#ParsedReport
28-06-2022
SpiderLabs Blog. Interactive Phishing Mark II: Messenger Chatbot Leveraged in a New Facebook-Themed Spam
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/interactive-phishing-mark-ii-messenger-chatbot-leveraged-in-a-new-facebook-themed-spam
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 1
Url: 6
28-06-2022
SpiderLabs Blog. Interactive Phishing Mark II: Messenger Chatbot Leveraged in a New Facebook-Themed Spam
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/interactive-phishing-mark-ii-messenger-chatbot-leveraged-in-a-new-facebook-themed-spam
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 1
Url: 6
Trustwave
Interactive Phishing Mark II: Messenger Chatbot Leveraged in a New Facebook-Themed Spam | Trustwave
Facebook Messenger is one of the most popular messaging platform in the world, amassing 988 million monthly active users as of January 2022 according to Statista.
#ParsedReport
28-06-2022
Raccoon Stealer v2 Part 1: The return of the dead
https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead
Threats:
Raccoon_stealer (tags: stealer, rat, scan, vpn, malware)
Recordbreaker_stealer
Mars_stealer (tags: malware)
Geo:
Russian, Ukraine
TTPs:
Tactics: 6
Technics: 17
IOCs:
Domain: 1
Email: 1
File: 5
Registry: 2
IP: 86
Hash: 21
Functions Names: 1
Links:
28-06-2022
Raccoon Stealer v2 Part 1: The return of the dead
https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead
Threats:
Raccoon_stealer (tags: stealer, rat, scan, vpn, malware)
Recordbreaker_stealer
Mars_stealer (tags: malware)
Geo:
Russian, Ukraine
TTPs:
Tactics: 6
Technics: 17
IOCs:
Domain: 1
Email: 1
File: 5
Registry: 2
IP: 86
Hash: 21
Functions Names: 1
Links:
https://github.com/SEKOIA-IO/Community/blob/main/IOCs/raccoonstealer/raccoon\_stealer\_iocs\_20220628.csvSekoia
Raccoon Stealer v2 - Part 1: The return of the dead
On June 10, 2022, Sekoia analysts stumbled upon active servers hosting a web page named “Raccoon Stealer 2.0”. Discover their research.
#ParsedReport
28-06-2022
AsyncRAT malware being distributed targeting vulnerable MySQL servers
https://asec-ahnlab-com.translate.goog/ko/35866/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Asyncrat_rat (tags: rat, cryptomining, malware)
Cobalt_strike (tags: malware)
Remcos_rat (tags: malware)
Cringe_rat (tags: malware)
Gh0st_rat (tags: malware)
Metasploit_tool (tags: malware)
Trojan/win32.rl_generic.c4239825 (tags: malware)
Trojan/win32.inject.c500093 (tags: malware)
IOCs:
Hash: 2
Url: 1
IP: 3
28-06-2022
AsyncRAT malware being distributed targeting vulnerable MySQL servers
https://asec-ahnlab-com.translate.goog/ko/35866/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Asyncrat_rat (tags: rat, cryptomining, malware)
Cobalt_strike (tags: malware)
Remcos_rat (tags: malware)
Cringe_rat (tags: malware)
Gh0st_rat (tags: malware)
Metasploit_tool (tags: malware)
Trojan/win32.rl_generic.c4239825 (tags: malware)
Trojan/win32.inject.c500093 (tags: malware)
IOCs:
Hash: 2
Url: 1
IP: 3
ASEC BLOG
취약한 MySQL 서버를 대상으로 유포 중인 AsyncRAT 악성코드 - ASEC BLOG
