#ParsedReport
20-07-2022
Redeemer Ransomware back Action
https://blog.cyble.com/2022/07/20/redeemer-ransomware-back-action
Threats:
Redeemer
Industry:
Financial
TTPs:
Tactics: 5
Technics: 10
IOCs:
File: 8
Path: 3
Hash: 4
Softs:
telegram, vssadmin, bootnxt, winlogon
Functions:
OpenSSL, FindNextFileW, ShellExecuteW, FindFirstFileW
20-07-2022
Redeemer Ransomware back Action
https://blog.cyble.com/2022/07/20/redeemer-ransomware-back-action
Threats:
Redeemer
Industry:
Financial
TTPs:
Tactics: 5
Technics: 10
IOCs:
File: 8
Path: 3
Hash: 4
Softs:
telegram, vssadmin, bootnxt, winlogon
Functions:
OpenSSL, FindNextFileW, ShellExecuteW, FindFirstFileW
Cyble
Redeemer Ransomware back Action
Cyble analyzes the return of Redeemer ransomware and how the ransomware developer is increasingly leveraging affiliates.
#ParsedReport
20-07-2022
Atlas Intelligence Group (A.I.G) The Wrath of a Titan
https://cyberint.com/blog/research/atlas-intelligence-group
Actors/Campaigns:
Atlantis_cyberarmy
Ddosarmy
Industry:
Education, Government, Financial, E-commerce
Geo:
Pakistan, Israel, Colombia, Emirates, German, Germany
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 3
Softs:
telegram
20-07-2022
Atlas Intelligence Group (A.I.G) The Wrath of a Titan
https://cyberint.com/blog/research/atlas-intelligence-group
Actors/Campaigns:
Atlantis_cyberarmy
Ddosarmy
Industry:
Education, Government, Financial, E-commerce
Geo:
Pakistan, Israel, Colombia, Emirates, German, Germany
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 3
Softs:
telegram
Cyberint
Atlas Intelligence Group (A.I.G) – The Wrath of a Titan
The Atlas Intelligence Group is recruiting cyber-mercenaries to do specific jobs as a part of bigger campaigns known only to the admins.
#ParsedReport
20-07-2022
New Variant of QakBot Being Spread by HTML File Attached to Phishing Emails
https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails
Threats:
Qakbot
Procmon_tool
Netstat_tool
Industry:
Financial
IOCs:
File: 43
Path: 1
Hash: 3
IP: 243
Softs:
unix, microsoft defender, curl, microsoft edge
Algorithms:
base64, xor, rc4
Functions:
NetGetJoinInformation, GetVersionEx, LookupAccountSidW, WriteProcessMemory, GetSystemMetrics, CreateThread, built-in, GetComputerNameW, FindResourceW, CreateProcessW, API, GetModuleFileNameW, ResumeThread, GetSystemInfo, encryption, CreatProcessW
20-07-2022
New Variant of QakBot Being Spread by HTML File Attached to Phishing Emails
https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails
Threats:
Qakbot
Procmon_tool
Netstat_tool
Industry:
Financial
IOCs:
File: 43
Path: 1
Hash: 3
IP: 243
Softs:
unix, microsoft defender, curl, microsoft edge
Algorithms:
base64, xor, rc4
Functions:
NetGetJoinInformation, GetVersionEx, LookupAccountSidW, WriteProcessMemory, GetSystemMetrics, CreateThread, built-in, GetComputerNameW, FindResourceW, CreateProcessW, API, GetModuleFileNameW, ResumeThread, GetSystemInfo, encryption, CreatProcessW
Fortinet Blog
New Variant of QakBot Being Spread by HTML File Attached to Phishing Emails
FortiGuard Labs discovered a phishing campaign spreading a new variant of the information stealer and banking Trojan QakBot. Read our blog to learn how the QakBot variant operates. …
#ParsedReport
20-07-2022
Black Basta Ransomware Victim Knauf Forced to Stop Their Services
https://socradar.io/black-basta-ransomware-victim-knauf-forced-to-stop-their-services
Threats:
Blackbasta
Conti
Qakbot
Filecoder
Trojan.win32.delshad.gen
Sabsik
Geo:
India, Australia, Canada
IOCs:
Domain: 1
Hash: 10
File: 1
IP: 20
Softs:
esxi, windows defender
20-07-2022
Black Basta Ransomware Victim Knauf Forced to Stop Their Services
https://socradar.io/black-basta-ransomware-victim-knauf-forced-to-stop-their-services
Threats:
Blackbasta
Conti
Qakbot
Filecoder
Trojan.win32.delshad.gen
Sabsik
Geo:
India, Australia, Canada
IOCs:
Domain: 1
Hash: 10
File: 1
IP: 20
Softs:
esxi, windows defender
SOCRadar® Cyber Intelligence Inc.
