#ParsedReport
21-07-2022
Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group
https://www.tenable.com/blog/brazen-unsophisticated-and-illogical-understanding-the-lapsus-extortion-group
Actors/Campaigns:
Lapsus (motivation: information_theft, script_kiddie, politically_motivated, cyber_criminal)
Karakurt (motivation: information_theft)
Ransomhouse
Threats:
Conti
Empire_loader
Godfather
Silence
Avoslocker
Lockbit
Industry:
Telco, Financial, Media, Healthcare, Government
Geo:
America, Brazil, Portugal
IOCs:
File: 2
Softs:
tiktok, confluence, telegram, active directory, microsoft sharepoint
21-07-2022
Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group
https://www.tenable.com/blog/brazen-unsophisticated-and-illogical-understanding-the-lapsus-extortion-group
Actors/Campaigns:
Lapsus (motivation: information_theft, script_kiddie, politically_motivated, cyber_criminal)
Karakurt (motivation: information_theft)
Ransomhouse
Threats:
Conti
Empire_loader
Godfather
Silence
Avoslocker
Lockbit
Industry:
Telco, Financial, Media, Healthcare, Government
Geo:
America, Brazil, Portugal
IOCs:
File: 2
Softs:
tiktok, confluence, telegram, active directory, microsoft sharepoint
Tenable®
Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group
Having gained the industry’s attention in the first months of 2022, the LAPSUS$ extortion group has largely gone quiet. What can we learn from this extortion group’s story and tactics?
Попробовал повысить качество вытаскивания функций WIN API из отчетов. Посмотрим что получится )))
#ParsedReport
22-07-2022
The Return of Candiru: Zero-days in the Middle East
https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east
Threats:
Watering_hole_technique
Devilstongue
Geo:
Lebanon, Yemen, Turkey, Palestine
CVEs:
CVE-2022-2294 [Vulners]
Vulners: Score: Unknown, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
IOCs:
Domain: 11
Path: 30
Registry: 4
Softs:
chrome, chromium, google chrome
Algorithms:
aes-256-cbc, rsa-2048
Languages:
javascript
Platforms:
apple
Links:
22-07-2022
The Return of Candiru: Zero-days in the Middle East
https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east
Threats:
Watering_hole_technique
Devilstongue
Geo:
Lebanon, Yemen, Turkey, Palestine
CVEs:
CVE-2022-2294 [Vulners]
Vulners: Score: Unknown, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
IOCs:
Domain: 11
Path: 30
Registry: 4
Softs:
chrome, chromium, google chrome
Algorithms:
aes-256-cbc, rsa-2048
Languages:
javascript
Platforms:
apple
Links:
https://github.com/avast/ioc/tree/master/CandiruGendigital
The Return of Candiru: Zero-days in the Middle East
Zero-day vulnerability in Google Chrome discovery
#ParsedReport
22-07-2022
OperationShadowTiger
https://mp.weixin.qq.com/s/jX8D8d-4q46pKHS0AIVgjw
Actors/Campaigns:
Shadowtiger
Tiger_hibiscus
Threats:
Dll_hijacking_technique
Putty_tool
Uacme
Geo:
Korean, Korea, Asia, Asian, Polish
CVEs:
CVE-2018-6055 [Vulners]
Vulners: Score: 6.8, CVSS: 4.9,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- google chrome (<64.0.3282.119)
TTPs:
Tactics: 2
Technics: 0
IOCs:
File: 19
Url: 3
Email: 2
IP: 5
Hash: 16
Softs:
chrome
Languages:
php
22-07-2022
OperationShadowTiger
https://mp.weixin.qq.com/s/jX8D8d-4q46pKHS0AIVgjw
Actors/Campaigns:
Shadowtiger
Tiger_hibiscus
Threats:
Dll_hijacking_technique
Putty_tool
Uacme
Geo:
Korean, Korea, Asia, Asian, Polish
CVEs:
CVE-2018-6055 [Vulners]
Vulners: Score: 6.8, CVSS: 4.9,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- google chrome (<64.0.3282.119)
TTPs:
Tactics: 2
Technics: 0
IOCs:
File: 19
Url: 3
Email: 2
IP: 5
Hash: 16
Softs:
chrome
Languages:
php
#ParsedReport
22-07-2022
Proxyware. Attackers who make money using ProxyWare
https://asec.ahnlab.com/ko/36762
