#ParsedReport
22-06-2022
Chinese actor takes aim, armed with Nim Language and Bizarro AES. Executive Summary
https://research.checkpoint.com/2022/chinese-actor-takes-aim-armed-with-nim-language-and-bizarro-aes
Actors/Campaigns:
Pirate_panda
Ta428
Threats:
Bizarro (tags: proxy, trojan, scan, malware, rat, backdoor, ransomware)
Yahoyah (tags: scan, backdoor, malware)
Zebrocy
Trickbot
Process_doppelganging_technique
Industry:
Financial
Geo:
Philippines, Taiwan, China, Chinese
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 4
Hash: 32
IP: 24
Domain: 2
Functions Names: 1
Links:
22-06-2022
Chinese actor takes aim, armed with Nim Language and Bizarro AES. Executive Summary
https://research.checkpoint.com/2022/chinese-actor-takes-aim-armed-with-nim-language-and-bizarro-aes
Actors/Campaigns:
Pirate_panda
Ta428
Threats:
Bizarro (tags: proxy, trojan, scan, malware, rat, backdoor, ransomware)
Yahoyah (tags: scan, backdoor, malware)
Zebrocy
Trickbot
Process_doppelganging_technique
Industry:
Financial
Geo:
Philippines, Taiwan, China, Chinese
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 4
Hash: 32
IP: 24
Domain: 2
Functions Names: 1
Links:
https://github.com/polymorf/findcrypt-yaraCheck Point Research
Chinese actor takes aim, armed with Nim Language and Bizarro AES - Check Point Research
Executive Summary In this article, Check Point Research shares findings on a group / activity cluster with ties to Tropic Trooper: The infection chain includes a previously undescribed loader (dubbed “Nimbda”) written in Nim language. This loader was observed…
#ParsedReport
22-06-2022
CALISTO continues its credential harvesting campaign
https://blog.sekoia.io/calisto-continues-its-credential-harvesting-campaign
Actors/Campaigns:
Calisto
Coldriver
Fancy_bear
Threats:
Hades
Industry:
Ngo
Geo:
Ukrainian, Russian
IOCs:
Domain: 24
Links:
22-06-2022
CALISTO continues its credential harvesting campaign
https://blog.sekoia.io/calisto-continues-its-credential-harvesting-campaign
Actors/Campaigns:
Calisto
Coldriver
Fancy_bear
Threats:
Hades
Industry:
Ngo
Geo:
Ukrainian, Russian
IOCs:
Domain: 24
Links:
https://github.com/kgretzky/evilginx2Sekoia.io Blog
CALISTO continues its credential harvesting campaign
March 30, 2022, Google TAG published several IOCs related to CALISTO - a Russia-nexus threat actor. Discover our analysis.
#ParsedReport
22-06-2022
From the Front Lines \| 3 New and Emerging Ransomware Threats Striking Businesses in 2022
https://www.sentinelone.com/blog/from-the-front-lines-3-new-and-emerging-ransomware-threats-striking-businesses-in-2022
Actors/Campaigns:
Lapsus
Mindware
Threats:
Zeon (tags: ransomware)
Helloxd (tags: ransomware, malware, rat)
Babuk (tags: ransomware, malware)
Conti (tags: ransomware)
Lockbit (tags: ransomware)
Blackcat (tags: ransomware)
Microbackdoor (tags: ransomware)
Sfile (tags: ransomware)
Industry:
Financial
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 8
IP: 1
Hash: 22
Links:
22-06-2022
From the Front Lines \| 3 New and Emerging Ransomware Threats Striking Businesses in 2022
https://www.sentinelone.com/blog/from-the-front-lines-3-new-and-emerging-ransomware-threats-striking-businesses-in-2022
Actors/Campaigns:
Lapsus
Mindware
Threats:
Zeon (tags: ransomware)
Helloxd (tags: ransomware, malware, rat)
Babuk (tags: ransomware, malware)
Conti (tags: ransomware)
Lockbit (tags: ransomware)
Blackcat (tags: ransomware)
Microbackdoor (tags: ransomware)
Sfile (tags: ransomware)
Industry:
Financial
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 8
IP: 1
Hash: 22
Links:
https://github.com/vbdaga/Rabbit-Cipherhttps://github.com/dashingsoft/pyarmorSentinelOne
From the Front Lines | 3 New and Emerging Ransomware Threats Striking Businesses in 2022
Crimeware continues to evolve at pace with threat actors both iterating on old source code and creating new ransomware families. Stay informed, stay safe.
