#ParsedReport
30-06-2022
Countering hack-for-hire groups
https://blog.google/threat-analysis-group/countering-hack-for-hire-groups
Actors/Campaigns:
Voidbalaur
Threats:
Gophish_tool
Njrat_rat
Houdini_rat
Industry:
Education, Government, Healthcare, Ngo, Financial, Telco
Geo:
Israel, Arab, Nigeria, Bahrain, Indian, Cyprus, India, Saudi, Russia, Arabia, Russian, Africa
IOCs:
Domain: 36
Links:
30-06-2022
Countering hack-for-hire groups
https://blog.google/threat-analysis-group/countering-hack-for-hire-groups
Actors/Campaigns:
Voidbalaur
Threats:
Gophish_tool
Njrat_rat
Houdini_rat
Industry:
Education, Government, Healthcare, Ngo, Financial, Telco
Geo:
Israel, Arab, Nigeria, Bahrain, Indian, Cyprus, India, Saudi, Russia, Arabia, Russian, Africa
IOCs:
Domain: 36
Links:
https://github.com/kgretzky/evilginx2https://github.com/gophish/gophishGoogle
Countering hack-for-hire groups
As part of TAG's mission to counter serious threats to Google and our users, we've published analysis on a range of persistent threats including government-backed attackers, commercial surveillance vendors, and serious criminal operators. Today, we're sharing…
#ParsedReport
30-06-2022
"Validator" - Trojan horse of the NSA (APT-C-40)
https://www-anquanke-com.translate.goog/post/id/275517?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Apt-c-40
Threats:
Quantum_tool
Foxacid_tool
Industry:
Government
Geo:
China
IOCs:
File: 14
IP: 2
Hash: 1
Registry: 6
30-06-2022
"Validator" - Trojan horse of the NSA (APT-C-40)
https://www-anquanke-com.translate.goog/post/id/275517?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Apt-c-40
Threats:
Quantum_tool
Foxacid_tool
Industry:
Government
Geo:
China
IOCs:
File: 14
IP: 2
Hash: 1
Registry: 6
www-anquanke-com.translate.goog
“验证器”（Validator）— 美国国家安全局NSA（APT—C—40）的木马尖兵 - 安全客，安全资讯平台
根据斯诺登曝光文档描述，“验证器”（Validator）是与美国国家安全局（NSA）接入技术行动处（TAO）“酸狐狸”（FOXACID）攻击武器平台相配套的专用木马程序。
#ParsedReport
30-06-2022
The SessionManager IIS backdoor
https://securelist.com/the-sessionmanager-iis-backdoor/106868
Actors/Campaigns:
Volatile_cedar
Threats:
Gelsemium (tags: malware, backdoor)
Owowa
Proxylogon_exploit (tags: malware)
Owlproxy
Mimikatz
Sessionmanager
Industry:
Ngo, Healthcare, Petroleum, Government, Transport
Geo:
Taiwan, Thailand, Argentina, Turkey, Indonesia, Malaysia, Kenya, Guinea, Asia, Armenia, Vietnam, China, Kuwait, Russia, Pakistan, Russian, America, Africa, Nigeria, Arabia, Poland, Djibouti, Saudi
IOCs:
Hash: 10
Path: 18
File: 1
IP: 2
Links:
30-06-2022
The SessionManager IIS backdoor
https://securelist.com/the-sessionmanager-iis-backdoor/106868
Actors/Campaigns:
Volatile_cedar
Threats:
Gelsemium (tags: malware, backdoor)
Owowa
Proxylogon_exploit (tags: malware)
Owlproxy
Mimikatz
Sessionmanager
Industry:
Ngo, Healthcare, Petroleum, Government, Transport
Geo:
Taiwan, Thailand, Argentina, Turkey, Indonesia, Malaysia, Kenya, Guinea, Asia, Armenia, Vietnam, China, Kuwait, Russia, Pakistan, Russian, America, Africa, Nigeria, Arabia, Poland, Djibouti, Saudi
IOCs:
Hash: 10
Path: 18
File: 1
IP: 2
Links:
https://github.com/3gstudent/Hook-PasswordChangeNotifyhttps://github.com/dionach/stripheaders#ParsedReport
30-06-2022
Bahamut Android Malware returns with New Spying Capabilities. Android Spyware Distributed Via Phishing Campaigns