ShadowServer 재단은 최근 전 세계에서 외부에 노출되어 있는 MySQL 서버의 수가 약 360만 대 존재한다는 보고서를 공개하였다. MySQL 서버는 MS-SQL 서버와 함께 대표적인 데이터베이스 서버로서 기업이나 사용자 환경에서 대량의 데이터를 관리하는 기능을 제공한다. 일반적으로 윈도우 환경에서는 MS-SQL이 대표적이지만 리눅스 환경에서는 MySQL이 아직까지 많이 사용되고 있다. ASEC 분석팀에서는 취약한 데이터베이스 서버를 대상으로…
#ParsedReport
29-06-2022
ASEC Weekly Malware Statistics (June 20th, 2022 June 26th, 2022)
https://asec.ahnlab.com/en/36042
Threats:
Agent_tesla (tags: malware)
Cloudeye (tags: malware)
Formbook (tags: malware)
Remcos_rat (tags: malware)
Nanocore_rat (tags: malware)
Clipboard_grabbing_technique (tags: malware)
Emotet (tags: malware)
Qakbot (tags: malware)
Trickbot (tags: malware)
Industry:
Financial
Geo:
Asian
IOCs:
Domain: 4
IP: 4
Email: 6
File: 22
Url: 26
29-06-2022
ASEC Weekly Malware Statistics (June 20th, 2022 June 26th, 2022)
https://asec.ahnlab.com/en/36042
Threats:
Agent_tesla (tags: malware)
Cloudeye (tags: malware)
Formbook (tags: malware)
Remcos_rat (tags: malware)
Nanocore_rat (tags: malware)
Clipboard_grabbing_technique (tags: malware)
Emotet (tags: malware)
Qakbot (tags: malware)
Trickbot (tags: malware)
Industry:
Financial
Geo:
Asian
IOCs:
Domain: 4
IP: 4
Email: 6
File: 22
Url: 26
ASEC BLOG
ASEC Weekly Malware Statistics (June 20th, 2022 - June 26th, 2022) - ASEC BLOG
The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from June 20th, 2022 (Monday) to June 26th, 2022 (Sunday). For the main category, info-stealer…
#ParsedReport
29-06-2022
Forced Chrome extensions get removed, keep reappearing
https://blog.malwarebytes.com/threat-analysis/2022/06/forced-chrome-extensions-keep-reappearing
IOCs:
File: 8
Domain: 5
Registry: 1
29-06-2022
Forced Chrome extensions get removed, keep reappearing
https://blog.malwarebytes.com/threat-analysis/2022/06/forced-chrome-extensions-keep-reappearing
IOCs:
File: 8
Domain: 5
Registry: 1
Malwarebytes Labs
Forced Chrome extensions get removed, keep reappearing
A family of forced Chrome extensions can't be removed because of a policy change that tells users "Your browser is managed"
#ParsedReport
29-06-2022
YTStealer Malware: YouTube Cookies! Om Nom Nom Nom
https://www.intezer.com/blog/research/ytstealer-malware-youtube-cookies
Actors/Campaigns:
Nitro
Threats:
Ytstealer (tags: stealer, malware, ransomware)
Redline_stealer
Vidar_stealer
Sanny
Industry:
Petroleum, Entertainment
Geo:
Iranian, American, Mexico
TTPs:
Tactics: 1
Technics: 0
IOCs:
Domain: 2
Functions Names: 1
Links:
29-06-2022
YTStealer Malware: YouTube Cookies! Om Nom Nom Nom
https://www.intezer.com/blog/research/ytstealer-malware-youtube-cookies
Actors/Campaigns:
Nitro
Threats:
Ytstealer (tags: stealer, malware, ransomware)
Redline_stealer
Vidar_stealer
Sanny
Industry:
Petroleum, Entertainment
Geo:
Iranian, American, Mexico
TTPs:
Tactics: 1
Technics: 0
IOCs:
Domain: 2
Functions Names: 1
Links:
https://github.com/intezer/community-intellignce/blob/master/YTStealer\_hashes.txthttps://github.com/p3tr0v/chacalIntezer
YTStealer Malware: “YouTube Cookies! Om Nom Nom Nom” - Intezer
YTStealer is a new malware we believe is sold as a service on the Dark Web for stealing authentication cookies from YouTube content creators.