#ParsedReport
22-06-2022
Improvised Modus Operandi for Targeting Indian Banking Customers via SMS Forwarding Malware
https://cloudsek.com/threatintelligence/improvised-modus-operandi-for-targeting-indian-banking-customers-via-sms-forwarding-malware/?utm_source=rss&utm_medium=rss&utm_campaign=improvised-modus-operandi-for-targeting-indian-banking-customers-via-sms-forwarding-malware
Industry:
Financial
Geo:
Indian, India
TTPs:
Tactics: 2
Technics: 0
IOCs:
Domain: 5
File: 2
IP: 1
Hash: 1
Url: 3
Functions Names: 3
22-06-2022
Improvised Modus Operandi for Targeting Indian Banking Customers via SMS Forwarding Malware
https://cloudsek.com/threatintelligence/improvised-modus-operandi-for-targeting-indian-banking-customers-via-sms-forwarding-malware/?utm_source=rss&utm_medium=rss&utm_campaign=improvised-modus-operandi-for-targeting-indian-banking-customers-via-sms-forwarding-malware
Industry:
Financial
Geo:
Indian, India
TTPs:
Tactics: 2
Technics: 0
IOCs:
Domain: 5
File: 2
IP: 1
Hash: 1
Url: 3
Functions Names: 3
CloudSEK - Digital Risk Management Enterprise | Artificial Intelligence based Cybersecurity
Improvised Modus Operandi for Targeting Indian Banking Customers via SMS Forwarding Malware - CloudSEK
CloudSEK team has uncovered a banking trojan (SMS Forwarding Malware, with improvised modus operandi, where the threat actor or a group of threat actors host a simple fake online complaint portal having the domains and target Indian banking customers.
#ParsedReport
22-06-2022
Cybercriminals Exploit Reverse Tunnel Services and URL Shorteners to Launch Large-Scale Phishing Campaigns
https://cloudsek.com/threatintelligence/cybercriminals-exploit-reverse-tunnel-services-and-url-shorteners-to-launch-large-scale-phishing-campaigns/?utm_source=rss&utm_medium=rss&utm_campaign=cybercriminals-exploit-reverse-tunnel-services-and-url-shorteners-to-launch-large-scale-phishing-campaigns
Industry:
Financial
Geo:
Indian
TTPs:
Tactics: 1
Technics: 0
IOCs:
Domain: 3
Url: 6
22-06-2022
Cybercriminals Exploit Reverse Tunnel Services and URL Shorteners to Launch Large-Scale Phishing Campaigns
https://cloudsek.com/threatintelligence/cybercriminals-exploit-reverse-tunnel-services-and-url-shorteners-to-launch-large-scale-phishing-campaigns/?utm_source=rss&utm_medium=rss&utm_campaign=cybercriminals-exploit-reverse-tunnel-services-and-url-shorteners-to-launch-large-scale-phishing-campaigns
Industry:
Financial
Geo:
Indian
TTPs:
Tactics: 1
Technics: 0
IOCs:
Domain: 3
Url: 6
#ParsedReport
22-06-2022
Quantum Software: LNK file-based builders growing in popularity. Possibly associated with Lazarus APT group
https://blog.cyble.com/2022/06/22/quantum-software-lnk-file-based-builders-growing-in-popularity
Actors/Campaigns:
Lazarus
Kimsuky
Threats:
Emotet
Bumblebee
Qakbot
Icedid
Lolbin
Dogwalk_vuln
TTPs:
Tactics: 3
Technics: 5
IOCs:
File: 2
Path: 1
Url: 1
Hash: 2
22-06-2022
Quantum Software: LNK file-based builders growing in popularity. Possibly associated with Lazarus APT group
https://blog.cyble.com/2022/06/22/quantum-software-lnk-file-based-builders-growing-in-popularity
Actors/Campaigns:
Lazarus
Kimsuky
Threats:
Emotet
Bumblebee
Qakbot
Icedid
Lolbin
Dogwalk_vuln
TTPs:
Tactics: 3
Technics: 5
IOCs:
File: 2
Path: 1
Url: 1
Hash: 2
Cyble
Quantum Software: LNK File Builders Gain Popularity
Cyble analyzes Quantum Software, a .lnk -based builder with possible links to the Lazarus APT Group.