https://blog.cyble.com/2022/06/29/bahamut-android-malware-returns-with-new-spying-capabilities
Threats:
Bahamut (tags: spyware, phishing, malware)
Silence (tags: phishing, spyware)
Industry:
Financial
Geo:
Asia
TTPs:
Tactics: 3
Technics: 1
IOCs:
Url: 4
File: 2
Hash: 3
30-06-2022
Bahamut Android Malware returns with New Spying Capabilities. Android Spyware Distributed Via Phishing Campaigns
https://blog.cyble.com/2022/06/29/bahamut-android-malware-returns-with-new-spying-capabilities
Threats:
Bahamut (tags: spyware, phishing, malware)
Silence (tags: phishing, spyware)
Industry:
Financial
Geo:
Asia
TTPs:
Tactics: 3
Technics: 1
IOCs:
Url: 4
File: 2
Hash: 3
#ParsedReport
30-06-2022
Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit. QakBots infection chain
https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html
Threats:
Blackbasta (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Qakbot (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Printnightmare_vuln (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Megacortex (tags: ransomware, trojan)
Egregor (tags: ransomware, trojan)
Revil (tags: ransomware, trojan)
Follina_vuln (tags: ransomware, trojan)
Cobalt_strike
Coroxy (tags: ransomware, backdoor)
Netcat_tool
Trojan.win64.quaknightmare.yacejt
Industry:
Financial
CVEs:
CVE-2021-34527 [Vulners]
Vulners: Score: 9.0, CVSS: 3.3,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -)
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 21h1, 1809, 1909, 2004)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-, 20h2, 2004)
have more...
CVE-2022-30190 [Vulners]
Vulners: Score: 9.3, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 1809, 20h2, 21h1, 21h2)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
- microsoft windows server 2008 (-, r2)
have more...
IOCs:
File: 4
Hash: 19
IP: 20
30-06-2022
Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit. QakBots infection chain
https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html
Threats:
Blackbasta (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Qakbot (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Printnightmare_vuln (tags: backdoor, ransomware, malware, trojan, rat, phishing)
Megacortex (tags: ransomware, trojan)
Egregor (tags: ransomware, trojan)
Revil (tags: ransomware, trojan)
Follina_vuln (tags: ransomware, trojan)
Cobalt_strike
Coroxy (tags: ransomware, backdoor)
Netcat_tool
Trojan.win64.quaknightmare.yacejt
Industry:
Financial
CVEs:
CVE-2021-34527 [Vulners]
Vulners: Score: 9.0, CVSS: 3.3,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -)
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 21h1, 1809, 1909, 2004)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-, 20h2, 2004)
have more...
CVE-2022-30190 [Vulners]
Vulners: Score: 9.3, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 1809, 20h2, 21h1, 21h2)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
- microsoft windows server 2008 (-, r2)
have more...
IOCs:
File: 4
Hash: 19
IP: 20
Trend Micro
Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit
We look into a recent attack orchestrated by the Black Basta ransomware group that used the banking trojan QakBot as a means of entry and movement and took advantage of the PrintNightmare vulnerability to perform privileged file operations.
