Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Just two months ago, researchers from Trend Micro uncovered a sophisticated attack campaign by Earth Preta (also known as Mustang Panda), a China-linked APT group. Included by default since Windows 10 version 1607, this digitally-signed Microsoft utility is typically whitelisted by security solutions, making it an ideal vector for attackers to bypass detection mechanisms. As threat actors continue to leverage living-off-the-land techniques, defenders must remain vigilant against the misuse of legitimate system utilities within their attack chains. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. This sophisticated attack technique allows hackers to hide malicious activity behind trusted Windows processes. This method injects an import table entry consisting of a specified DLL into the module at a given base address, allowing for more precise control over the attack. Earth Preta leveraged mavinject.exe to inject malicious payloads into waitfor.exe when ESET antivirus was detected running on victims’ systems. She is covering various cyber security incidents happening in the Cyber Space.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 22 Apr 2025 12:45:14 +0000