#ParsedReport
22-06-2022
Distribution of LockBit ransomware through email impersonating copyright
https://asec-ahnlab-com.translate.goog/ko/35481/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Lockbit (tags: phishing, malware, ransomware)
Malware/mdp.systemmanipulation.m1751 (tags: ransomware)
IOCs:
File: 14
Hash: 2
22-06-2022
Distribution of LockBit ransomware through email impersonating copyright
https://asec-ahnlab-com.translate.goog/ko/35481/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Lockbit (tags: phishing, malware, ransomware)
Malware/mdp.systemmanipulation.m1751 (tags: ransomware)
IOCs:
File: 14
Hash: 2
ASEC BLOG
저작권 사칭 메일을 통한 LockBit 랜섬웨어 유포 - ASEC BLOG
ASEC 분석팀은 이전에 소개한 방식과 동일한 저작권법 위반의 내용으로 사칭한 피싱 메일을 통해 LockBit 랜섬웨어가 다시 유포되고 있음을 확인하였다. 지난 2월 유포되었던 피싱 메일(아래 링크 참고) 본문과 유사한 내용으로 작성되었으며 기존처럼 첨부된 파일명에 압축 파일의 비밀번호를 포함하여 유포하였다. 지원서 및 저작권 관련 메일로 LockBit 랜섬웨어 유포 중 [그림 2]와 같이 피싱 메일에 첨부된 압축 파일 내부에 추가 압축 파일이 존재하는…
#ParsedReport
22-06-2022
New information stealing malware, crack disguise is being distributed
https://asec-ahnlab-com.translate.goog/ko/35549/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Cryptbot_stealer (tags: malware)
Redline_stealer (tags: malware)
Vidar_stealer (tags: malware)
Raccoon_stealer (tags: malware)
Recordbreaker_stealer (tags: malware)
Exodus (tags: malware)
Clipbanker (tags: malware)
Infostealer/win.recordstealer.r498039 (tags: malware)
Infostealer/win.recordstealer.r500009 (tags: malware)
Infostealer/win.passstealer.r496906 (tags: malware)
IOCs:
Url: 9
Coin: 9
Hash: 230
Domain: 26
22-06-2022
New information stealing malware, crack disguise is being distributed
https://asec-ahnlab-com.translate.goog/ko/35549/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Cryptbot_stealer (tags: malware)
Redline_stealer (tags: malware)
Vidar_stealer (tags: malware)
Raccoon_stealer (tags: malware)
Recordbreaker_stealer (tags: malware)
Exodus (tags: malware)
Clipbanker (tags: malware)
Infostealer/win.recordstealer.r498039 (tags: malware)
Infostealer/win.recordstealer.r500009 (tags: malware)
Infostealer/win.passstealer.r496906 (tags: malware)
IOCs:
Url: 9
Coin: 9
Hash: 230
Domain: 26
ASEC BLOG
신종 정보탈취 악성코드, 크랙 위장 유포 중 - ASEC BLOG
ASEC 분석팀은 S/W 크랙 및 인스톨러로 위장하여 유포되는 다양한 악성코드를 소개한 바 있다. CryptBot, RedLine, Vidar 악성코드가 대표적이다. 최근 단일 악성코드 형태의 RedLine 악성코드가 자취를 감추고(드로퍼 유형으로는 유포 중) 신종 정보 탈취 악성코드가 활발히 유포 중이다. 5월 20일 경부터 본격적으로 유포되기 시작하였으며, 해외에서는 해당 악성코드를 “Recordbreaker Stealer”로 분류하고 있으며, Raccoon…
#ParsedReport
23-06-2022
Windows MSDT Zero-day Vulnerability DogWalk Detected by V3
https://asec.ahnlab.com/en/35681
Threats:
Dogwalk_vuln (tags: malware)
Follina_vuln
IOCs:
File: 1
Path: 1
23-06-2022
Windows MSDT Zero-day Vulnerability DogWalk Detected by V3
https://asec.ahnlab.com/en/35681
Threats:
Dogwalk_vuln (tags: malware)