#ParsedReport
30-06-2022
Fat Cats
https://blog.group-ib.com/blackcat
Actors/Campaigns:
Blackcat
Darkside
Blackmatter
Threats:
Revil
Lockbit
Conti
Proxyshell_vuln
Screenconnect_tool
Cobalt_strike
Procdump_tool
Minidump_tool
Adrecon
Putty_tool
Exmatter_tool
Psexec_tool
Wevtutil_tool
Industry:
Financial, Media, Education
CVEs:
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9.1
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: 6.6
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
TTPs:
Tactics: 12
Technics: 58
IOCs:
File: 2
Functions Names: 1
Links:
30-06-2022
Fat Cats
https://blog.group-ib.com/blackcat
Actors/Campaigns:
Blackcat
Darkside
Blackmatter
Threats:
Revil
Lockbit
Conti
Proxyshell_vuln
Screenconnect_tool
Cobalt_strike
Procdump_tool
Minidump_tool
Adrecon
Putty_tool
Exmatter_tool
Psexec_tool
Wevtutil_tool
Industry:
Financial, Media, Education
CVEs:
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9.1
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: 6.6
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)
TTPs:
Tactics: 12
Technics: 58
IOCs:
File: 2
Functions Names: 1
Links:
https://github.com/rivitna/Malware/tree/main/BlackCatGroup-IB
Fat Cats
An analysis of the BlackCat ransomware affiliate program
#ParsedReport
30-06-2022
Distribution of AppleSeed disguised as order form and written agreement
https://asec-ahnlab-com.translate.goog/ko/35781/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Kimsuky
Threats:
Appleseed (tags: backdoor, dropper, phishing, malware)
Geo:
Korean
IOCs:
File: 2
Hash: 3
Coin: 1
30-06-2022
Distribution of AppleSeed disguised as order form and written agreement
https://asec-ahnlab-com.translate.goog/ko/35781/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Kimsuky
Threats:
Appleseed (tags: backdoor, dropper, phishing, malware)
Geo:
Korean
IOCs:
File: 2
Hash: 3
Coin: 1
ASEC
발주서, 품의서를 위장한 AppleSeed 유포 - ASEC
ASEC 분석팀은 최근들어 발주서, 품의서를 위장하여 AppleSeed 악성코드를 유포하는 정황을 포착하였다. AppleSeed는 Kimsuky 조직에서 주로 사용되는 백도어성 악성코드로 시스템에 상주하면서 공격자의 명령을 받아 악성행위를 수행한다. Kimsuky 그룹의 APT 공격 분석 보고서 (AppleSeed, PebbleDash) – ASEC BLOG 본 문서는 최근 Kimsuky 그룹에서 사용하는 악성코드들에 대한 분석 보고서이다. Kimsuky…
#ParsedReport
30-06-2022
US National Security Agency (NSA) "acid fox" vulnerability attack weapon platform technical analysis report
https://mp-weixin-qq-com.translate.goog/s/fjeamyy_kgPh9D8EO17pZA?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Apt-c-40
Threats:
Foxacid_tool (tags: spam, backdoor, phishing, trojan, malware)
Cannon
Industry:
Government
Geo:
Russian, Russia, Chinese, China
IOCs:
File: 13
30-06-2022
US National Security Agency (NSA) "acid fox" vulnerability attack weapon platform technical analysis report
https://mp-weixin-qq-com.translate.goog/s/fjeamyy_kgPh9D8EO17pZA?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Actors/Campaigns:
Apt-c-40
Threats:
Foxacid_tool (tags: spam, backdoor, phishing, trojan, malware)
Cannon
Industry:
Government
Geo:
Russian, Russia, Chinese, China
IOCs:
File: 13
#ParsedReport
30-06-2022
Using process creation properties to catch evasion techniques
https://www.microsoft.com/security/blog/2022/06/30/using-process-creation-properties-to-catch-evasion-techniques
Actors/Campaigns:
Volatile_cedar
Threats:
Process_doppelganging_technique
Toctou_vuln
IOCs:
File: 1
Functions Names: 5
30-06-2022
Using process creation properties to catch evasion techniques
https://www.microsoft.com/security/blog/2022/06/30/using-process-creation-properties-to-catch-evasion-techniques
Actors/Campaigns:
Volatile_cedar
Threats:
Process_doppelganging_technique
Toctou_vuln
IOCs:
File: 1
Functions Names: 5
Microsoft News
Using process creation properties to catch evasion techniques
We developed a robust detection method in Microsoft Defender for Endpoint that can catch known and unknown variations of a process execution class used by attackers to evade detection. This class of stealthy execution techniques include process doppelganging…
#ParsedReport
30-06-2022
ZuoRAT is a sophisticated malware that mainly targets SOHO routers
https://blog.malwarebytes.com/reports/2022/06/zuorat-is-a-sophisticated-malware-that-mainly-targets-soho-routers
Threats:
Zuo_rat (tags: dns, rat, botnet, malware)
Mirai (tags: botnet, malware)
Industry:
Financial, Education
Geo:
China, American, Chinese
Links:
30-06-2022
ZuoRAT is a sophisticated malware that mainly targets SOHO routers
https://blog.malwarebytes.com/reports/2022/06/zuorat-is-a-sophisticated-malware-that-mainly-targets-soho-routers
Threats:
Zuo_rat (tags: dns, rat, botnet, malware)
Mirai (tags: botnet, malware)
Industry:
Financial, Education
Geo:
China, American, Chinese
Links:
https://github.com/blacklotuslabs/IOCs/blob/main/ZuoRAT\_IoCs.txtMalwarebytes Labs
ZuoRAT is a sophisticated malware that mainly targets SOHO routers
Researchers have analyzed a long running campaign that compromises SOHO routers to further penetrate and eavesdrop on networks.
