#ParsedReport
09-06-2022

Killnet: The Hactivist Group That Started A Global Cyber War

https://www.digitalshadows.com/blog-and-research/killnet-the-hactivist-group-that-started-a-global-cyber-war

Actors/Campaigns:
Killnet (tags: botnet, ddos, rat)
It_army
Ddosgung
Sakurajima
Kratos
Zarya

Threats:
Phoenix_keylogger
Mirai
Dns_amplification_technique

Industry:
Financial, Government

Geo:
Russian, Russia, Ukraine, Lithuania, Poland, Romanian, Estonia, Latvia, Italian, Germany, German, Italy, Romania

Functions Names: 1

#ParsedReport
09-06-2022

LockBit 2.0: How This RaaS Operates and How to Protect Against It

https://unit42.paloaltonetworks.com/lockbit-2-ransomware

Actors/Campaigns:
Darkside

Threats:
Lockbit (tags: stealer, rat, malware, spyware, ddos, ransomware, vpn, dns, scan, proxy, phishing)
Babuk
Revil
Conti
Blackcat
Avaddon
Suncrypt
Blackbyte
Cobalt_strike
Metasploit_tool
Proxyshell_vuln
Psexec_tool
Wevtutil_tool
Mimikatz
Minidump_tool
Grabchrome_tool
Grabrff_tool
Netscan_tool
Adfind_tool
Pchunter_tool
Beacon
Megasync_tool
Stealbit

Industry:
Healthcare, Education, Retail, Financial

Geo:
Latam, Russian, Japan, Japac, Germany, Apac, Italy, America, Emea

CVEs:
CVE-2021-20028 [Vulners]
Vulners: Score: 7.5, CVSS: 4.4,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Unavailable
Soft:
- sonicwall sma 210 firmware (<9.0.0.10)
- sonicwall sma 410 firmware (<9.0.0.10)
- sonicwall sma 500v firmware (<9.0.0.10)

CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)

CVE-2020-0787 [Vulners]
Vulners: Score: 7.2, CVSS: 5.1,
Vulners: Exploitation: True
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows 10 (-, 1607, 1709, 1803, 1809, 1903, 1909)
- microsoft windows 7 (-)
- microsoft windows 8.1 (-)
- microsoft windows rt 8.1 (-)
- microsoft windows server 2008 (-, r2, r2)
have more...
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9.1
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)


TTPs:
Tactics: 10
Technics: 27

#ParsedReport
09-06-2022

Andariel Group, active only in Korea, for the past two years

https://www-ahnlab-com.translate.goog/kr/site/securityinfo/secunews/secuNewsView.do?seq=31890&menu_dist=2&cmd=scrap&_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp

Actors/Campaigns:
Lazarus (tags: malware, phishing, ransomware, keylogger)

Threats:
Gh0st_rat
Rifdoor
Phandoor
Tiger_downloader
Watering_hole_technique
Nukesped_rat
Tiger_rat

Geo:
Korea

IOCs:
File: 10

Functions Names: 1

Оппааа! Кто-то небезопасно выкладывает куски кода )

#ParsedReport
09-06-2022

eSentire Threat Intelligence Malware Analysis: Purple Fox

https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-purple-fox

Threats:
Purplefox (tags: malware, rat, rootkit, proxy, dns, scan, phishing)
Rig_tool (tags: malware)
Lolbin
Hot_potato_technique
Tater_exploit

Geo:
Chinese, Africa, Apac, America, Emea

CVEs:
CVE-2018-8120 [Vulners]
Vulners: Score: 7.2, CVSS: 7.3,
Vulners: Exploitation: True
X-Force: Risk: 7
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -, r2)
- microsoft windows 7 (-)

CVE-2021-1675 [Vulners]
Vulners: Score: 9.3, CVSS: 3.2,
Vulners: Exploitation: True
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -)
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 21h1, 1809, 1909, 2004)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
have more...
CVE-2015-1701 [Vulners]
Vulners: Score: 7.2, CVSS: 7.1,
Vulners: Exploitation: True
X-Force: Risk: 6.8
X-Force: Patch: Official fix
Soft:
- microsoft windows vista (*)
- microsoft windows 2003 server (*)
- microsoft windows server 2008 (-)
- microsoft windows 7 (le-, le-)

CVE-2020-0674 [Vulners]
Vulners: Score: 7.6, CVSS: 6.2,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Workaround
Soft:
- microsoft internet explorer (9, 10, 11)

CVE-2019-0808 [Vulners]
Vulners: Score: 7.2, CVSS: 6.2,
Vulners: Exploitation: True
X-Force: Risk: 7
X-Force: Patch: Official fix
Soft:
- microsoft windows 7 (sp1)
- microsoft windows server 2008 (r2, r2, -)