Follina_vuln
IOCs:
File: 1
Path: 1
ASEC BLOG
Windows MSDT Zero-day Vulnerability 'DogWalk' Detected by V3 - ASEC BLOG
On June 8th, a new Windows Zero-day vulnerability named DogWalk was revealed by Hacker News (thehackernews.com). Similar to that of Follina vulnerability that targeted MS Office document files, this is a vulnerability that occurs from MSDT (Microsoft Support…
#ParsedReport
23-06-2022
Spyware vendor targets users in Italy and Kazakhstan
https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan
Threats:
Lightspeed_vuln
Sockpuppet_vuln
Timewaste_vuln
Avecesare_vuln
Clicked_vuln
Industry:
Telco, Government
Geo:
Italy, Kazakhstan
CVEs:
CVE-2020-9907 [Vulners]
Vulners: Score: 9.3, CVSS: 4.6,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- apple ipad os (<13.6)
- apple iphone os (<13.6)
- apple tvos (<13.4.8)
CVE-2021-30883 [Vulners]
Vulners: Score: 9.3, CVSS: 3.1,
Vulners: Exploitation: True
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- apple ipad os (<14.8.1, 15.0, 15.0.1)
- apple iphone os (<14.8.1, 15.0, 15.0.1)
- apple macos (<11.6.1, 12.0)
- apple tvos (<15.1)
- apple watchos (<8.1)
have more...
CVE-2020-3837 [Vulners]
Vulners: Score: 9.3, CVSS: 5.8,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- apple ipados (<13.3.1)
- apple iphone os (<13.3.1)
- apple mac os x (<10.15.3)
- apple tvos (<13.3.1)
- apple watchos (<6.1.2)
have more...
CVE-2018-4344 [Vulners]
Vulners: Score: 9.3, CVSS: 4.4,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.4
X-Force: Patch: Official fix
Soft:
- apple iphone os (<12.0)
- apple mac os x (<10.14)
- apple tvos (<12)
- apple watchos (<5.0)
CVE-2021-30983 [Vulners]
Vulners: Score: 9.3, CVSS: 4.7,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- apple ipados (<15.2)
- apple iphone os (<15.2)
CVE-2019-8605 [Vulners]
Vulners: Score: 9.3, CVSS: 5.7,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- apple iphone os (<12.3)
- apple mac os x (<10.14.5)
- apple tvos (<12.3)
- apple watchos (<5.2.1)
IOCs:
Domain: 18
Hash: 9
IP: 4
23-06-2022
Spyware vendor targets users in Italy and Kazakhstan
https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan
Threats:
Lightspeed_vuln
Sockpuppet_vuln
Timewaste_vuln
Avecesare_vuln
Clicked_vuln
Industry:
Telco, Government
Geo:
Italy, Kazakhstan
CVEs:
CVE-2020-9907 [Vulners]
Vulners: Score: 9.3, CVSS: 4.6,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- apple ipad os (<13.6)
- apple iphone os (<13.6)
- apple tvos (<13.4.8)
CVE-2021-30883 [Vulners]
Vulners: Score: 9.3, CVSS: 3.1,
Vulners: Exploitation: True
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- apple ipad os (<14.8.1, 15.0, 15.0.1)
- apple iphone os (<14.8.1, 15.0, 15.0.1)
- apple macos (<11.6.1, 12.0)
- apple tvos (<15.1)
- apple watchos (<8.1)
have more...
