#ParsedReport
05-07-2022
Hive ransomware gets upgrades in Rust. Recommended customer actions
https://www.microsoft.com/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust
Actors/Campaigns:
Fin12
Threats:
Hive (tags: ransomware, rat, malware)
Ransom:win64/hive
Ransom:win32/hive
Industry:
Education, Financial, Healthcare
Geo:
Korea
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 10
Hash: 9
Path: 1
Links:
05-07-2022
Hive ransomware gets upgrades in Rust. Recommended customer actions
https://www.microsoft.com/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust
Actors/Campaigns:
Fin12
Threats:
Hive (tags: ransomware, rat, malware)
Ransom:win64/hive
Ransom:win32/hive
Industry:
Education, Financial, Healthcare
Geo:
Korea
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 10
Hash: 9
Path: 1
Links:
https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/MultipleDataSources/BackupDeletion.yamlhttps://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/HiveRansomwareJuly2022.yamlhttps://github.com/Azure/Azure-Sentinel/blob/master/Detections/SecurityAlert/HiveRansomwareAVHits.yamlMicrosoft News
Hive ransomware gets upgrades in Rust
With its latest variant carrying several major upgrades, Hive proves it’s one of the fastest evolving ransomware payload, exemplifying the continuously changing ransomware ecosystem.
#ParsedReport
05-07-2022
JPCERT/CC Eyes
https://blogs.jpcert.or.jp/en/2022/07/vsingle.html
Actors/Campaigns:
Lazarus
Threats:
Vsingle (tags: malware)
Geo:
Usa
IOCs:
Hash: 3
05-07-2022
JPCERT/CC Eyes
https://blogs.jpcert.or.jp/en/2022/07/vsingle.html
Actors/Campaigns:
Lazarus
Threats:
Vsingle (tags: malware)
Geo:
Usa
IOCs:
Hash: 3
JPCERT/CC Eyes
VSingle malware that obtains C2 server information from GitHub - JPCERT/CC Eyes
Some types of malware use DGA, obfuscate...
#ParsedReport
05-07-2022
Your Guide to Top Infostealers in 2022
https://blog.morphisec.com/infostealer-comparison
Threats:
Mars_stealer (tags: stealer, malware)
Vidar_stealer
Oski_stealer
Raccoon_stealer (tags: stealer)
Redline_stealer (tags: stealer)
Blackguard_stealer (tags: stealer, malware, rat, vpn)
Stormkitty_stealer (tags: stealer)
44caliber_stealer (tags: stealer)
Jester_stealer (tags: stealer, malware, vpn)
Industry:
Financial, Chemical, Entertainment
Geo:
Ukraine, Ukrainian, Russian
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 9
Links:
05-07-2022
Your Guide to Top Infostealers in 2022
https://blog.morphisec.com/infostealer-comparison
Threats:
Mars_stealer (tags: stealer, malware)
Vidar_stealer
Oski_stealer
Raccoon_stealer (tags: stealer)
Redline_stealer (tags: stealer)
Blackguard_stealer (tags: stealer, malware, rat, vpn)
Stormkitty_stealer (tags: stealer)
44caliber_stealer (tags: stealer)
Jester_stealer (tags: stealer, malware, vpn)
Industry:
Financial, Chemical, Entertainment
Geo:
Ukraine, Ukrainian, Russian
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 9
Links:
https://github.com/swagkarna/StormKittyhttps://github.com/razexgod/44CALIBERMorphisec
Your Guide to Top Infostealers in 2022
An infostealer attack can be extremely damaging—and attacks are on the rise. Morphisec analyzes six of the top infostealers used in 2022.