Black Basta Ransomware Victim Knauf Forced to Stop Their Services - SOCRadar® Cyber Intelligence Inc.
#ParsedReport
20-07-2022
ISO IcedID. ICEDID distribution through ISO file
https://asec.ahnlab.com/ko/36776
Threats:
Icedid
Bumblebee
Emotet
Dridex
Trojan/win.generic.r503676
Industry:
Financial
IOCs:
File: 12
Path: 2
Url: 2
Hash: 4
20-07-2022
ISO IcedID. ICEDID distribution through ISO file
https://asec.ahnlab.com/ko/36776
Threats:
Icedid
Bumblebee
Emotet
Dridex
Trojan/win.generic.r503676
Industry:
Financial
IOCs:
File: 12
Path: 2
Url: 2
Hash: 4
ASEC BLOG
ISO 파일을 통해 IcedID 유포 중 - ASEC BLOG
ASEC 분석팀은 ISO 파일을 통해 다양한 악성코드가 유포되고 있는 사례를 소개해왔다. 최근에는 ISO 파일을 통해 모듈형 뱅킹 악성코드인 IcedID 가 유포 중인 것을 확인하였다. 확인된 유형은 2가지로, 하나는 이전에 소개했던 Bumblebee 악성코드와 동일한 방식을 이용하였다. 나머지 유형 또한 비슷한 방식을 사용했지만, 스크립트 파일과 cmd 명령어가 추가된 형태이다. 먼저, 첫번째 유형은 IcedID 가 실행되는 과정 및 유포되는 과정이…
#ParsedReport
20-07-2022
Analyzing Penetration-Testing Tools That Threat Actors Use to Breach Systems and Steal Data
https://www.trendmicro.com/en_us/research/22/g/analyzing-penetration-testing-tools-that-threat-actors-use-to-br.html
Threats:
Pchunter_tool
Psexec_tool
Minidump_tool
Megasync_tool
IOCs:
Path: 6
File: 6
Url: 1
Softs:
microsoft exchange, unix, mssql, active directory, curl
Links:
20-07-2022
Analyzing Penetration-Testing Tools That Threat Actors Use to Breach Systems and Steal Data
https://www.trendmicro.com/en_us/research/22/g/analyzing-penetration-testing-tools-that-threat-actors-use-to-br.html
Threats:
Pchunter_tool
Psexec_tool
Minidump_tool
Megasync_tool
IOCs:
Path: 6
File: 6
Url: 1
Softs:
microsoft exchange, unix, mssql, active directory, curl
Links:
https://github.com/lgandx/ResponderTrend Micro
Analyzing Penetration-Testing Tools That Threat Actors Use to Breach Systems and Steal Data
We discovered the use of two Python penetration-testing tools, Impacket and Responder, that malicious actors used to compromise systems and exfiltrate data. We share our key findings in this report.
#ParsedReport
20-07-2022
Luna and Black Basta new ransomware for Windows, Linux and ESXi
https://securelist.com/luna-black-basta-ransomware/106950
Actors/Campaigns:
Blackcat
Threats:
Blackbasta
Luna
Conti
Geo:
Russian, Asia
IOCs:
Path: 2
Softs:
esxi
Algorithms:
chacha20, curve25519, aes
20-07-2022
Luna and Black Basta new ransomware for Windows, Linux and ESXi
https://securelist.com/luna-black-basta-ransomware/106950
Actors/Campaigns:
Blackcat
Threats:
Blackbasta
Luna
Conti
Geo:
Russian, Asia
IOCs:
Path: 2
Softs:
esxi
Algorithms:
chacha20, curve25519, aes
Securelist
Kaspersky report on Luna and Black Basta ransomware
This report discusses new ransomware, that targets Windows, Linux and ESXi systems: Luna written in Rust and Black Basta.