IOCs:
File: 10
Registry: 4
Path: 21
IP: 39
Domain: 1
Hash: 6
Url: 1

YARA: Found

Links:
https://github.com/Kevin-Robertson/Tater
https://github.com/k8gege/K8tools

#ParsedReport
10-06-2022

Lyceum .NET DNSBackdoor. Key Features of this attack:

https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor

Actors/Campaigns:
Siamesekitten (tags: dns, backdoor, malware)

Threats:
Dnsbackdoor (tags: dns, backdoor, malware)

Industry:
Energy, Telco

Geo:
Iran, Iranian

TTPs:
Tactics: 1
Technics: 7

IOCs:
File: 5
Url: 5
Hash: 2
Domain: 1
IP: 2

Functions Names: 6

#ParsedReport
10-06-2022

Bumblebee Loader Linked to Conti and Used In Quantum Locker Attacks

https://www.kroll.com/en/insights/publications/cyber/bumblebee-loader-linked-conti-used-in-quantum-locker-attacks

Actors/Campaigns:
Exotic_lily
Ta578
Ta579

Threats:
Quantum_locker (tags: spam, phishing, trojan, malware, ransomware)
Bumblebee (tags: spam, phishing, trojan, malware, ransomware)
Conti (tags: spam, phishing, trojan, malware, ransomware)
Cobalt_strike
Emotet
Icedid
Ryuk
Gozi
Meterpreter_tool
Sliver_tool
Bazarbackdoor

Industry:
Healthcare

CVEs:
CVE-2021-40444 [Vulners]
Vulners: Score: 6.8, CVSS: 2.1,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -)
- microsoft windows 10 (1607, -, 1809, 1909, 2004, 20h2, 21h1)
- microsoft windows server 2016 (-, 2004, 20h2)
- microsoft windows rt 8.1 (-)
- microsoft windows server 2012 (-, -)
have more...

Links:
https://github.com/LordNoteworthy/al-khaser/tree/06d4a89e9ecc3e49e4d2df67fe0b2d6faf04166e

#ParsedReport
10-06-2022

Smilodon Credit Card Skimming Malware Shifts to WordPress

https://blog.sucuri.net/2022/06/smilodon-credit-card-skimming-malware-shifts-to-wordpress.html

Actors/Campaigns:
Magecart (tags: malware)

Threats:
Megalodon (tags: malware, rat, backdoor)

Industry:
E-commerce, Financial

IOCs:
Domain: 3

Functions Names: 1

#ParsedReport
10-06-2022

BAT (//)

https://asec-ahnlab-com.translate.goog/ko/35189/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp

Actors/Campaigns:
Kimsuky

IOCs:
File: 6
Hash: 13

#ParsedReport
10-06-2022

Back From the Dead, Emotet Returns in 2022

https://www.deepinstinct.com/blog/emotet-malware-returns-in-2022

Actors/Campaigns:
Wizard_spider (tags: malware)

Threats:
Emotet (tags: malware, botnet, rat, phishing, trojan, ransomware)
Conti
Ryuk
Trickbot (tags: malware)
Qakbot
Chaos (tags: phishing, malware)

Industry:
Financial

Geo:
Japanese, Netherlands

CVEs:
CVE-2017-11882 [Vulners]
Vulners: Score: 9.3, CVSS: 8.3,
Vulners: Exploitation: True
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft office (2013, 2010, 2016, 2007)

#ParsedReport
10-06-2022

SANS ISC: InfoSec Handlers Diary Blog - SANS Internet Storm Center SANS Site Network Current Site SANS Internet Storm Center Other SANS Sites Help Graduate Degree Programs Security Training Security Certification Security Awareness Training Penetration Testing Industrial Control Systems Cyber Defense Foundations DFIR Software Security Government OnSite Training InfoSec Handlers Diary Blog

https://isc.sans.edu/diary/rss/28728

Actors/Campaigns:
Ta570 (tags: spam, malware)

Threats:
Qakbot (tags: spam, malware)
Follina_vuln (tags: spam, malware)

Industry:
Government

CVEs:
CVE-2022-30190 [Vulners]
Vulners: Score: 9.3, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 1809, 20h2, 21h1, 21h2)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
- microsoft windows server 2008 (-, r2)
have more...