#ParsedReport
30-06-2022
The Ryuk Ransomware
https://www.telsy.com/the-ryuk-ransomware
Actors/Campaigns:
Wizard_spider (motivation: cyber_criminal)
Unc1878 (motivation: cyber_criminal)
Threats:
Ryuk (tags: phishing, ransomware, trojan, malware, dropper)
Hermes (tags: ransomware)
Trickbot (tags: trojan, malware, ransomware)
Z_loader
Bazarbackdoor
Cobalt_strike
Beacon
Zerologon_vuln
Industry:
Financial, Healthcare
Geo:
Russian
IOCs:
File: 3
Path: 2
30-06-2022
The Ryuk Ransomware
https://www.telsy.com/the-ryuk-ransomware
Actors/Campaigns:
Wizard_spider (motivation: cyber_criminal)
Unc1878 (motivation: cyber_criminal)
Threats:
Ryuk (tags: phishing, ransomware, trojan, malware, dropper)
Hermes (tags: ransomware)
Trickbot (tags: trojan, malware, ransomware)
Z_loader
Bazarbackdoor
Cobalt_strike
Beacon
Zerologon_vuln
Industry:
Financial, Healthcare
Geo:
Russian
IOCs:
File: 3
Path: 2
Telsy
The Ryuk Ransomware - Telsy
Ryuk tops the list of the most dangerous ransomware attacks and has successfully attacked sectors and companies worldwide.
#ParsedReport
30-06-2022
Raccoon Stealer v2 Part 2: In-depth analysis
https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis
Threats:
Raccoon_stealer (tags: malware, rat, trojan, stealer, cryptomining, scan)
Agent_tesla
Formbook
Redline_stealer
Vidar_stealer
Industry:
Financial
Geo:
Ukraine, Russia
TTPs:
Tactics: 6
Technics: 17
IOCs:
Domain: 1
File: 15
Registry: 2
Functions Names: 2
YARA: Found
Links:
30-06-2022
Raccoon Stealer v2 Part 2: In-depth analysis
https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis
Threats:
Raccoon_stealer (tags: malware, rat, trojan, stealer, cryptomining, scan)
Agent_tesla
Formbook
Redline_stealer
Vidar_stealer
Industry:
Financial
Geo:
Ukraine, Russia
TTPs:
Tactics: 6
Technics: 17
IOCs:
Domain: 1
File: 15
Registry: 2
Functions Names: 2
YARA: Found
Links:
https://github.com/SEKOIA-IO/Community/blob/main/scripts/raccoon\_stealer\_v2\_c2\_extrator.pySekoia.io Blog
Raccoon Stealer v2 - Part 2: In-depth analysis
Raccoon stealer 2.0 targets various crypto wallets, retrieves cookies and saves credit card numbers from browsers (Edge, Firefox and Chrome).
#ParsedReport
30-06-2022
Countering hack-for-hire groups
https://blog.google/threat-analysis-group/countering-hack-for-hire-groups
Actors/Campaigns:
Voidbalaur
Threats:
Gophish_tool
Njrat_rat
Houdini_rat
Industry:
Education, Government, Healthcare, Ngo, Financial, Telco
Geo:
Israel, Arab, Nigeria, Bahrain, Indian, Cyprus, India, Saudi, Russia, Arabia, Russian, Africa
IOCs:
Domain: 36
Links:
30-06-2022
Countering hack-for-hire groups
https://blog.google/threat-analysis-group/countering-hack-for-hire-groups
Actors/Campaigns:
Voidbalaur
Threats:
Gophish_tool
Njrat_rat
Houdini_rat
Industry:
Education, Government, Healthcare, Ngo, Financial, Telco
Geo:
Israel, Arab, Nigeria, Bahrain, Indian, Cyprus, India, Saudi, Russia, Arabia, Russian, Africa
IOCs:
Domain: 36
Links:
https://github.com/kgretzky/evilginx2https://github.com/gophish/gophishGoogle
Countering hack-for-hire groups
As part of TAG's mission to counter serious threats to Google and our users, we've published analysis on a range of persistent threats including government-backed attackers, commercial surveillance vendors, and serious criminal operators. Today, we're sharing…
#ParsedReport
30-06-2022
"Validator" - Trojan horse of the NSA (APT-C-40)
https://www-anquanke-com.translate.goog/post/id/275517?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Apt-c-40
Threats:
Quantum_tool