#ParsedReport
20-07-2022
LockBit: Ransomware Puts Servers in the Crosshairs
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockbit-targets-servers
Threats:
Lockbit
Uacme
Conti
Lockdown
Geo:
Russia
TTPs:
Tactics: 3
Technics: 0
IOCs:
File: 9
Path: 2
Hash: 1
Url: 1
Softs:
windows defender, anydesk, active directory, wordpad, process explorer, msexchange, vssadmin
Functions:
DuplicateTokenEx, CreateProcessAsUserW, GetSystemDefaultUILanguage, GetUserDefaultUILanguage
20-07-2022
LockBit: Ransomware Puts Servers in the Crosshairs
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockbit-targets-servers
Threats:
Lockbit
Uacme
Conti
Lockdown
Geo:
Russia
TTPs:
Tactics: 3
Technics: 0
IOCs:
File: 9
Path: 2
Hash: 1
Url: 1
Softs:
windows defender, anydesk, active directory, wordpad, process explorer, msexchange, vssadmin
Functions:
DuplicateTokenEx, CreateProcessAsUserW, GetSystemDefaultUILanguage, GetUserDefaultUILanguage
#ParsedReport
20-07-2022
Google ads lead to major malvertising campaign
https://blog.malwarebytes.com/threat-intelligence/2022/07/google-ads-lead-to-major-malvertising-campaign
IOCs:
Domain: 22
20-07-2022
Google ads lead to major malvertising campaign
https://blog.malwarebytes.com/threat-intelligence/2022/07/google-ads-lead-to-major-malvertising-campaign
IOCs:
Domain: 22
Malwarebytes
Google ads lead to major malvertising campaign
Fraudsters have long been leveraging the shady corners of the internet to place malicious adverts, leading users to various scams. However,...
#ParsedReport
21-07-2022
Change in Injection Method of Magniber Ransomware
https://asec.ahnlab.com/en/36475
Threats:
Magniber
Process_injection_technique
IOCs:
File: 2
Path: 1
Hash: 2
Softs:
chrome, windows installer
Algorithms:
xor
21-07-2022
Change in Injection Method of Magniber Ransomware
https://asec.ahnlab.com/en/36475
Threats:
Magniber
Process_injection_technique
IOCs:
File: 2
Path: 1
Hash: 2
Softs:
chrome, windows installer
Algorithms:
xor
ASEC BLOG
Change in Injection Method of Magniber Ransomware - ASEC BLOG
The ASEC analysis team is constantly monitoring Magniber, which has a higher number of distribution cases. It has been distributed through the IE (Internet Explorer) vulnerability for the past few years but stopped exploiting the vulnerability after the support…
#ParsedReport
21-07-2022
Malware Being Distributed by Disguising Itself as Icon of V3 Lite
https://asec.ahnlab.com/en/36629
Threats:
Avemaria_rat
Agent_tesla
Lokibot_stealer
Formbook
Remcos_rat
Trojan/win.msilkrypt.r495355
Trojan/win.msilkrypt.r498085
Trojan/win.msil.c5152589
Trojan/win.msil.r500015
Trojan/win.msil.c515258
Tnega
Geo:
Korea
IOCs:
File: 4
Hash: 3
IP: 1
Url: 2
21-07-2022
Malware Being Distributed by Disguising Itself as Icon of V3 Lite
https://asec.ahnlab.com/en/36629
Threats:
Avemaria_rat
Agent_tesla
Lokibot_stealer
Formbook
Remcos_rat
Trojan/win.msilkrypt.r495355