IOCs:
File: 59
Hash: 49
Path: 1
Url: 4

#ParsedReport
10-06-2022

Phishing Campaigns featuring Ursnif Trojan on the Rise

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/phishing-campaigns-featuring-ursnif-trojan/?&web_view=true

Threats:
Gozi (tags: spam, rat, trojan, phishing, malware)
Dexter
Emotet
Hancitor
Ficker_stealer

TTPs:
Tactics: 3
Technics: 4

IOCs:
File: 4
Url: 1
Hash: 2

Functions Names: 2

#ParsedReport
10-06-2022

Instagram credentials Stealers: Free Followers or Free Likes

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/instagram-credentials-stealers-free-followers-or-free-likes

Threats:
Dexter
Emotet
Hancitor
Ficker_stealer

Geo:
Turkey, Portuguese

IOCs:
Hash: 2

#ParsedReport
10-06-2022

Instagram credentials Stealer: Disguised as Mod App

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/instagram-credentials-stealer-disguised-as-mod-app

Threats:
Dexter (tags: stealer)
Emotet
Hancitor
Ficker_stealer

IOCs:
Email: 1
Hash: 1

#ParsedReport
10-06-2022

Yashma Ransomware Report

https://www.cyfirma.com/outofband/yashma-ransomware-report

Threats:
Yashma (tags: ddos, malware, ransomware, spam, phishing, rat)
Chaos (tags: ransomware)

Geo:
Turkey, Azerbaijan

TTPs:
Tactics: 6
Technics: 12

IOCs:
File: 2
Hash: 1

#technique
PACMAN is a new attack technique demonstrated against Apple M1 processor chipsets that could be used to hack macOS systems.

https://securityaffairs.co/wordpress/132154/hacking/pacman-attack-apple-m1-cpus.html

#ParsedReport
12-06-2022

Confluence servers hacked to deploy AvosLocker, Cerber2021 ransomware

https://www.bleepingcomputer.com/news/security/confluence-servers-hacked-to-deploy-avoslocker-cerber2021-ransomware

Threats:
Avoslocker (tags: scan, ransomware, cryptomining, malware, botnet, rat)
Cerberimposter (tags: ransomware, botnet, cryptomining, malware, scan, rat)
Cerber (tags: ransomware)

Geo:
Australia

CVEs:
CVE-2022-26134 [Vulners]
Vulners: Score: Unknown, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix

CVE-2021-26084 [Vulners]
Vulners: Score: 7.5, CVSS: 7.3,
Vulners: Exploitation: True
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- atlassian confluence server (<7.12.5, <7.4.11, <7.11.6, <6.13.23)
- atlassian confluence data center (<7.12.5, <7.11.6, <7.4.11, <6.13.23)

#ParsedReport
12-06-2022

Exposing HelloXD Ransomware and x4k

https://unit42.paloaltonetworks.com/helloxd-ransomware

Actors/Campaigns:
Lapsus (tags: ransomware)

Threats:
Helloxd (tags: malware, backdoor, ddos, dns, ransomware, rat)
Babuk (tags: ransomware)
Microbackdoor (tags: ransomware)
Cobalt_strike (tags: ransomware)
Beacon (tags: ransomware)
Lockbit (tags: malware, ransomware)

Industry:
Financial

Geo:
Apac, Emea, Japan, America, Russia, Russian

TTPs:
Tactics: 1
Technics: 0

IOCs:
IP: 7
File: 3
Hash: 59
Email: 1
Domain: 56

Links:
https://github.com/l4ckyguy
https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/self\_delete\_bin.nim
https://github.com/l4cky-control
https://github.com/x4kme
https://github.com/vbdaga/Rabbit-Cipher

#ParsedReport
12-06-2022

Smilodon Credit Card Skimming Malware Shifts to WordPress

https://blog.sucuri.net/2022/06/smilodon-credit-card-skimming-malware-shifts-to-wordpress.html

Actors/Campaigns:
Magecart (tags: malware)

Threats:
Megalodon (tags: rat, backdoor, malware)

Industry:
E-commerce, Financial

IOCs:
Domain: 3

Functions Names: 1

#ParsedReport
13-06-2022

Hydra Android Malware Distributed Via Play Store. Fake Document Manager App Downloading Hydra Banking Trojan

https://blog.cyble.com/2022/06/13/hydra-android-malware-distributed-via-play-store

Threats:
Hydra (tags: malware, trojan, phishing, proxy)

Industry:
Financial

Geo:
Colombia

TTPs:
Tactics: 6
Technics: 2

IOCs:
Url: 6
File: 2
Hash: 2

#ParsedReport
13-06-2022

Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers. Key points

https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter

Threats:
Purecrypter (tags: ransomware, malware, stealer, rat)
Binder
Agent_tesla
Arkei_stealer
Asyncrat_rat
Azorult
Dcrat_rat
Nanocore_rat
Redline_stealer
Remcos_rat
Snake_keylogger
Avemaria_rat

TTPs:
Tactics: 1
Technics: 0

IOCs:
Hash: 57
File: 13
Url: 17
Registry: 4
Path: 1

Functions Names: 4