CTT Report Hub

Немного примеров простых вопросов:

Q: What threats are relevant for telecom companies?

A: The relevant threats for telecom companies include:

1. **LightBasin (aka UNC1945)**: This Iranian hacking group infiltrated 13 telecommunications operators to collect signal intelligence and highly sensitive information such as subscriber information and call metadata. [Source: 20220505_intezer_com_report_0x13d68844]

2. **LAPSUS$**: This cybercrime group breached T-Mobile multiple times in March 2022, stealing source code for various projects. [Source: 20220505_intezer_com_report_0x13d68844]

3. **VermilionStrike**: A sophisticated threat targeting telecom companies, discovered by Intezer’s research team. It is a re-implementation of Cobalt Strike Beacon targeting both Linux and Windows systems. [Source: 20220505_intezer_com_report_0x13d68844]

4. **Lyceum APT (aka HEXANE, Spirlin)**: This group targets energy organizations and telecommunication in the Middle East and has expanded to include internet service providers and government agencies. [Source: 20220905_rewterz_com_report_0xf535e93, 20220905_rewterz_com_report_0x35e3c06c]

5. **Gamaredon APT**: A Russia-backed APT group targeting telecom companies in Europe and Africa, using various methods including phishing emails and malicious documents. [Source: 20220919_rewterz_com_report_0x58298aad, 20221003_rewterz_com_report_0xc432b14d, 20221010_rewterz_com_report_0x1065ef02]

6. **Killnet**: A pro-Russian hacktivist group known for DDoS campaigns against countries supporting Ukraine, including attacks on telecom infrastructure. [Source: 20221216_socradar_io_report_0xeec15888]

7. **Stormous**: A pro-Russian ransomware group targeting the US and Ukraine, with potential implications for telecom companies due to their broad targeting strategy. [Source: 20220430_trustwave_com_report_0x976617be]

8. **LockBit 3.0**: A ransomware gang that has targeted various sectors, including telecom, with sophisticated ransomware attacks. [Source: 20221116_explore_avertium_com_report_0x7ac2a37d]

These threats highlight the need for robust cybersecurity measures, including monitoring for phishing attempts, securing cloud and IoT devices, and implementing strong access controls and incident response plans.

Q: What about 202.182.123[.]185 ?

A: The IP address 202.182.123[.]185 is identified as a staging server used between March and April 2021. It was leveraged by SessionManager operators to download additional tools such as a PowerSploit-based reflective loader for the Mimikatz DLL, Mimikatz SSP, ProcDump, and a legitimate memory dump tool from Avast. This IP address is associated with the activities of the SessionManager backdoor, which is a malicious IIS module used for espionage operations.

**Relevant Document:**
- 20220630_securelist_com_report_0x745400aa

Q: What targets of APT34?

A: APT34, also known as OilRig, COBALT GYPSY, IRN2, and HELIX KITTEN, is an Iranian threat group that has targeted Middle Eastern countries and victims worldwide since at least 2014. The group is known to focus on the financial, governmental, energy, chemical, and telecommunication sectors.

**Sources:**
- 20220510_blog_malwarebytes_com_report_0x6854fe7f
- 20221012_mandiant_com_report_0x5d15cb45
- 20220529_rewterz_com_report_0xe1e078f5

279 views11:44