CVE-2020-3837 [Vulners]
Vulners: Score: 9.3, CVSS: 5.8,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- apple ipados (<13.3.1)
- apple iphone os (<13.3.1)
- apple mac os x (<10.15.3)
- apple tvos (<13.3.1)
- apple watchos (<6.1.2)
have more...
CVE-2018-4344 [Vulners]
Vulners: Score: 9.3, CVSS: 4.4,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.4
X-Force: Patch: Official fix
Soft:
- apple iphone os (<12.0)
- apple mac os x (<10.14)
- apple tvos (<12)
- apple watchos (<5.0)
CVE-2021-30983 [Vulners]
Vulners: Score: 9.3, CVSS: 4.7,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- apple ipados (<15.2)
- apple iphone os (<15.2)
CVE-2019-8605 [Vulners]
Vulners: Score: 9.3, CVSS: 5.7,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- apple iphone os (<12.3)
- apple mac os x (<10.14.5)
- apple tvos (<12.3)
- apple watchos (<5.2.1)
IOCs:
Domain: 18
Hash: 9
IP: 4
Google
Spyware vendor targets users in Italy and Kazakhstan
Today, alongside Google’s Project Zero, we are detailing capabilities provided by RCS Labs, an Italian vendor that uses a combination of tactics, including atypical drive-by downloads as initial infection vectors to target mobile users on both iOS and Android.
#ParsedReport
23-06-2022
Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems
https://us-cert.cisa.gov/ncas/current-activity/2022/06/23/malicious-cyber-actors-continue-exploit-log4shell-vmware-horizon
Actors/Campaigns:
Karakurt
Threats:
Log4shell_vuln
Spring4shell
Geo:
China
CVEs:
CVE-2021-44228 [Vulners]
Vulners: Score: 9.3, CVSS: 4.0,
Vulners: Exploitation: True
X-Force: Risk: 10
X-Force: Patch: Official fix
Soft:
- apache log4j (2.0, 2.0, 2.0, 2.0, <2.15.0, <2.3.1, <2.12.2)
- siemens sppa-t3000 ses3000 firmware (*)
- siemens logo\! soft comfort (*)
- siemens spectrum power 4 (4.70, 4.70, <4.70, 4.70)
- siemens siveillance control pro (*)
have more...
23-06-2022
Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems
https://us-cert.cisa.gov/ncas/current-activity/2022/06/23/malicious-cyber-actors-continue-exploit-log4shell-vmware-horizon
Actors/Campaigns:
Karakurt
Threats:
Log4shell_vuln
Spring4shell
Geo:
China
CVEs:
CVE-2021-44228 [Vulners]
Vulners: Score: 9.3, CVSS: 4.0,
Vulners: Exploitation: True
X-Force: Risk: 10
X-Force: Patch: Official fix
Soft:
- apache log4j (2.0, 2.0, 2.0, 2.0, <2.15.0, <2.3.1, <2.12.2)
- siemens sppa-t3000 ses3000 firmware (*)
- siemens logo\! soft comfort (*)
- siemens spectrum power 4 (4.70, 4.70, <4.70, 4.70)
- siemens siveillance control pro (*)
have more...
