Threat Hunting

*Original image source: [blogger.googleusercontent.com](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqxmoJtQxCw_JRBCIc5vQ8KP7fDvEliYGDzRe4RRTwH_vydH3_bliXj-rfs_e5j3YD6EPrvVKtSlI_IUIA5EoxajlFgyLPhLtjiYZjwotvmIHvLuvf_bIhfUuGJ-Sgxx0Wjhl7UigBQko3hYNb44Z4PT6fRSXFEVdPZIzMjLe7uge8CWthwqzErdqpheA/s1600/chrome.jpg Cybersecurityresearchershavedetailedanewpost-exploitationtechniquethatleveragestheChromeDevToolsProtocol(CDP)* from within a running Google Chrome or Microsoft Edge process on Windows. This method allows attackers, who have already achieved code execution on the target host, to access sensitive browser data like cookies, saved passwords, and authenticated browser sessions. Understanding the CDP Post-Exploitation Technique This technique is not an exploit for a browser vulnerability but rather a method for attackers to gain deeper control and extract data once initial access is established. It addresses a post-compromise scenario, offering a powerful way to escalate privileges within the compromised system’s browser context. ...

A legitimate and widely used open source server monitoring tool has been repurposed by attackers to gain complete remote control of compromised systems. According to findings from the Ontinue Cyber ​​Defense Center, the activity involves Nezha, a popular monitoring platform that offers administrators system visibility and remote management features in Windows and Linux environments. In this campaign, Nezha is deployed as a remote access tool (RAT) in the post-exploitation phase, instead of being a traditional malware. Since the software is legitimate and actively maintained, it records zero detections on VirusTotal, where 72 security vendors detected nothing suspicious. The agent is installed silently and only becomes visible when attackers begin issuing commands, making traditional signature-based detection ineffective. ...