Foxacid_tool
Industry:
Government
Geo:
China
IOCs:
File: 14
IP: 2
Hash: 1
Registry: 6
30-06-2022
"Validator" - Trojan horse of the NSA (APT-C-40)
https://www-anquanke-com.translate.goog/post/id/275517?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Apt-c-40
Threats:
Quantum_tool
Foxacid_tool
Industry:
Government
Geo:
China
IOCs:
File: 14
IP: 2
Hash: 1
Registry: 6
www-anquanke-com.translate.goog
“验证器”（Validator）— 美国国家安全局NSA（APT—C—40）的木马尖兵 - 安全客，安全资讯平台
根据斯诺登曝光文档描述，“验证器”（Validator）是与美国国家安全局（NSA）接入技术行动处（TAO）“酸狐狸”（FOXACID）攻击武器平台相配套的专用木马程序。
#ParsedReport
30-06-2022
The SessionManager IIS backdoor
https://securelist.com/the-sessionmanager-iis-backdoor/106868
Actors/Campaigns:
Volatile_cedar
Threats:
Gelsemium (tags: malware, backdoor)
Owowa
Proxylogon_exploit (tags: malware)
Owlproxy
Mimikatz
Sessionmanager
Industry:
Ngo, Healthcare, Petroleum, Government, Transport
Geo:
Taiwan, Thailand, Argentina, Turkey, Indonesia, Malaysia, Kenya, Guinea, Asia, Armenia, Vietnam, China, Kuwait, Russia, Pakistan, Russian, America, Africa, Nigeria, Arabia, Poland, Djibouti, Saudi
IOCs:
Hash: 10
Path: 18
File: 1
IP: 2
Links:
30-06-2022
The SessionManager IIS backdoor
https://securelist.com/the-sessionmanager-iis-backdoor/106868
Actors/Campaigns:
Volatile_cedar
Threats:
Gelsemium (tags: malware, backdoor)
Owowa
Proxylogon_exploit (tags: malware)
Owlproxy
Mimikatz
Sessionmanager
Industry:
Ngo, Healthcare, Petroleum, Government, Transport
Geo:
Taiwan, Thailand, Argentina, Turkey, Indonesia, Malaysia, Kenya, Guinea, Asia, Armenia, Vietnam, China, Kuwait, Russia, Pakistan, Russian, America, Africa, Nigeria, Arabia, Poland, Djibouti, Saudi
IOCs:
Hash: 10
Path: 18
File: 1
IP: 2
Links:
https://github.com/3gstudent/Hook-PasswordChangeNotifyhttps://github.com/dionach/stripheaders#ParsedReport
30-06-2022
Bahamut Android Malware returns with New Spying Capabilities. Android Spyware Distributed Via Phishing Campaigns
https://blog.cyble.com/2022/06/29/bahamut-android-malware-returns-with-new-spying-capabilities
Threats:
Bahamut (tags: spyware, phishing, malware)
Silence (tags: phishing, spyware)
Industry:
Financial
Geo:
Asia
TTPs:
Tactics: 3
Technics: 1
IOCs:
Url: 4
File: 2
Hash: 3
30-06-2022
Bahamut Android Malware returns with New Spying Capabilities. Android Spyware Distributed Via Phishing Campaigns
https://blog.cyble.com/2022/06/29/bahamut-android-malware-returns-with-new-spying-capabilities
Threats:
Bahamut (tags: spyware, phishing, malware)
Silence (tags: phishing, spyware)
Industry:
Financial
Geo:
Asia
TTPs:
Tactics: 3
Technics: 1
IOCs:
Url: 4
File: 2
Hash: 3
#ParsedReport
30-06-2022
Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit. QakBots infection chain
https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html
Threats:
Blackbasta (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Qakbot (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Printnightmare_vuln (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Megacortex (tags: ransomware, trojan)
Egregor (tags: ransomware, trojan)
Revil (tags: ransomware, trojan)
Follina_vuln (tags: ransomware, trojan)
Cobalt_strike
Coroxy (tags: ransomware, backdoor)
Netcat_tool
Trojan.win64.quaknightmare.yacejt
Industry:
Financial
CVEs:
CVE-2021-34527 [Vulners]
Vulners: Score: 9.0, CVSS: 3.3,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -)
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 21h1, 1809, 1909, 2004)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-, 20h2, 2004)
have more...
