{"id":2161,"date":"2025-01-28T11:16:56","date_gmt":"2025-01-28T11:16:56","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/2025\/01\/28\/ransomware-exploits-esxi-via-ssh-tunnels-for-c2\/"},"modified":"2025-01-28T11:16:57","modified_gmt":"2025-01-28T11:16:57","slug":"ransomware-exploits-esxi-via-ssh-tunnels-for-c2","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/ransomware-exploits-esxi-via-ssh-tunnels-for-c2\/","title":{"rendered":"Ransomware Exploits ESXi via SSH Tunnels for C2"},"content":{"rendered":"\n<\/p>\n

Ransomware Attacks Evade Telemetry with Hardware Breakpoints<\/strong><\/p>\n

Author:<\/strong> Ravie Lakshmanan
\nDate:<\/strong> January 28, 2025<\/p>\n

Tags:<\/strong> Ransomware \/ Threat Intelligence<\/p>\n

<\/a><\/div>\n

Cybersecurity researchers have discovered a new technique used by attackers to evade telemetry and maintain stealth while implementing "patchless" hooks that prevent AMSI scanning and avoid ETW logging. This technique involves using hardware breakpoints at the CPU level to hook functions and manipulate telemetry in userland without direct kernel patching.<\/p>\n

The Technique<\/strong><\/p>\n

The technique relies on a native Windows function called NtContinue, instead of SetThreadContext, to set debug registers and avoid triggering ETW logging and events that are parsed by EDRs to flag suspicious activity. By leveraging hardware breakpoints at the CPU level, attackers can hook functions and manipulate telemetry in userland without direct kernel patching, challenging traditional defenses.<\/p>\n

Expert Insights<\/strong><\/p>\n

Praetorian researcher Rad Kawar explained the significance of this technique, stating, "By leveraging hardware breakpoints at the CPU level, attackers can hook functions and manipulate telemetry in userland without direct kernel patching \u2014 challenging traditional defenses." This highlights a technique adversaries can use to evade and maintain stealth while implementing "patchless" hooks that prevent AMSI scanning and avoid ETW logging.<\/p>\n

Implications<\/strong><\/p>\n

This matters because it highlights a technique adversaries can use to evade and maintain stealth while implementing "patchless" hooks that prevent AMSI scanning and avoid ETW logging. This technique has significant implications for traditional defenses and highlights the need for more advanced security measures to detect and prevent such attacks.<\/p>\n

<\/p>\n

Found this article interesting? Follow us on Twitter \uf099<\/i><\/a> and LinkedIn<\/a> to read more exclusive content we post.<\/div>\n\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Ransomware Attacks Evade Telemetry with Hardware Breakpoints Author: Ravie Lakshmanan Date: January 28, 2025 Tags: Ransomware \/ Threat Intelligence Cybersecurity researchers have discovered a new technique used by attackers to…<\/p>\n","protected":false},"author":19,"featured_media":2162,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-2161","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/01\/1738063017_ransomware.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/2161","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=2161"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/2161\/revisions"}],"predecessor-version":[{"id":2163,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/2161\/revisions\/2163"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/2162"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=2161"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=2161"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=2161"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}