#ParsedReport
05-07-2022
Lockbit 3.0 Ransomware group launches new version. Lockbit Black actively targeting BFSI Sector
https://blog.cyble.com/2022/07/05/lockbit-3-0-ransomware-group-launches-new-version
Threats:
Lockbit (tags: malware, ransomware)
Industry:
Financial
Geo:
Spanish, Chinese
TTPs:
Tactics: 4
Technics: 8
IOCs:
File: 4
Hash: 1
Functions Names: 3
05-07-2022
Lockbit 3.0 Ransomware group launches new version. Lockbit Black actively targeting BFSI Sector
https://blog.cyble.com/2022/07/05/lockbit-3-0-ransomware-group-launches-new-version
Threats:
Lockbit (tags: malware, ransomware)
Industry:
Financial
Geo:
Spanish, Chinese
TTPs:
Tactics: 4
Technics: 8
IOCs:
File: 4
Hash: 1
Functions Names: 3
Cyble
Cyble - Lockbit 3.0 - Ransomware Group Launches New Version
Cyble analyzes the return of Lockbit ransomware as Lockbit 3.0/"Lockbit Black" and how it has been actively targeting the BFSI sector.
#ParsedReport
05-07-2022
IconBurst: NPM software supply chain attack grabs data from apps, websites
https://blog.reversinglabs.com/blog/iconburst-npm-software-supply-chain-attack-grabs-data-from-apps-websites
Threats:
Woxruz_tool
Geo:
German
IOCs:
Url: 3
Hash: 62
Functions Names: 2
Links:
05-07-2022
IconBurst: NPM software supply chain attack grabs data from apps, websites
https://blog.reversinglabs.com/blog/iconburst-npm-software-supply-chain-attack-grabs-data-from-apps-websites
Threats:
Woxruz_tool
Geo:
German
IOCs:
Url: 3
Hash: 62
Functions Names: 2
Links:
https://github.com/ionic-team/ioniconshttps://github.com/javascript-obfuscator/javascript-obfuscatorhttps://github.com/relative/synchronyReversingLabs
RL Blog | ReversingLabs | ReversingLabs
RL Blog: AppSec & Supply Chain Security, Dev & DevSecOps, Threat Research, and Security Operations (SecOps)
#ParsedReport
06-07-2022
CuteBoi Detected Preparing a Large-Scale Crypto Mining Campaign on NPM Users. Details
https://checkmarx.com/blog/cuteboi-detected-preparing-a-large-scale-crypto-mining-campaign-on-npm-users
Actors/Campaigns:
Cuteboi
Red_lili
Threats:
Eazyminer
Xmrig_miner (tags: cryptomining)
IOCs:
Hash: 2
Links:
06-07-2022
CuteBoi Detected Preparing a Large-Scale Crypto Mining Campaign on NPM Users. Details
https://checkmarx.com/blog/cuteboi-detected-preparing-a-large-scale-crypto-mining-campaign-on-npm-users
Actors/Campaigns:
Cuteboi
Red_lili
Threats:
Eazyminer
Xmrig_miner (tags: cryptomining)
IOCs:
Hash: 2
Links:
https://github.com/checkmarx/cuteboiCheckmarx
“CuteBoi” Detected Preparing a Large-Scale Crypto Mining Campaign on NPM Users
Checkmarx SCS team detected over 1200 npm packages released to the registry by over a thousand different user accounts. This was done using automation which includes the ability to pass NPM 2FA challenge. This cluster of packages seems to be a part of an…
#ParsedReport
06-07-2022
North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector
https://us-cert.cisa.gov/ncas/current-activity/2022/07/06/north-korean-state-sponsored-cyber-actors-use-maui-ransomware
Threats:
Medusalocker
Log4shell_vuln
Spring4shell
Industry:
Healthcare
Geo:
Korea, Korean
06-07-2022
North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector
https://us-cert.cisa.gov/ncas/current-activity/2022/07/06/north-korean-state-sponsored-cyber-actors-use-maui-ransomware
Threats:
Medusalocker
Log4shell_vuln
Spring4shell
Industry:
Healthcare
Geo:
Korea, Korean
www.cisa.gov
