the intrusion succeeded.

Protecting your devices from information theft | Elastic Security Labs

Security | IBM

LokiLocker, a Ransomware Similar to BlackBit Being Distributed in Korea - ASEC

Researchers reported that LokiLocker is a relatively new ransomware-as-a-service family targeting Microsoft Windows systems through a small, vetted affiliate network, with activity observed across Eastern Europe, Asia, and English-speaking victims. The malware, first seen in the wild in 2021, encrypts files using AES with RSA-protected keys, demands payment by email, and is written in .NET with NETGuard and the KoiVM virtualization plugin to complicate reverse engineering. Early infections were linked in some cases to trojanized brute-checker tools, and no free decryptor was available. BlackBerry researchers said the operation may be using false-flag indicators to obscure attribution, citing Iranian-linked clues such as affiliate usernames, cracking tools associated with the AccountCrack team, and an Iran exclusion list in code, while cautioning that the true origin remains unclear. LokiLocker is also notable for a configurable wiper function that can delete non-system files, overwrite the Master Boot Record (MBR), and force a Blue Screen of Death if victims refuse to pay, increasing the risk of destructive impact beyond conventional ransomware encryption.

Detect Credential Access with Elastic Security | Elastic Security Labs

Elastic Endpoint Security added kernel-driver-derived file and registry telemetry to detect access to sensitive credential stores, including browser data, Windows SAM and LSA secrets, cached domain credentials, credential files, and Windows Credential Manager. Its behavior protections can block high-confidence credential-theft activity associated with tools and malware such as Mimikatz, LaZagne, AgentTesla, FormBook, and Poulight Stealer; KQL and EQL hunting can also identify processes opening multiple sensitive stores or SMB access following a network logon. Attackers commonly extract saved browser usernames, passwords, cookies, and session tokens from stores such as Chrome’s Login Data and Firefox’s key3.db, key4.db, and logins.json. They also dump Windows LSA secrets and cached domain credentials using utilities including Mimikatz, reg save, Impacket secretsdump.py, CrackMapExec, and gsecdump. Cached Windows credentials are generally stored as DCC2/MS-Cache v2 hashes and require offline cracking rather than pass-the-hash, while Linux Active Directory integrations may retain cached credentials in SSSD or Quest database files.