CVE-2022-30190 [Vulners]
Vulners: Score: 9.3, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 1809, 20h2, 21h1, 21h2)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
- microsoft windows server 2008 (-, r2)
have more...
IOCs:
File: 4
Hash: 19
IP: 20
30-06-2022
Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit. QakBots infection chain
https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html
Threats:
Blackbasta (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Qakbot (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Printnightmare_vuln (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Megacortex (tags: ransomware, trojan)
Egregor (tags: ransomware, trojan)
Revil (tags: ransomware, trojan)
Follina_vuln (tags: ransomware, trojan)
Cobalt_strike
Coroxy (tags: ransomware, backdoor)
Netcat_tool
Trojan.win64.quaknightmare.yacejt
Industry:
Financial
CVEs:
CVE-2021-34527 [Vulners]
Vulners: Score: 9.0, CVSS: 3.3,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -)
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 21h1, 1809, 1909, 2004)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-, 20h2, 2004)
have more...
CVE-2022-30190 [Vulners]
Vulners: Score: 9.3, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 1809, 20h2, 21h1, 21h2)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
- microsoft windows server 2008 (-, r2)
have more...
IOCs:
File: 4
Hash: 19
IP: 20
Trend Micro
Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit
We look into a recent attack orchestrated by the Black Basta ransomware group that used the banking trojan QakBot as a means of entry and movement and took advantage of the PrintNightmare vulnerability to perform privileged file operations.
#ParsedReport
30-06-2022
Fat Cats
https://blog.group-ib.com/blackcat
Actors/Campaigns:
Blackcat
Darkside
Blackmatter
Threats:
Revil
Lockbit
Conti
Proxyshell_vuln
Screenconnect_tool
Cobalt_strike
Procdump_tool
Minidump_tool
Adrecon
Putty_tool
Exmatter_tool
Psexec_tool
Wevtutil_tool
Industry:
Financial, Media, Education
CVEs:
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9.1
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: 6.6
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
TTPs:
Tactics: 12
Technics: 58
IOCs:
File: 2
Functions Names: 1
Links:
30-06-2022
Fat Cats
https://blog.group-ib.com/blackcat
Actors/Campaigns:
Blackcat
Darkside
Blackmatter
Threats:
Revil
Lockbit
Conti
Proxyshell_vuln
Screenconnect_tool
Cobalt_strike
Procdump_tool
Minidump_tool
Adrecon
Putty_tool
Exmatter_tool
Psexec_tool
Wevtutil_tool
Industry:
Financial, Media, Education
CVEs:
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9.1
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: 6.6
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
TTPs:
Tactics: 12
Technics: 58
IOCs:
File: 2
Functions Names: 1
Links:
https://github.com/rivitna/Malware/tree/main/BlackCatGroup-IB
Fat Cats
An analysis of the BlackCat ransomware affiliate program
#ParsedReport
30-06-2022
Distribution of AppleSeed disguised as order form and written agreement
https://asec-ahnlab-com.translate.goog/ko/35781/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Kimsuky
Threats:
Appleseed (tags: backdoor, dropper, phishing, malware)
Geo:
Korean
IOCs:
File: 2
Hash: 3
Coin: 1
30-06-2022
Distribution of AppleSeed disguised as order form and written agreement
https://asec-ahnlab-com.translate.goog/ko/35781/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Kimsuky
Threats:
Appleseed (tags: backdoor, dropper, phishing, malware)