North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector | CISA
CISA, the Federal Bureau of Investigation (FBI), and the Department of the Treasury (Treasury) have released a joint Cybersecurity Advisory (CSA), North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector…
#ParsedReport
06-07-2022
Flubot: the evolution of a notorious Android Banking Malware
https://research.nccgroup.com/2022/07/05/flubot-the-evolution-of-a-notorious-android-banking-malware
Threats:
Flubot (tags: rat, phishing, malware, botnet, dns)
Anatsa
Industry:
Financial, Transport
Geo:
Asia, Italy, Czech, Sweden, Belgium, Turkey, Thailand, Serbia, Poland, Romania, Spain, Austria, Greece, Croatia, Switzerland, Spanish, Slovakia, Bulgaria, German, Netherlands, Australia, Portugal, Singapore, Korea, Germany, Japan, Hungary
IOCs:
File: 3
Hash: 33
06-07-2022
Flubot: the evolution of a notorious Android Banking Malware
https://research.nccgroup.com/2022/07/05/flubot-the-evolution-of-a-notorious-android-banking-malware
Threats:
Flubot (tags: rat, phishing, malware, botnet, dns)
Anatsa
Industry:
Financial, Transport
Geo:
Asia, Italy, Czech, Sweden, Belgium, Turkey, Thailand, Serbia, Poland, Romania, Spain, Austria, Greece, Croatia, Switzerland, Spanish, Slovakia, Bulgaria, German, Netherlands, Australia, Portugal, Singapore, Korea, Germany, Japan, Hungary
IOCs:
File: 3
Hash: 33
NCC Group Research Blog
Flubot: the evolution of a notorious Android Banking Malware
Originally published June 29, 2022 on the Fox-IT blog Authored by Alberto Segura (main author) and Rolf Govers (co-author) Summary Flubot is an Android based malware that has been distributed in th…
#ParsedReport
06-07-2022
OrBit: New Undetected Linux Threat Uses Unique Hijack of Execution Flow
https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat
Actors/Campaigns:
Volatile_cedar
Threats:
Orbits_technique (tags: dropper, malware, backdoor)
Symbiote
Hiddenwasp
Hermeticwiper
Geo:
Israel
TTPs:
Tactics: 1
Technics: 0
IOCs:
Hash: 4
File: 1
Functions Names: 2
06-07-2022
OrBit: New Undetected Linux Threat Uses Unique Hijack of Execution Flow
https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat
Actors/Campaigns:
Volatile_cedar
Threats:
Orbits_technique (tags: dropper, malware, backdoor)
Symbiote
Hiddenwasp
Hermeticwiper
Geo:
Israel
TTPs:
Tactics: 1
Technics: 0
IOCs:
Hash: 4
File: 1
Functions Names: 2
Intezer
OrBit: New Undetected Linux Threat Uses Unique Hijack of Execution Flow
OrBit is a new Linux malware that hijacks the execution flow, evading and gaining persistence to get remote access and steal information.
#ParsedReport
06-07-2022
ALPHV Ransomware expands its Arsenal of Extortion techniques. Searchable Databases compound the risk of Supply Chain Attacks
https://blog.cyble.com/2022/07/06/alphv-ransomware-expands-its-arsenal-of-extortion-techniques
Actors/Campaigns:
Blackcat
Darkside
Blackmatter
Karakurt
06-07-2022
ALPHV Ransomware expands its Arsenal of Extortion techniques. Searchable Databases compound the risk of Supply Chain Attacks
https://blog.cyble.com/2022/07/06/alphv-ransomware-expands-its-arsenal-of-extortion-techniques
Actors/Campaigns:
Blackcat
Darkside
Blackmatter
Karakurt
Cyble
ALPHV Ransomware expands its Arsenal of Extortion techniques
Cyble analyzes ALPHV's updated TTPs and its possible links to other known ransomware groups like BlackMatter and DarkSide.