Trojan/win.msilkrypt.r498085
Trojan/win.msil.c5152589
Trojan/win.msil.r500015
Trojan/win.msil.c515258
Tnega
Geo:
Korea
IOCs:
File: 4
Hash: 3
IP: 1
Url: 2
ASEC BLOG
Malware Being Distributed by Disguising Itself as Icon of V3 Lite - ASEC BLOG
The ASEC analysis team has discovered the distribution of malware disguised as a V3 Lite icon and packed with the .NET packer. The attacker likely created an icon that is almost identical to that of V3 Lite to trick the user, and AveMaria RAT and AgentTesla…
#ParsedReport
21-07-2022
Amadey Bot Being Distributed Through SmokeLoader
https://asec.ahnlab.com/en/36634
Actors/Campaigns:
Ta505
Threats:
Amadey
Smokeloader
Gandcrab
Flawedammyy
Clop
Fallout_ek_tool
Rig_tool
Redline_stealer
Tightvnc_tool
Uac_bypass_technique
Dll_hijacking_technique
Trojan/win.malpe.r503126
Delf
Trojan/win.generic.r503640
Malware/win.trojanspy.r438708
Malware/mdp.download.m1197
IOCs:
File: 15
Path: 7
Registry: 1
Url: 15
Hash: 10
IP: 1
Softs:
realvnc, total commander, task scheduler, windows defender, winscp, tigervnc
Languages:
delphi, rust, autoit
21-07-2022
Amadey Bot Being Distributed Through SmokeLoader
https://asec.ahnlab.com/en/36634
Actors/Campaigns:
Ta505
Threats:
Amadey
Smokeloader
Gandcrab
Flawedammyy
Clop
Fallout_ek_tool
Rig_tool
Redline_stealer
Tightvnc_tool
Uac_bypass_technique
Dll_hijacking_technique
Trojan/win.malpe.r503126
Delf
Trojan/win.generic.r503640
Malware/win.trojanspy.r438708
Malware/mdp.download.m1197
IOCs:
File: 15
Path: 7
Registry: 1
Url: 15
Hash: 10
IP: 1
Softs:
realvnc, total commander, task scheduler, windows defender, winscp, tigervnc
Languages:
delphi, rust, autoit
ASEC
Amadey Bot Being Distributed Through SmokeLoader - ASEC
Amadey Bot Being Distributed Through SmokeLoader ASEC
#ParsedReport
21-07-2022
Lightning Framework: New Undetected Swiss Army Knife Linux Malware
https://www.intezer.com/blog/research/lightning-framework-new-linux-threat
Threats:
Lightning_tool
Jigsaw
Netstat_tool
Timestomp_technique
TTPs:
Tactics: 4
Technics: 17
IOCs:
File: 7
IP: 1
Hash: 3
Algorithms:
xor
Functions:
GetRemotePathInfo, CloseShellPure, GetDomainSetting, OpenSSH, DeleteGuid, RemoveKernelHide, DeleteVecFile, SetDomainSetting
Links:
21-07-2022
Lightning Framework: New Undetected Swiss Army Knife Linux Malware
https://www.intezer.com/blog/research/lightning-framework-new-linux-threat
Threats:
Lightning_tool
Jigsaw
Netstat_tool
Timestomp_technique
TTPs:
Tactics: 4
Technics: 17
IOCs:
File: 7
IP: 1
Hash: 3
Algorithms:
xor
Functions:
GetRemotePathInfo, CloseShellPure, GetDomainSetting, OpenSSH, DeleteGuid, RemoveKernelHide, DeleteVecFile, SetDomainSetting
Links:
https://github.com/raboof/nethogsIntezer
Lightning Framework: New “Swiss Army Knife” Linux Malware
A new Linux malware we're calling Lightning Framework has modular plugins and the ability to install multiple types of rootkits.