www.cisa.gov
Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems | CISA
CISA and the United States Coast Guard Cyber Command (CGCYBER) have released a joint Cybersecurity Advisory (CSA) to warn network defenders that cyber threat actors, including state-sponsored advanced persistent threat (APT) actors, have continued to exploit…
#ParsedReport
24-06-2022
eSentire Threat Intelligence Malware Analysis: PINGPULL RAT
https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-pingpull-rat
Threats:
Pingpull (tags: malware, backdoor, rat, scan)
Log4shell_vuln
Netstat_tool
Industry:
Government, Telco
Geo:
Russia, Apac, Asia, America, Emea, Africa, Vietnam
IOCs:
File: 9
Hash: 6
IP: 1
Domain: 8
Functions Names: 11
YARA: Found
24-06-2022
eSentire Threat Intelligence Malware Analysis: PINGPULL RAT
https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-pingpull-rat
Threats:
Pingpull (tags: malware, backdoor, rat, scan)
Log4shell_vuln
Netstat_tool
Industry:
Government, Telco
Geo:
Russia, Apac, Asia, America, Emea, Africa, Vietnam
IOCs:
File: 9
Hash: 6
IP: 1
Domain: 8
Functions Names: 11
YARA: Found
eSentire
eSentire Threat Intelligence Malware Analysis: PINGPULL RAT
Dive deeper into the technical details gathered during eSentire’s Threat Response Unit (TRU) team’s research and threat analysis of the PINGPULL Remote Access Tool.
#ParsedReport
24-06-2022
LockBit Ransomware Disguised as Copyright Claim E-mail Being Distributed
https://asec.ahnlab.com/en/35822
Threats:
Lockbit (tags: ransomware, malware, phishing)
Malware/mdp.systemmanipulation.m1751 (tags: ransomware)
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 14
Hash: 2
24-06-2022
LockBit Ransomware Disguised as Copyright Claim E-mail Being Distributed
https://asec.ahnlab.com/en/35822
Threats:
Lockbit (tags: ransomware, malware, phishing)
Malware/mdp.systemmanipulation.m1751 (tags: ransomware)
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 14
Hash: 2
ASEC BLOG
LockBit Ransomware Disguised as Copyright Claim E-mail Being Distributed - ASEC BLOG
The ASEC analysis team has once again discovered the distribution of LockBit ransomware using phishing e-mail, and disguising itself as copyright claims e-mail which was introduced in the previous blog. The filename of the attachment in e-mail had password…
#ParsedReport
24-06-2022
Socgholish to Cobalt Strike in 10 Minutes
https://www.esentire.com/blog/socgholish-to-cobalt-strike-in-10-minutes
Threats:
Cobalt_strike (tags: malware, phishing)
Socgholish_loader (tags: malware, phishing)
Kerberoasting_technique
Gootkit
Solarmarker
Geo:
America, Emea, Africa, Apac
IOCs:
File: 7
Hash: 2
Domain: 3
24-06-2022
Socgholish to Cobalt Strike in 10 Minutes
https://www.esentire.com/blog/socgholish-to-cobalt-strike-in-10-minutes
Threats:
Cobalt_strike (tags: malware, phishing)
Socgholish_loader (tags: malware, phishing)
Kerberoasting_technique
Gootkit
Solarmarker
Geo:
America, Emea, Africa, Apac
IOCs:
File: 7
Hash: 2
Domain: 3
eSentire
Socgholish to Cobalt Strike in 10 Minutes
Learn about the Socgholish malware including what we found, how we found it and recommendations from our Threat Response Unit (TRU) to protect your business from this cyber threat.
#ParsedReport
24-06-2022
NightLion Worm Strikes Again. Worm targeting openly accessible Elasticsearch Servers
https://blog.cyble.com/2022/06/24/nightlion-worm-strikes-again
Geo:
China
24-06-2022
NightLion Worm Strikes Again. Worm targeting openly accessible Elasticsearch Servers
https://blog.cyble.com/2022/06/24/nightlion-worm-strikes-again
Geo:
China
Cyble
“NightLion” Worm Strikes Again
Cyble analyzes the resurfaced "NightLion", a worm that targets vulnerable, openly-accessible Elasticsearch Servers.
