Ophir Harpaz

Guardicore has discovered FritzFrog, a sophisticated peer-to-peer (P2P) botnet that has been actively breaching SSH servers since January 2020.

Learn about the critical zero-click remote code execution (RCE) vulnerabilities in Windows RPC runtime. Discover how they work and how to mitigate them effectively.

Remote Procedure Call (RPC) is one of the most widespread protocols in use today. It allows for inter-process communication, both on a single host and across the network, and serves as a critical building block for countless applications and services. For the sake of this guide, we’ll be referring to MSRPC as we discuss RPC, given the focus of our work.

FritzFrog is a peer-to-peer botnet, which means its command and control server is not limited to a single, centralized machine, but rather can be done from every machine in its distributed network. In other words, every host running the malware process becomes part of the network, and is capable of sending, receiving, and executing the commands to control machines in the network.

Within hours from the moment our in-house built fuzzer, hAFL1, started running – it found a critical, CVSS 9.9 RCE vulnerability in Hyper-V’s virtual driver.

Guardicore Labs, in collaboration with SafeBreach Labs, found a critical vulnerability in Hyper-V’s virtual network switch driver (vmswitch.sys).

New details in the Indexsinas SMB worm, also dubbed NSABuffMiner.

Guardicore Labs uncovers an attack campaign that’s been under the radar for almost two years, breaching MS-SQL servers and infecting them with remote-access tools and cryptominers.

In this post, Guardicore Labs provides an in-depth analysis of the attack campaign, focusing on victim analysis and attack infrastructure.