#ParsedReport
06-07-2022
ASEC Weekly Malware Statistics ( 20220627 \~ 20220703 )
https://asec-ahnlab-com.translate.goog/ko/36232/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Agent_tesla (tags: malware)
Azorult (tags: malware)
Formbook (tags: malware)
Clipboard_grabbing_technique (tags: malware)
Emotet (tags: malware)
Qakbot (tags: malware)
Trickbot (tags: malware)
Cloudeye (tags: malware)
Remcos_rat (tags: malware)
Nanocore_rat (tags: malware)
Lokibot_stealer (tags: malware)
Avemaria_rat (tags: malware)
Industry:
Financial, Transport
Geo:
Korea
IOCs:
Domain: 1
IP: 3
Email: 6
File: 30
Url: 49
06-07-2022
ASEC Weekly Malware Statistics ( 20220627 \~ 20220703 )
https://asec-ahnlab-com.translate.goog/ko/36232/?_x_tr_sl=ko&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
Threats:
Agent_tesla (tags: malware)
Azorult (tags: malware)
Formbook (tags: malware)
Clipboard_grabbing_technique (tags: malware)
Emotet (tags: malware)
Qakbot (tags: malware)
Trickbot (tags: malware)
Cloudeye (tags: malware)
Remcos_rat (tags: malware)
Nanocore_rat (tags: malware)
Lokibot_stealer (tags: malware)
Avemaria_rat (tags: malware)
Industry:
Financial, Transport
Geo:
Korea
IOCs:
Domain: 1
IP: 3
Email: 6
File: 30
Url: 49
ASEC BLOG
ASEC 주간 악성코드 통계 ( 20220627 ~ 20220703 ) - ASEC BLOG
ASEC 분석팀에서는 ASEC 자동 분석 시스템 RAPIT 을 활용하여 알려진 악성코드들에 대한 분류 및 대응을 진행하고 있다. 본 포스팅에서는 2022년 6월 27일 월요일부터 7월 3일 일요일까지 한 주간 수집된 악성코드의 통계를 정리한다. 대분류 상으로는 인포스틸러가 48.0%로 1위를 차지하였으며, 그 다음으로는 뱅킹 악성코드가 26.5%, RAT 12.5%, 다운로더가 8.2%, 랜섬웨어 2.2%, 코인마이너 1.8%, 백도어가 0.7%로 집계되었다.…
#ParsedReport
06-07-2022
From the Front Lines \| New macOS covid Malware Masquerades as Apple, Wears Face of APT
https://www.sentinelone.com/blog/from-the-front-lines-new-macos-covid-malware-masquerades-as-apple-wears-face-of-apt
Actors/Campaigns:
Lazarus
Threats:
Dazzlespy (tags: malware)
Zuru (tags: malware)
Macma (tags: malware)
Gimmick (tags: malware)
Sliver_tool
Geo:
Korean
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 1
Url: 1
Hash: 5
IP: 1
Links:
06-07-2022
From the Front Lines \| New macOS covid Malware Masquerades as Apple, Wears Face of APT
https://www.sentinelone.com/blog/from-the-front-lines-new-macos-covid-malware-masquerades-as-apple-wears-face-of-apt
Actors/Campaigns:
Lazarus
Threats:
Dazzlespy (tags: malware)
Zuru (tags: malware)
Macma (tags: malware)
Gimmick (tags: malware)
Sliver_tool
Geo:
Korean
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 1
Url: 1
Hash: 5
IP: 1
Links:
https://github.com/BishopFox/sliverhttps://github.com/progrium/macdriverSentinelOne
From the Front Lines | New macOS ‘covid’ Malware Masquerades as Apple, Wears Face of APT
A fake VPN delivers a Sliver implant with a further malicious payload. APT or Red Team? The IoCs can look the same to defenders.
#ParsedReport
06-07-2022
Luna Moth: The Actors Behind the Recent False Subscription Scams
https://blog.sygnia.co/luna-moth-false-subscription-scams
Actors/Campaigns:
Luna_moth (motivation: information_theft)
Threats:
Atera_tool
Splashtop_tool
Syncro_tool
Sharpshares_tool
Industry:
Financial
TTPs:
Tactics: 2
Technics: 0
IOCs:
Email: 4
Domain: 88
IP: 46
Links:
06-07-2022
Luna Moth: The Actors Behind the Recent False Subscription Scams
https://blog.sygnia.co/luna-moth-false-subscription-scams
Actors/Campaigns:
Luna_moth (motivation: information_theft)
Threats:
Atera_tool
Splashtop_tool
Syncro_tool
Sharpshares_tool
Industry:
Financial
TTPs:
Tactics: 2
Technics: 0
IOCs:
Email: 4
Domain: 88
IP: 46
Links:
https://github.com/djhohnstein/SharpSharesblog.sygnia.co
Luna Moth: The Threat Actors Behind Recent False Subscription Scams
Sygnia’s team identified 'Luna Moth' ransom group. The threat actors resemble false subscription scammers, focusing on corporate data theft.