#ParsedReport
24-06-2022
Malware Analysis Report (AR22-174B)
https://us-cert.cisa.gov/ncas/analysis-reports/ar22-174b
Threats:
Chapak (tags: malware)
Nukesped_rat (tags: malware)
Trojan/win.generic (tags: malware)
Trojan.win64.injector (tags: malware)
Trojan/win.pws (tags: malware)
IOCs:
Hash: 57
Email: 3
IP: 12
Functions Names: 1
24-06-2022
Malware Analysis Report (AR22-174B)
https://us-cert.cisa.gov/ncas/analysis-reports/ar22-174b
Threats:
Chapak (tags: malware)
Nukesped_rat (tags: malware)
Trojan/win.generic (tags: malware)
Trojan.win64.injector (tags: malware)
Trojan/win.pws (tags: malware)
IOCs:
Hash: 57
Email: 3
IP: 12
Functions Names: 1
www.cisa.gov
MAR-10382580-1.v1 – Unidentified RAT | CISA
Notification This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product…
#ParsedReport
24-06-2022
Cybereason vs. Black Basta Ransomware
https://www.cybereason.com/blog/cybereason-vs.-black-basta-ransomware
Actors/Campaigns:
Blackmatter
Threats:
Blackbasta (tags: ransomware, malware, phishing)
Qakbot (tags: ransomware)
Megacortex (tags: ransomware)
Doppelpaymer (tags: ransomware)
Conti (tags: ransomware)
Egregor (tags: ransomware)
Psexec_tool (tags: ransomware)
Lockbit
Cheerscrypt
Ryuk
Revil
Eternal_petya
Industry:
Telco, Healthcare, Transport, Government, Financial
Geo:
Australia, Russian, Canada
TTPs:
Tactics: 3
Technics: 0
IOCs:
Domain: 2
Path: 1
File: 4
Hash: 16
Url: 2
24-06-2022
Cybereason vs. Black Basta Ransomware
https://www.cybereason.com/blog/cybereason-vs.-black-basta-ransomware
Actors/Campaigns:
Blackmatter
Threats:
Blackbasta (tags: ransomware, malware, phishing)
Qakbot (tags: ransomware)
Megacortex (tags: ransomware)
Doppelpaymer (tags: ransomware)
Conti (tags: ransomware)
Egregor (tags: ransomware)
Psexec_tool (tags: ransomware)
Lockbit
Cheerscrypt
Ryuk
Revil
Eternal_petya
Industry:
Telco, Healthcare, Transport, Government, Financial
Geo:
Australia, Russian, Canada
TTPs:
Tactics: 3
Technics: 0
IOCs:
Domain: 2
Path: 1
File: 4
Hash: 16
Url: 2
Cybereason
Cybereason vs. Black Basta Ransomware
In just two months, Black Basta has added nearly 50 victims to their list, making them one of the more prominent ransomware gangs. The attackers infiltrate and move laterally throughout the network in a fully-developed RansomOps attack. The Cybereason Nocturnus…
#ParsedReport
24-06-2022
Matanbuchus Loader Resurfaces. Malware Variant Delivering Cobalt Strike Beacons via Spam Campaigns
https://blog.cyble.com/2022/06/23/matanbuchus-loader-resurfaces
Actors/Campaigns:
Belialdemon
Threats:
Cobalt_strike (tags: malware, phishing, spam, rat)
Beacon (tags: rat, phishing, malware, spam)
TTPs:
Tactics: 4
Technics: 7
IOCs:
Path: 4
Url: 6
File: 5
Hash: 11
Functions Names: 7
24-06-2022
Matanbuchus Loader Resurfaces. Malware Variant Delivering Cobalt Strike Beacons via Spam Campaigns