Geo:
Korean
IOCs:
File: 2
Hash: 3
Coin: 1
ASEC
발주서, 품의서를 위장한 AppleSeed 유포 - ASEC
ASEC 분석팀은 최근들어 발주서, 품의서를 위장하여 AppleSeed 악성코드를 유포하는 정황을 포착하였다. AppleSeed는 Kimsuky 조직에서 주로 사용되는 백도어성 악성코드로 시스템에 상주하면서 공격자의 명령을 받아 악성행위를 수행한다. Kimsuky 그룹의 APT 공격 분석 보고서 (AppleSeed, PebbleDash) – ASEC BLOG 본 문서는 최근 Kimsuky 그룹에서 사용하는 악성코드들에 대한 분석 보고서이다. Kimsuky…
#ParsedReport
30-06-2022
US National Security Agency (NSA) "acid fox" vulnerability attack weapon platform technical analysis report
https://mp-weixin-qq-com.translate.goog/s/fjeamyy_kgPh9D8EO17pZA?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Apt-c-40
Threats:
Foxacid_tool (tags: spam, backdoor, phishing, trojan, malware)
Cannon
Industry:
Government
Geo:
Russian, Russia, Chinese, China
IOCs:
File: 13
30-06-2022
US National Security Agency (NSA) "acid fox" vulnerability attack weapon platform technical analysis report
https://mp-weixin-qq-com.translate.goog/s/fjeamyy_kgPh9D8EO17pZA?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Apt-c-40
Threats:
Foxacid_tool (tags: spam, backdoor, phishing, trojan, malware)
Cannon
Industry:
Government
Geo:
Russian, Russia, Chinese, China
IOCs:
File: 13
#ParsedReport
30-06-2022
Using process creation properties to catch evasion techniques
https://www.microsoft.com/security/blog/2022/06/30/using-process-creation-properties-to-catch-evasion-techniques
Actors/Campaigns:
Volatile_cedar
Threats:
Process_doppelganging_technique
Toctou_vuln
IOCs:
File: 1
Functions Names: 5
30-06-2022
Using process creation properties to catch evasion techniques
https://www.microsoft.com/security/blog/2022/06/30/using-process-creation-properties-to-catch-evasion-techniques
Actors/Campaigns:
Volatile_cedar
Threats:
Process_doppelganging_technique
Toctou_vuln
IOCs:
File: 1
Functions Names: 5
Microsoft News
Using process creation properties to catch evasion techniques
We developed a robust detection method in Microsoft Defender for Endpoint that can catch known and unknown variations of a process execution class used by attackers to evade detection. This class of stealthy execution techniques include process doppelganging…
#ParsedReport
30-06-2022
ZuoRAT is a sophisticated malware that mainly targets SOHO routers
https://blog.malwarebytes.com/reports/2022/06/zuorat-is-a-sophisticated-malware-that-mainly-targets-soho-routers
Threats:
Zuo_rat (tags: dns, rat, botnet, malware)
Mirai (tags: botnet, malware)
Industry:
Financial, Education
Geo:
China, American, Chinese
Links:
30-06-2022
ZuoRAT is a sophisticated malware that mainly targets SOHO routers
https://blog.malwarebytes.com/reports/2022/06/zuorat-is-a-sophisticated-malware-that-mainly-targets-soho-routers
Threats:
Zuo_rat (tags: dns, rat, botnet, malware)
Mirai (tags: botnet, malware)
Industry:
Financial, Education
Geo:
China, American, Chinese
Links:
https://github.com/blacklotuslabs/IOCs/blob/main/ZuoRAT\_IoCs.txtMalwarebytes Labs
ZuoRAT is a sophisticated malware that mainly targets SOHO routers
Researchers have analyzed a long running campaign that compromises SOHO routers to further penetrate and eavesdrop on networks.
#ParsedReport
30-06-2022
Alert (AA22-181A)
https://www.cisa.gov/uscert/ncas/alerts/aa22-181a
Threats:
Medusalocker
Industry:
Government, Financial
TTPs:
Tactics: 3
Technics: 6
IOCs:
File: 11
Coin: 18
Email: 80
IP: 24
30-06-2022
Alert (AA22-181A)
https://www.cisa.gov/uscert/ncas/alerts/aa22-181a
Threats:
Medusalocker
Industry:
Government, Financial
TTPs:
Tactics: 3
Technics: 6
IOCs:
File: 11
Coin: 18
Email: 80
IP: 24