#ParsedReport
06-07-2022
research report. Analysis of Active Hezb Mining Trojans
https://www-antiy-cn.translate.goog/research/notice&report/research_report/20220705.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
CVEs:
CVE-2022-26134 [Vulners]
Vulners: Score: 7.5, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- atlassian confluence data center (7.18.0, <7.17.4, <7.16.4, <7.15.2, <7.14.3, <7.13.7, <7.4.17)
- atlassian confluence server (7.18.0, <7.17.4, <7.16.4, <7.15.2, <7.14.3, <7.13.7, <7.4.17)
CVE-2022-29464 [Vulners]
Vulners: Score: 10.0, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- wso2 api manager (le4.0.0)
- wso2 enterprise integrator (le6.6.0)
- wso2 identity server (le5.11.0)
- wso2 identity server analytics (5.4.0, 5.4.1, 5.5.0, 5.6.0)
- wso2 identity server as key manager (le5.10.0)
have more...
CVE-2021-4034 [Vulners]
Vulners: Score: 7.2, CVSS: 3.5,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- polkit project polkit (*)
- redhat enterprise linux desktop (7.0)
- redhat enterprise linux workstation (7.0)
- redhat enterprise linux for scientific computing (7.0)
- redhat enterprise linux server (7.0, 6.0)
have more...
IOCs:
File: 10
Url: 10
IP: 3
Coin: 1
Hash: 6
06-07-2022
research report. Analysis of Active Hezb Mining Trojans
https://www-antiy-cn.translate.goog/research/notice&report/research_report/20220705.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp
CVEs:
CVE-2022-26134 [Vulners]
Vulners: Score: 7.5, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- atlassian confluence data center (7.18.0, <7.17.4, <7.16.4, <7.15.2, <7.14.3, <7.13.7, <7.4.17)
- atlassian confluence server (7.18.0, <7.17.4, <7.16.4, <7.15.2, <7.14.3, <7.13.7, <7.4.17)
CVE-2022-29464 [Vulners]
Vulners: Score: 10.0, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- wso2 api manager (le4.0.0)
- wso2 enterprise integrator (le6.6.0)
- wso2 identity server (le5.11.0)
- wso2 identity server analytics (5.4.0, 5.4.1, 5.5.0, 5.6.0)
- wso2 identity server as key manager (le5.10.0)
have more...
CVE-2021-4034 [Vulners]
Vulners: Score: 7.2, CVSS: 3.5,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- polkit project polkit (*)
- redhat enterprise linux desktop (7.0)
- redhat enterprise linux workstation (7.0)
- redhat enterprise linux for scientific computing (7.0)
- redhat enterprise linux server (7.0, 6.0)
have more...