https://blog.cyble.com/2022/06/23/matanbuchus-loader-resurfaces
Actors/Campaigns:
Belialdemon
Threats:
Cobalt_strike (tags: malware, phishing, spam, rat)
Beacon (tags: rat, phishing, malware, spam)
TTPs:
Tactics: 4
Technics: 7
IOCs:
Path: 4
Url: 6
File: 5
Hash: 11
Functions Names: 7
#ParsedReport
24-06-2022
ASEC Weekly Malware Statistics ( 20220613 \~ 20220619 )
https://asec-ahnlab-com.translate.goog/ko/35547/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Agent_tesla (tags: malware)
Azorult (tags: malware)
Formbook (tags: malware)
Lokibot_stealer (tags: malware)
Avemaria_rat (tags: malware)
Emotet (tags: malware)
Qakbot (tags: malware)
Trickbot (tags: malware)
Smoker_loader (tags: malware)
Industry:
Transport, Financial
Geo:
Korea
IOCs:
Domain: 18
Email: 3
File: 21
Url: 23
24-06-2022
ASEC Weekly Malware Statistics ( 20220613 \~ 20220619 )
https://asec-ahnlab-com.translate.goog/ko/35547/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Agent_tesla (tags: malware)
Azorult (tags: malware)
Formbook (tags: malware)
Lokibot_stealer (tags: malware)
Avemaria_rat (tags: malware)
Emotet (tags: malware)
Qakbot (tags: malware)
Trickbot (tags: malware)
Smoker_loader (tags: malware)
Industry:
Transport, Financial
Geo:
Korea
IOCs:
Domain: 18
Email: 3
File: 21
Url: 23
ASEC BLOG
ASEC 주간 악성코드 통계 ( 20220613 ~ 20220619 ) - ASEC BLOG
ASEC 분석팀에서는 ASEC 자동 분석 시스템 RAPIT 을 활용하여 알려진 악성코드들에 대한 분류 및 대응을 진행하고 있다. 본 포스팅에서는 2022년 6월 13일 월요일부터 6월 19일 일요일까지 한 주간 수집된 악성코드의 통계를 정리한다. 대분류 상으로는 인포스틸러가 63.8%로 1위를 차지하였으며, 그 다음으로는 백도어가 17.8%, 다운로더 8.9%, 뱅킹 악성코드7.5%, 랜섬웨어 1.9%로 집계되었다. Top 1 – AgentTesla 인포스틸러…
#ParsedReport
24-06-2022
Keona Clipper Leverages Telegram for Anonymity. Evasive Malware Targeting Cryptocurrency Users
https://blog.cyble.com/2022/06/22/keona-clipper-leverages-telegram-for-anonymity
Threats:
Beacon
Industry:
Financial
TTPs:
Tactics: 4
Technics: 5
IOCs:
Hash: 11
File: 2
Functions Names: 2
24-06-2022
Keona Clipper Leverages Telegram for Anonymity. Evasive Malware Targeting Cryptocurrency Users
https://blog.cyble.com/2022/06/22/keona-clipper-leverages-telegram-for-anonymity
Threats:
Beacon
Industry:
Financial
TTPs:
Tactics: 4
Technics: 5
IOCs:
Hash: 11
File: 2
Functions Names: 2
Cyble
Cyble - Keona Clipper Leverages Telegram For Anonymity
Cyble analyzes Keona Clipper - an evasive malware variant targeting crypto-wallets and cryptocurrency users.
#ParsedReport
24-06-2022
APT-C-56
https://mp-weixin-qq-com.translate.goog/s/YKSedzm7haO0vPttIqsUAQ?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Crimson_rat (tags: rat)
IOCs:
IP: 1
Hash: 5
24-06-2022
APT-C-56
https://mp-weixin-qq-com.translate.goog/s/YKSedzm7haO0vPttIqsUAQ?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Crimson_rat (tags: rat)
IOCs:
IP: 1
Hash: 5
微信公众平台
APT-C-56（透明部落）伪装印度国防部邮件攻击的跟踪简报
360高级威胁研究院近期捕获到了透明部落攻击印度国防部的文档，与此前类似的是，恶意文档最终仍释放CrimsonRAT