HN user
Really curious the use of the "zoom.com" domain. However, since the endpoint uses insecure HTTP, maybe this should be a simple endpoint/hostname redirection.
A search of "router/firmware/query.aspx" leads me to D-Link endpoints who also uses the "wrpd" subdomain.
rpm-ostree is being phased-out in favor of bootc[1], which uses ostree in the underlying code.
Gynvael Coldwind made a great analysis about it: https://gynvael.coldwind.pl/?lang=en&id=782
https://news.ycombinator.com/item?id=39878681
xz/liblzma: Bash-stage Obfuscation Explained
The CronRAT adds a number of tasks to crontab with a curious date specification: 52 23 31 2 3. These lines are syntactically valid, but would generate a run time error when executed. However, this will never happen as they are scheduled to run on February 31st. Instead, the actual malware code is hidden in the task names and is constructed using several layers of compression and base64 decoding.
The actual malware uses the task name from these "never occurring crontab". The invalid date is just a kind of signature.
Fun fact: both books have precisely the same content
"Zero Days" documentary is focused on Stuxnet. https://www.imdb.com/title/tt5446858/
I have this problem with my Hotmail/Outlook account for almost 5 years and Microsoft team don't even understand what's going on. - https://answers.microsoft.com/en-us/outlook_com/forum/oemail...
They just don't admit how hard did they failed in communications apps. Clearly priority and focus issues.