#ParsedReport
30-06-2022
Alert (AA22-181A)
https://www.cisa.gov/uscert/ncas/alerts/aa22-181a
Threats:
Medusalocker
Industry:
Government, Financial
TTPs:
Tactics: 3
Technics: 6
IOCs:
File: 11
Coin: 18
Email: 80
IP: 24
30-06-2022
Alert (AA22-181A)
https://www.cisa.gov/uscert/ncas/alerts/aa22-181a
Threats:
Medusalocker
Industry:
Government, Financial
TTPs:
Tactics: 3
Technics: 6
IOCs:
File: 11
Coin: 18
Email: 80
IP: 24
#ParsedReport
01-07-2022
I Dont Want to Receive Any Unnecessary Information!
https://asec.ahnlab.com/en/36184
IOCs:
Hash: 4
01-07-2022
I Dont Want to Receive Any Unnecessary Information!
https://asec.ahnlab.com/en/36184
IOCs:
Hash: 4
ASEC BLOG
I Don't Want to Receive Any Unnecessary Information! - ASEC BLOG
According to Section 50 of the ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION, anyone who wishes to send promotional information for commercial purposes via electronic transmission media must receive explicit…
#ParsedReport
01-07-2022
Case of Attack Exploiting AnyDesk Remote Tool (Cobalt Strike and Meterpreter)
https://asec.ahnlab.com/en/36159
Actors/Campaigns:
Kimsuky
Threats:
Cobalt_strike (tags: cryptomining, dropper, malware, ransomware, scan, backdoor)
Meterpreter_tool (tags: cryptomining, dropper, malware, ransomware, scan, backdoor)
Remcos_rat
Gh0st_rat
Tinynuke
Tightvnc_tool
Conti
Metasploit_tool
Anydesk_tool
Malware/win.exploit.c5159648
Malware/mdp.behavior.m2330
IOCs:
File: 1
Hash: 2
Url: 3
IP: 1
Functions Names: 1
01-07-2022
Case of Attack Exploiting AnyDesk Remote Tool (Cobalt Strike and Meterpreter)
https://asec.ahnlab.com/en/36159
Actors/Campaigns:
Kimsuky
Threats:
Cobalt_strike (tags: cryptomining, dropper, malware, ransomware, scan, backdoor)
Meterpreter_tool (tags: cryptomining, dropper, malware, ransomware, scan, backdoor)
Remcos_rat
Gh0st_rat
Tinynuke
Tightvnc_tool
Conti
Metasploit_tool
Anydesk_tool
Malware/win.exploit.c5159648
Malware/mdp.behavior.m2330
IOCs:
File: 1
Hash: 2
Url: 3
IP: 1
Functions Names: 1
ASEC
Case of Attack Exploiting AnyDesk Remote Tool (Cobalt Strike and Meterpreter) - ASEC
Case of Attack Exploiting AnyDesk Remote Tool (Cobalt Strike and Meterpreter) ASEC
#ParsedReport
01-07-2022
Meterpreter distributed to vulnerable servers of domestic medical institutions
https://asec-ahnlab-com.translate.goog/ko/36053/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Meterpreter_tool (tags: malware, ransomware)
Samsam
Smokeloader
Malware/mdp.download.m1900
Industry:
Healthcare
IOCs:
File: 9
Path: 5
Hash: 3
IP: 1
Url: 3
Functions Names: 1
Links:
01-07-2022
Meterpreter distributed to vulnerable servers of domestic medical institutions
https://asec-ahnlab-com.translate.goog/ko/36053/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Meterpreter_tool (tags: malware, ransomware)