IOCs:
File: 10
Url: 10
IP: 3
Coin: 1
Hash: 6
www-antiy-cn.translate.goog
活跃的Hezb挖矿木马分析
安天是引领威胁检测与防御能力发展的网络安全国家队，为客户构建端点防护、流量监测、边界防护、导流捕获、深度分析、应急处置的安全基石
#ParsedReport
07-07-2022
AsyncRAT Being Distributed to Vulnerable MySQL Servers
https://asec.ahnlab.com/en/36315
Threats:
Asyncrat_rat (tags: malware, spam, rat)
Cobalt_strike
Remcos_rat
Cringe_rat
Gh0st_rat
Metasploit_tool
Trojan/win32.rl_generic.c4239825
Trojan/win32.inject.c500093
IOCs:
File: 1
Hash: 2
Url: 1
IP: 3
07-07-2022
AsyncRAT Being Distributed to Vulnerable MySQL Servers
https://asec.ahnlab.com/en/36315
Threats:
Asyncrat_rat (tags: malware, spam, rat)
Cobalt_strike
Remcos_rat
Cringe_rat
Gh0st_rat
Metasploit_tool
Trojan/win32.rl_generic.c4239825
Trojan/win32.inject.c500093
IOCs:
File: 1
Hash: 2
Url: 1
IP: 3
ASEC BLOG
AsyncRAT Being Distributed to Unsecured MySQL Servers - ASEC BLOG
The ShadowServer foundation has recently released a report showing that there are about 3.6 million MySQL servers exposed to outside. Along with MS-SQL server, MySQL server is one of the main database servers that provides the feature of managing large amounts…
#ParsedReport
07-07-2022
ASEC Weekly Malware Statistics (June 27th, 2022 July 3rd, 2022)
https://asec.ahnlab.com/en/36294
Threats:
Agent_tesla (tags: malware)
Formbook (tags: malware)
Clipboard_grabbing_technique (tags: malware)
Emotet (tags: malware)
Qakbot (tags: malware)
Trickbot (tags: malware)
Cloudeye (tags: malware)
Remcos_rat (tags: malware)
Nanocore_rat (tags: malware)
Lokibot_stealer (tags: malware)
Industry:
Financial
IOCs:
Domain: 2
IP: 3
Email: 6
File: 30
Url: 48
07-07-2022
ASEC Weekly Malware Statistics (June 27th, 2022 July 3rd, 2022)
https://asec.ahnlab.com/en/36294
Threats:
Agent_tesla (tags: malware)
Formbook (tags: malware)
Clipboard_grabbing_technique (tags: malware)
Emotet (tags: malware)
Qakbot (tags: malware)
Trickbot (tags: malware)
Cloudeye (tags: malware)
Remcos_rat (tags: malware)
Nanocore_rat (tags: malware)
Lokibot_stealer (tags: malware)
Industry:
Financial
IOCs:
Domain: 2
IP: 3
Email: 6
File: 30
Url: 48
ASEC BLOG
ASEC Weekly Malware Statistics (June 27th, 2022 - July 3rd, 2022) - ASEC BLOG
The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from June 27th, 2022 (Monday) to July 3rd, 2022 (Sunday). For the main category, info-stealer…
#ParsedReport
07-07-2022
Targets of Interest \| Russian Organizations Increasingly Under Attack By Chinese APTs
https://www.sentinelone.com/labs/targets-of-interest-russian-organizations-increasingly-under-attack-by-chinese-apts
Actors/Campaigns:
Red_delta
Scarab
Tonto_team
Threats:
Korlia (tags: malware)
Industry:
Telco, Government
Geo:
Russian, Russia, Chinese, Pakistan, Pakistani, Ukraines, Asia, Ukraine, Chinas
CVEs:
CVE-2018-0798 [Vulners]
Vulners: Score: 9.3, CVSS: 9.3,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft office (2010, 2016, 2016, 2007, 2013)
- microsoft word (2013, 2016, 2007, 2010, 2013)
- microsoft office compatibility pack (-)
IOCs:
File: 3
Hash: 11
Domain: 4
IP: 2
07-07-2022
Targets of Interest \| Russian Organizations Increasingly Under Attack By Chinese APTs
https://www.sentinelone.com/labs/targets-of-interest-russian-organizations-increasingly-under-attack-by-chinese-apts
Actors/Campaigns:
Red_delta
Scarab
Tonto_team
Threats:
Korlia (tags: malware)
Industry:
Telco, Government
Geo:
Russian, Russia, Chinese, Pakistan, Pakistani, Ukraines, Asia, Ukraine, Chinas
CVEs:
CVE-2018-0798 [Vulners]
Vulners: Score: 9.3, CVSS: 9.3,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft office (2010, 2016, 2016, 2007, 2013)
- microsoft word (2013, 2016, 2007, 2010, 2013)
- microsoft office compatibility pack (-)
IOCs:
File: 3
Hash: 11
Domain: 4
IP: 2
SentinelOne
Targets of Interest | Russian Organizations Increasingly Under Attack By Chinese APTs
Chinese-linked phishing campaign seeks to compromise Russian targets with custom malware designed for espionage.
