Wi-Fi cameras are popular due to their affordability and convenience but often have security vulnerabilities that can be exploited.

Introduction

AJCloud: A Brief Introduction

Initial Vulnerability Research Efforts

Initial Hardware Hacking

Wansview Cloud for Windows

Exploring the network communications

Advanced Hardware Hacking

Building a P2P Client

Impact

What did the vendors do right?

What did the vendors do wrong?

Mitigations

Key Takeaways

Storm on the Horizon: Inside the AJCloud IoT Ecosystem

Elastic Security verifies new destructive malware targeting Ukraine: Operation Bleeding Bear

Overview

Stage 1: WhisperGate MBR payload

Malware analysis breakdown (Stages 1-4)

Stage 2/3: Discord downloader and injector

Final stage: File corruptor

MBR protection with Elastic Security

Observing WhisperGate in Elastic Security

Alert breakdown and defensive recommendations

Endpoint Security Integration Alerts

Stage 1 - MBR Wiper

Stage 2 - Downloader

Stage 3 + Stage 4 - Injector/File Corruptor

Prebuilt Detection Engine Alerts

Hunting queries

MITRE ATT&CK

Summary

Indicators

Artifacts

Operation Bleeding Bear

Analysis of the HERMETICWIPER malware targeting Ukranian organizations.

Malware Wipers & Ukrainian Targets

Malware Stage Analysis

Interesting Functionality

Shredding Component Analysis

Driver Analysis

YARA Rules

Observables

References

Elastic protects against data wiper malware targeting Ukraine: HERMETICWIPER

Author

Mark Mager

Articles

Storm on the Horizon: Inside the AJCloud IoT Ecosystem

Operation Bleeding Bear

Elastic protects against data wiper malware targeting Ukraine: HERMETICWIPER