Samsam
Smokeloader
Malware/mdp.download.m1900
Industry:
Healthcare
IOCs:
File: 9
Path: 5
Hash: 3
IP: 1
Url: 3
Functions Names: 1
Links:
https://translate.google.com/website?sl=ko&tl=en&hl=ru&client=webapp&u=https://github.com/joaomatosf/jexbossASEC BLOG
국내 의료기관의 취약한 서버를 대상으로 유포된 미터프리터(Meterpreter) - ASEC BLOG
ASEC 분석팀에서는 취약한 서버를 대상으로 유포 중인 악성코드를 모니터링 하던 중 국내 의료 기관에서 사용 중인 PACS(Picture Archiving and Communication System) 서버를 공격한 사례가 확인되었다. PACS(Picture Archiving and Communication System)는 환자의 의료 영상을 디지털로 관리하고 전송하는 시스템으로써 병원에서 의료 영상을 시공간 제한 없이 조회하고 판독하기 위해 사용하는…
#ParsedReport
01-07-2022
Xloader Returns with New Infection Technique. Multistage Delivery of Malware Using Steganography
https://blog.cyble.com/2022/07/01/xloader-returns-with-new-infection-technique
Threats:
Formbook (tags: stealer, malware, phishing, spam)
Beacon
Geo:
Chinese
CVEs:
CVE-2017-11882 [Vulners]
Vulners: Score: 9.3, CVSS: 8.3,
Vulners: Exploitation: True
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft office (2013, 2010, 2016, 2007)
TTPs:
Tactics: 5
Technics: 8
IOCs:
Url: 2
File: 7
Hash: 11
Functions Names: 3
01-07-2022
Xloader Returns with New Infection Technique. Multistage Delivery of Malware Using Steganography
https://blog.cyble.com/2022/07/01/xloader-returns-with-new-infection-technique
Threats:
Formbook (tags: stealer, malware, phishing, spam)
Beacon
Geo:
Chinese
CVEs:
CVE-2017-11882 [Vulners]
Vulners: Score: 9.3, CVSS: 8.3,
Vulners: Exploitation: True
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft office (2013, 2010, 2016, 2007)
TTPs:
Tactics: 5
Technics: 8
IOCs:
Url: 2
File: 7
Hash: 11
Functions Names: 3
Cyble
Cyble - Xloader Returns With New Infection Technique
Cyble analyzes Xloader, a sophisticated malware variant that uses multiple stages for its payload delivery.
#ParsedReport
01-07-2022
PennyWise Stealer: An Evasive Infostealer leveraging YouTube to infect users. Multi-Threading Approach used For Rapid Exfiltration
https://blog.cyble.com/2022/06/30/infostealer
Threats:
Netstat_tool
Beacon
Industry:
Financial
Geo:
Russia, Belarus, Kazakhstan, Ukraine, Russian
TTPs:
Tactics: 7
Technics: 14
IOCs:
File: 12
Hash: 15
Coin: 1
Registry: 2
Url: 1
Functions Names: 2
01-07-2022
PennyWise Stealer: An Evasive Infostealer leveraging YouTube to infect users. Multi-Threading Approach used For Rapid Exfiltration
https://blog.cyble.com/2022/06/30/infostealer
Threats:
Netstat_tool
Beacon
Industry:
Financial
Geo:
Russia, Belarus, Kazakhstan, Ukraine, Russian
TTPs:
Tactics: 7
Technics: 14
IOCs:
File: 12
Hash: 15
Coin: 1
Registry: 2
Url: 1
Functions Names: 2
Cyble
PennyWise Stealer: YouTube's Evasive Infostealer
Cyble analyzes Pennywise, an infostealer that targets over 30 browsers and cold crypto-wallets and leverages YouTube to spread itself.