#ParsedReport
21-07-2022
ASEC Weekly Malware Statistics (July 4th, 2022 July 10th, 2022)
https://asec.ahnlab.com/en/36586
Threats:
Agent_tesla
Cloudeye
Formbook
Remcos_rat
Nanocore_rat
Clipboard_grabbing_technique
Redline_stealer
Beamwinhttp_loader
Industry:
Financial
IOCs:
Domain: 4
IP: 4
Email: 4
File: 20
Url: 39
Softs:
discord, nsis installer
Languages:
visual_basic
21-07-2022
ASEC Weekly Malware Statistics (July 4th, 2022 July 10th, 2022)
https://asec.ahnlab.com/en/36586
Threats:
Agent_tesla
Cloudeye
Formbook
Remcos_rat
Nanocore_rat
Clipboard_grabbing_technique
Redline_stealer
Beamwinhttp_loader
Industry:
Financial
IOCs:
Domain: 4
IP: 4
Email: 4
File: 20
Url: 39
Softs:
discord, nsis installer
Languages:
visual_basic
ASEC BLOG
ASEC Weekly Malware Statistics (July 4th, 2022 - July 10th, 2022) - ASEC BLOG
The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from July 4th, 2022 (Monday) to July 10th, 2022 (Sunday). For the main category, info-stealer…
#ParsedReport
21-07-2022
eSentire Threat Intelligence Malware Analysis: Gootloader and IcedID
https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-gootloader-and-icedid
Actors/Campaigns:
Xinglocker
Threats:
Gootloader
Icedid
Cobalt_strike
Process_hollowing_technique
Pingpull
Antidebugging_technique
Sandbox_evasion_technique
Conti
Quantum_locker
Quantum_tool
Industry:
Financial
Geo:
Apac, America, Africa, Emea
IOCs:
Registry: 6
Domain: 1
File: 2
Hash: 4
Softs:
active directory
Algorithms:
exhibit
Functions:
Foad, WriteProcessMemory, GetTickCount, GetComputerNameExW, GetUserNameW, Test, GetAdaptersInfo
Languages:
java, php
YARA: Found
21-07-2022
eSentire Threat Intelligence Malware Analysis: Gootloader and IcedID
https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-gootloader-and-icedid
Actors/Campaigns:
Xinglocker
Threats:
Gootloader
Icedid
Cobalt_strike
Process_hollowing_technique
Pingpull
Antidebugging_technique
Sandbox_evasion_technique
Conti
Quantum_locker
Quantum_tool
Industry:
Financial
Geo:
Apac, America, Africa, Emea
IOCs:
Registry: 6
Domain: 1
File: 2
Hash: 4
Softs:
active directory
Algorithms:
exhibit
Functions:
Foad, WriteProcessMemory, GetTickCount, GetComputerNameExW, GetUserNameW, Test, GetAdaptersInfo
Languages:
java, php
YARA: Found
eSentire
eSentire Threat Intelligence Malware Analysis: Gootloader and IcedID
Dive deeper into the technical details gathered during eSentire’s Threat Response Unit (TRU) team’s research and threat analysis of the Gootloader malware and IcedID payload.
#ParsedReport
21-07-2022
LockBit 3.0 Update \| Unpicking the Ransomwares Latest Anti-Analysis and Evasion Techniques
https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques
Actors/Campaigns:
Blackmatter
Threats:
Lockbit
Cobalt_strike
Socgholish_loader
Uac_bypass_technique
Blackcat
Egregor
Antidebugging_technique
Conti
Process_injection_technique
Industry:
Financial
Geo:
Russian, Ukraine
TTPs:
IOCs:
Hash: 6
Domain: 19
Softs:
thebat, powerpnt, steam, encsvc, dbsnmp, windows service, onenote, msexchange, zcash, wordpad
Algorithms:
xor, exhibit
Functions:
NtSetInformationThread
21-07-2022
LockBit 3.0 Update \| Unpicking the Ransomwares Latest Anti-Analysis and Evasion Techniques
https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques
Actors/Campaigns:
Blackmatter
Threats:
Lockbit
Cobalt_strike
Socgholish_loader
Uac_bypass_technique
Blackcat
Egregor
Antidebugging_technique
Conti
Process_injection_technique
Industry:
Financial
Geo:
Russian, Ukraine
TTPs:
IOCs:
Hash: 6
Domain: 19
Softs:
thebat, powerpnt, steam, encsvc, dbsnmp, windows service, onenote, msexchange, zcash, wordpad
Algorithms:
xor, exhibit
Functions:
NtSetInformationThread
SentinelOne
LockBit 3.0 Update | Unpicking the Ransomware's Latest Anti-Analysis and Evasion Techniques
The self-proclaimed 'oldest ransomware affiliate on the planet' has new tricks and new features and continues to beat enterprise defenses.