#ParsedReport
07-07-2022
Unpacking Cloud-Based Cryptocurrency Miners That Abuse GitHub Actions and Azure Virtual Machines
https://www.trendmicro.com/en_us/research/22/g/unpacking-cloud-based-cryptocurrency-miners-that-abuse-github-ac.html
Threats:
Xmrig_miner (tags: cryptomining)
Industry:
E-commerce
IOCs:
File: 2
Coin: 7
Hash: 2
Links:
07-07-2022
Unpacking Cloud-Based Cryptocurrency Miners That Abuse GitHub Actions and Azure Virtual Machines
https://www.trendmicro.com/en_us/research/22/g/unpacking-cloud-based-cryptocurrency-miners-that-abuse-github-ac.html
Threats:
Xmrig_miner (tags: cryptomining)
Industry:
E-commerce
IOCs:
File: 2
Coin: 7
Hash: 2
Links:
https://github.com/Hffffhujft/hahsy/blob/main/.github/workflows/main.ymlhttps://github.com/limoain14/Langs/blob/main/.github/workflows/main.ymlhttps://github.com/aldilariskhameilenia2018/mining22/blob/main/.github/workflows/blank.ymlhttps://github.com/nick-fields/retryhttps://github.com/gesbul1989/VERUS/blob/main/.github/workflows/baru.ymlhttps://github.com/search?q=xmrig+extension%3Ayaml+extension%3Ayml+path%3A.github%2Fworkflows&type=Codehttps://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow\_dispatchhttps://docs.github.com/en/actions/using-jobs/using-a-matrix-for-your-jobshttps://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runnershttps://github.com/000h0/1hars/blob/circleci-project-setup/.github/workflows/main.ymlhttps://github.com/janjan1999/shiba/blob/main/.github/Workflows/KaptenCrypto.ymlhttps://github.com/wa2nderma1/StartNew/blob/main/.github/workflows/mulai1.ymlhttps://github.com/FixKRI1/miner/blob/main/.github/workflows/main.ymlhttps://github.com/wizman008/shiba/blob/main/.github/workflows/coins.ymlhttps://github.com/aldilariskhameilenia2018/mininggg/blob/main/.github/workflows/blank.ymlhttps://github.com/actions/checkouthttps://github.com/jaknan/pg/blob/main/.github/workflows/main.ymlhttps://github.com/Olish420/nubatur/blob/main/.github/workflows/nubatur.ymlhttps://docs.github.com/en/actions/learn-github-actions/understanding-github-actionshttps://github.com/dsdnklasmals/aaaaaaaaaaaaa/blob/main/.github/Workflows/KaptenCrypto.ymlhttps://github.com/Olish420/tron/blob/main/.github/workflows/tron.ymlhttps://github.com/jaknan/pg/actionsTrend Micro
Unpacking Cloud-Based Cryptocurrency Miners That Abuse GitHub Actions and Azure Virtual Machines
We investigate cloud-based cryptocurrency miners that leverage GitHub Actions and Azure virtual machines, including the cloud infrastructure and vulnerabilities that malicious actors exploit for easy monetary gain.
#ParsedReport
07-07-2022
Unprecedented Shift: The Trickbot Group is Systematically Attacking Ukraine
https://securityintelligence.com/posts/trickbot-group-systematically-attacking-ukraine
Actors/Campaigns:
Wizard_spider (motivation: cyber_criminal, financially_motivated, information_theft)
Ta578
Threats:
Trickbot (tags: malware, backdoor, phishing, ransomware, dropper, ddos, trojan)
Icedid (tags: malware, phishing, ransomware, dropper)
Cobalt_strike (tags: malware, phishing, ransomware, dropper, rat)
Meterpreter_tool (tags: phishing)
Bumblebee (tags: malware, ransomware, rat)
Conti
Ryuk
Diavol
Emotet
Tron
Bazarbackdoor
Anchor (tags: dropper)
Follina_vuln
Beacon
Putty_tool (tags: malware)
Industry:
Financial
Geo:
Ukraine, Ukraines, Belarus, Ukrainian, Russian, Russia
CVEs:
CVE-2022-30190 [Vulners]
Vulners: Score: 9.3, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 1809, 20h2, 21h1, 21h2)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
- microsoft windows server 2008 (-, r2)
have more...