#ParsedReport
30-06-2022
Hacktivist Group DragonForce Malaysia Releases Windows LPE Exploit, Discloses Plans to Evolve into a Ransomware Group
https://cloudsek.com/threatintelligence/hacktivist-group-dragonforce-malaysia-releases-windows-lpe-exploit-discloses-plans-to-evolve-into-a-ransomware-group/?utm_source=rss&utm_medium=rss&utm_campaign=hacktivist-group-dragonforce-malaysia-releases-windows-lpe-exploit-discloses-plans-to-evolve-into-a-ransomware-group
Actors/Campaigns:
Dragonforce (motivation: hacktivism)
Industry:
Government
Geo:
Indian, Malaysia, India
CVEs:
CVE-2022-26134 [Vulners]
Vulners: Score: 7.5, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- atlassian confluence data center (7.18.0, <7.17.4, <7.16.4, <7.15.2, <7.14.3, <7.13.7, <7.4.17)
- atlassian confluence server (7.18.0, <7.17.4, <7.16.4, <7.15.2, <7.14.3, <7.13.7, <7.4.17)
TTPs:
Tactics: 1
Technics: 0
30-06-2022
Hacktivist Group DragonForce Malaysia Releases Windows LPE Exploit, Discloses Plans to Evolve into a Ransomware Group
https://cloudsek.com/threatintelligence/hacktivist-group-dragonforce-malaysia-releases-windows-lpe-exploit-discloses-plans-to-evolve-into-a-ransomware-group/?utm_source=rss&utm_medium=rss&utm_campaign=hacktivist-group-dragonforce-malaysia-releases-windows-lpe-exploit-discloses-plans-to-evolve-into-a-ransomware-group
Actors/Campaigns:
Dragonforce (motivation: hacktivism)
Industry:
Government
Geo:
Indian, Malaysia, India
CVEs:
CVE-2022-26134 [Vulners]
Vulners: Score: 7.5, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- atlassian confluence data center (7.18.0, <7.17.4, <7.16.4, <7.15.2, <7.14.3, <7.13.7, <7.4.17)
- atlassian confluence server (7.18.0, <7.17.4, <7.16.4, <7.15.2, <7.14.3, <7.13.7, <7.4.17)
TTPs:
Tactics: 1
Technics: 0
Cloudsek
Hacktivist Group DragonForce Malaysia Releases Windows LPE Exploit, Discloses Plans to Evolve into a Ransomware Group | Threat…
DragonForce Malaysia has shared an exploit to bypass the Windows Server LPE LDR for targeting and exploiting Indian servers. The group has also shared a working PoC (Proof of Concept) video to substantiate their claims.
#ParsedReport
03-07-2022
YTStealer targets YouTube content creators
https://blog.malwarebytes.com/scams/2022/07/ytstealer-targets-youtube-content-creators
Threats:
Ytstealer (tags: malware)
Vidar_stealer
Redline_stealer
03-07-2022
YTStealer targets YouTube content creators
https://blog.malwarebytes.com/scams/2022/07/ytstealer-targets-youtube-content-creators
Threats:
Ytstealer (tags: malware)
Vidar_stealer
Redline_stealer
Malwarebytes Labs
YTStealer targets YouTube content creators
We take a look at reports of scammers targeting Youtuber's channels with malware called YTStealer, that eats authentication cookies.
#ParsedReport
03-07-2022
AstraLocker 2.0 ransomware isnt going to give you your files back
https://blog.malwarebytes.com/ransomware/2022/07/astralocker-2-0-ransomware-isnt-going-to-give-you-your-files-back
Threats:
Babuk (tags: trojan, malware, cryptomining, ransomware)
Follina_vuln
Industry:
Financial
03-07-2022
AstraLocker 2.0 ransomware isnt going to give you your files back
https://blog.malwarebytes.com/ransomware/2022/07/astralocker-2-0-ransomware-isnt-going-to-give-you-your-files-back
Threats:
Babuk (tags: trojan, malware, cryptomining, ransomware)
Follina_vuln
Industry:
Financial
Malwarebytes Labs
AstraLocker 2.0 ransomware isn't going to give you your files back
Through malice or carelessness, AstraLocker breaks the "circle of trust".