#ParsedReport
21-07-2022
Buy, Sell, Steal, EvilNum Targets Cryptocurrency, Forex, Commodities
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Actors/Campaigns:
Evilnum (motivation: information_theft)
Venom_spider
Industry:
Financial
IOCs:
Domain: 8
File: 7
Url: 11
Path: 1
Hash: 5
Email: 5
Softs:
windows defender, microsoft word
Languages:
java
21-07-2022
Buy, Sell, Steal, EvilNum Targets Cryptocurrency, Forex, Commodities
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Actors/Campaigns:
Evilnum (motivation: information_theft)
Venom_spider
Industry:
Financial
IOCs:
Domain: 8
File: 7
Url: 11
Path: 1
Hash: 5
Email: 5
Softs:
windows defender, microsoft word
Languages:
java
Proofpoint
Buy, Sell, Steal, EvilNum Targets Cryptocurrency, Forex, Commodities | Proofpoint US
Key Findings TA4563 is a threat actor leveraging EvilNum malware to target European financial and investment entities, especially those with operations supporting foreign exchanges,
#ParsedReport
21-07-2022
Attackers target Ukraine using GoMet backdoor
http://blog.talosintelligence.com/2022/07/attackers-target-ukraine-using-gomet.html
Threats:
Gomet_dropper
Industry:
Government
Geo:
Ukrainian, Ukraine, Russian, Ukrainians
CVEs:
CVE-2020-5902 [Vulners]
Vulners: Score: 10.0, CVSS: 4.6,
Vulners: Exploitation: True
X-Force: Risk: 10
X-Force: Patch: Official fix
Soft:
- f5 big-ip access policy manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, le15.0.1.4, <15.1.0.4)
- f5 big-ip advanced firewall manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip advanced web application firewall (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip analytics (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip application acceleration manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
have more...
CVE-2022-1040 [Vulners]
Vulners: Score: 7.5, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- sophos sfos (le18.5.3)
IOCs:
File: 6
Hash: 3
Path: 1
IP: 1
Softs:
task scheduler
Links:
21-07-2022
Attackers target Ukraine using GoMet backdoor
http://blog.talosintelligence.com/2022/07/attackers-target-ukraine-using-gomet.html
Threats:
Gomet_dropper
Industry:
Government
Geo:
Ukrainian, Ukraine, Russian, Ukrainians
CVEs:
CVE-2020-5902 [Vulners]
Vulners: Score: 10.0, CVSS: 4.6,
Vulners: Exploitation: True
X-Force: Risk: 10
X-Force: Patch: Official fix
Soft:
- f5 big-ip access policy manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, le15.0.1.4, <15.1.0.4)
- f5 big-ip advanced firewall manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip advanced web application firewall (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip analytics (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip application acceleration manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
have more...