IOCs:
File: 10
Hash: 38
Url: 13
Domain: 3
Path: 4
Functions Names: 1
07-07-2022
Unprecedented Shift: The Trickbot Group is Systematically Attacking Ukraine
https://securityintelligence.com/posts/trickbot-group-systematically-attacking-ukraine
Actors/Campaigns:
Wizard_spider (motivation: cyber_criminal, financially_motivated, information_theft)
Ta578
Threats:
Trickbot (tags: malware, backdoor, phishing, ransomware, dropper, ddos, trojan)
Icedid (tags: malware, phishing, ransomware, dropper)
Cobalt_strike (tags: malware, phishing, ransomware, dropper, rat)
Meterpreter_tool (tags: phishing)
Bumblebee (tags: malware, ransomware, rat)
Conti
Ryuk
Diavol
Emotet
Tron
Bazarbackdoor
Anchor (tags: dropper)
Follina_vuln
Beacon
Putty_tool (tags: malware)
Industry:
Financial
Geo:
Ukraine, Ukraines, Belarus, Ukrainian, Russian, Russia
CVEs:
CVE-2022-30190 [Vulners]
Vulners: Score: 9.3, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 1809, 20h2, 21h1, 21h2)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
- microsoft windows server 2008 (-, r2)
have more...
IOCs:
File: 10
Hash: 38
Url: 13
Domain: 3
Path: 4
Functions Names: 1
Security Intelligence
Unprecedented Shift: The Trickbot Group is Systematically Attacking Ukraine
IBM Security X-Force uncovered evidence indicating that the Russia-based cybercriminal syndicate "Trickbot group" has been attacking Ukraine since the Russian invasion. Explore an in-depth analysis on six of ITG23's campaigns.
#ParsedReport
07-07-2022
Stormous Ransomware Group Runs Opinion Polls, Leaks Intellectual Property of Indian Companies
https://cloudsek.com/threatintelligence/stormous-ransomware-group-runs-opinion-polls-leaks-intellectual-property-of-indian-companies/?utm_source=rss&utm_medium=rss&utm_campaign=stormous-ransomware-group-runs-opinion-polls-leaks-intellectual-property-of-indian-companies
Actors/Campaigns:
Stormous (motivation: financially_motivated, hacktivism)
Threats:
Ekipa_rat (tags: ransomware)
Industry:
Financial, Telco, Education
Geo:
Russian, Indiacounty, India, Indian
TTPs:
Tactics: 1
Technics: 0
IOCs:
Hash: 19
IP: 10
Url: 4
07-07-2022
Stormous Ransomware Group Runs Opinion Polls, Leaks Intellectual Property of Indian Companies
https://cloudsek.com/threatintelligence/stormous-ransomware-group-runs-opinion-polls-leaks-intellectual-property-of-indian-companies/?utm_source=rss&utm_medium=rss&utm_campaign=stormous-ransomware-group-runs-opinion-polls-leaks-intellectual-property-of-indian-companies
Actors/Campaigns:
Stormous (motivation: financially_motivated, hacktivism)
Threats:
Ekipa_rat (tags: ransomware)
Industry:
Financial, Telco, Education
Geo:
Russian, Indiacounty, India, Indian
TTPs:
Tactics: 1
Technics: 0
IOCs:
Hash: 19
IP: 10
Url: 4
Cloudsek
Stormous Ransomware Group Runs Opinion Polls, Leaks Intellectual Property of Indian Companies | Threat Intelligence | CloudSEK
CloudSEK team has identified Stormous ransomware campaigns targeting multiple organizations globally. The threat group is financially motivated and their latest chain of attacks has been directed at Indian entities as well.