CVE-2022-1040 [Vulners]
Vulners: Score: 7.5, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- sophos sfos (le18.5.3)
IOCs:
File: 6
Hash: 3
Path: 1
IP: 1
Softs:
task scheduler
Links:
https://github.com/Laeeth/GoMetCisco Talos Blog
Attackers target Ukraine using GoMet backdoor
Executive summary
Since the Russian invasion of Ukraine began, Ukrainians have been under a nearly constant barrage of cyber attacks. Working jointly with Ukrainian organizations, Cisco Talos has discovered a fairly uncommon piece of malware targeting Ukraine…
Since the Russian invasion of Ukraine began, Ukrainians have been under a nearly constant barrage of cyber attacks. Working jointly with Ukrainian organizations, Cisco Talos has discovered a fairly uncommon piece of malware targeting Ukraine…
#ParsedReport
21-07-2022
The Return of Candiru: Zero-days in the Middle East
https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/?utm_source=rss&utm_medium=rss&utm_campaign=the-return-of-candiru-zero-days-in-the-middle-east
Threats:
Watering_hole_technique
Devilstongue
Geo:
Palestine, Yemen, Lebanon, Turkey
CVEs:
CVE-2022-2294 [Vulners]
Vulners: Score: Unknown, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
IOCs:
Domain: 11
Path: 30
Registry: 4
Softs:
google chrome, chrome, chromium
Algorithms:
rsa-2048, aes-256-cbc
Languages:
java, Javascript
Links:
21-07-2022
The Return of Candiru: Zero-days in the Middle East
https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/?utm_source=rss&utm_medium=rss&utm_campaign=the-return-of-candiru-zero-days-in-the-middle-east
Threats:
Watering_hole_technique
Devilstongue
Geo:
Palestine, Yemen, Lebanon, Turkey
CVEs:
CVE-2022-2294 [Vulners]
Vulners: Score: Unknown, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
IOCs:
Domain: 11
Path: 30
Registry: 4
Softs:
google chrome, chrome, chromium
Algorithms:
rsa-2048, aes-256-cbc
Languages:
java, Javascript
Links:
https://github.com/avast/ioc/tree/master/CandiruGendigital
The Return of Candiru: Zero-days in the Middle East
Zero-day vulnerability in Google Chrome discovery
#ParsedReport
21-07-2022
Profiling YDIO, the Blackhat Group Behind #OpBRICS. Appendix
https://cloudsek.com/threatintelligence/profiling-ydio-the-blackhat-group-behind-opbrics/?utm_source=rss&utm_medium=rss&utm_campaign=profiling-ydio-the-blackhat-group-behind-opbrics
Actors/Campaigns:
Ydio
Industry:
Government, Healthcare, Telco
Geo:
Russian, Africa, Russia, Chinese, Brazil, China, Belarus, India
TTPs:
Tactics: 1
Technics: 0
Softs:
telegram
21-07-2022
Profiling YDIO, the Blackhat Group Behind #OpBRICS. Appendix
https://cloudsek.com/threatintelligence/profiling-ydio-the-blackhat-group-behind-opbrics/?utm_source=rss&utm_medium=rss&utm_campaign=profiling-ydio-the-blackhat-group-behind-opbrics
Actors/Campaigns:
Ydio
Industry:
Government, Healthcare, Telco
Geo:
Russian, Africa, Russia, Chinese, Brazil, China, Belarus, India
TTPs:
Tactics: 1
Technics: 0
Softs:
telegram
Cloudsek
Profiling YDIO, the Blackhat Group Behind #OpBRICS | Threat Intelligence | CloudSEK
XVigil discovered a new operation named #OpBRICS launched by the threat actor group Your Data is Ours (YDIO) against the following five major emerging economies:
#ParsedReport
21-07-2022
AppleSeed. AppleSed is distributed to certain military maintenance companies
https://asec.ahnlab.com/ko/36918
Actors/Campaigns:
Kimsuky
Threats:
Appleseed
IOCs:
File: 4
Path: 1
Hash: 2
Url: 2
21-07-2022
AppleSeed. AppleSed is distributed to certain military maintenance companies
https://asec.ahnlab.com/ko/36918
Actors/Campaigns:
Kimsuky
Threats:
Appleseed
IOCs:
File: 4
Path: 1
Hash: 2
Url: 2
ASEC BLOG
특정 군부대 유지보수 업체 대상으로 AppleSeed 유포 - ASEC BLOG
ASEC 분석팀은 최근 특정 군부대 유지보수 업체 대상으로 AppleSeed 악성코드를 유포하는 정황을 포착하였다. AppleSeed 악성코드는 Kimsuky 조직에서 주로 사용되는 백도어성 악성코드로 최근 여러 대상을 타깃으로 활발히 유포하고 있다. 이번에는 특정 군부대의 이름이 담긴 아래와 같은 파일명으로 악성코드 유포가 이루어졌다. 20220713_****부대_설치 예상 일정V004_***시스 수정_6.xls 최초 엑셀 문서 형태(XLS)로 유포가…