Threats:
Dropper/win.proxyware.c5173477
Dropper/win.proxyware.c5173478
Dropper/win.proxyware.c5210584
IOCs:
File: 8
Path: 1
Hash: 7
Softs:
ms-sql
Algorithms:
base64
Functions:
startMainRoutine
Platforms:
x86
22-07-2022
Proxyware. Attackers who make money using ProxyWare
https://asec.ahnlab.com/ko/36762
Threats:
Dropper/win.proxyware.c5173477
Dropper/win.proxyware.c5173478
Dropper/win.proxyware.c5210584
IOCs:
File: 8
Path: 1
Hash: 7
Softs:
ms-sql
Algorithms:
base64
Functions:
startMainRoutine
Platforms:
x86
ASEC
Proxyware를 이용해 수익을 얻는 공격자들 - ASEC
Proxyware를 이용해 수익을 얻는 공격자들 ASEC
#ParsedReport
22-07-2022
RedLine Stealer. Confirm the campaign to infect Redline Stealer from the fake site
https://blog.lac.co.jp/2022/07/21/1430
Actors/Campaigns:
Fakeupdates
Threats:
Redline_stealer
Geo:
Japan, Japanese
IOCs:
File: 7
Hash: 1
Url: 1
IP: 1
Softs:
chrome, google chrome
Algorithms:
base64
Languages:
javascript
22-07-2022
RedLine Stealer. Confirm the campaign to infect Redline Stealer from the fake site
https://blog.lac.co.jp/2022/07/21/1430
Actors/Campaigns:
Fakeupdates
Threats:
Redline_stealer
Geo:
Japan, Japanese
IOCs:
File: 7
Hash: 1
Url: 1
IP: 1
Softs:
chrome, google chrome
Algorithms:
base64
Languages:
javascript
ラック脅威情報ブログ
偽サイトからRedLine Stealerに感染させるキャンペーンを確認 | ラック脅威情報ブログ
ブラウザのChromeを装った偽のアップデート要求画面から、情報窃取型マルウェアの一種であるRedLine Stealerに感染させようとする攻撃を日本国内で確認しています。偽のアップデートファイルをダウンロード・実行してしまった場合、マルウェアに感染する恐れがあります。概要2022年4月頃に、改ざんされたと思われるいくつかの日本のサイト(JPドメイン)から、RedLine Stealerを配布するサイトに誘導される事例を確認しました。Chromeを装った偽
#ParsedReport
22-07-2022
Alibaba OSS Buckets Compromised to Distribute Malicious Shell Scripts via Steganography
https://www.trendmicro.com/en_us/research/22/g/alibaba-oss-buckets-compromised-to-distribute-malicious-shell-sc.html
Actors/Campaigns:
Teamtnt
Threats:
Monero_miner
Xmrig_miner
Kinsing_miner
Geo:
Chinese
IOCs:
Domain: 1
Hash: 5
Softs:
unix, redis
Links:
22-07-2022
Alibaba OSS Buckets Compromised to Distribute Malicious Shell Scripts via Steganography
https://www.trendmicro.com/en_us/research/22/g/alibaba-oss-buckets-compromised-to-distribute-malicious-shell-sc.html
Actors/Campaigns:
Teamtnt
Threats:
Monero_miner
Xmrig_miner
Kinsing_miner
Geo:
Chinese
IOCs:
Domain: 1
Hash: 5
Softs:
unix, redis
Links:
https://github.com/xmrig/xmrigTrend Micro
Alibaba OSS Buckets Compromised to Distribute Malicious Shell Scripts via Steganography
#ParsedReport
22-07-2022
Daum. Fishing mail disguised as a domestic portal site Daum
https://asec.ahnlab.com/ko/36969
IOCs:
Url: 2
File: 1
Hash: 1
22-07-2022
Daum. Fishing mail disguised as a domestic portal site Daum
https://asec.ahnlab.com/ko/36969
IOCs:
Url: 2
File: 1
Hash: 1
ASEC BLOG
국내 포털 사이트 Daum으로 위장한 피싱 메일 - ASEC BLOG
ASEC 분석팀은 해당 블로그 작성 날짜 기준으로 전날인, 2022년 7월 21일에 국내 포털 사이트 중 하나인 Daum으로 위장한 피싱 메일이 유포되고 있는 정황을 포착하였다. 해당 피싱 메일은 제목에 RFQ를 포함하여 견적 요청서로 둔갑하였으며, 첨부 파일을 이용하여 피싱 페이지로 유도하도록 만들어졌다. 첨부 파일은 HTML 파일로 이루어져 있으며, 첨부 파일을 실행하면 자동으로 아래 주소로 리다이렉션된다. hxxps://euoi8708twufev…
#ParsedReport
22-07-2022
Qakbot Resurfaces with new Playbook
https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook
Threats:
Qakbot
Brata
Beacon
Process_injection_technique
Industry:
Financial
TTPs:
Tactics: 2
Technics: 4
IOCs:
File: 5
Hash: 5
Softs:
android
Algorithms:
base64
22-07-2022
Qakbot Resurfaces with new Playbook
https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook
Threats:
Qakbot
Brata
Beacon
Process_injection_technique
Industry:
Financial
TTPs:
Tactics: 2
Technics: 4
IOCs:
File: 5
Hash: 5
Softs:
android
Algorithms:
base64
Всем привет.
До 1 августа уходим вместе с движком публикации TI-отчетов в отпуск.
Все индикаторы из отчетов продолжат попадать в наш фид автоматически.
До 1 августа уходим вместе с движком публикации TI-отчетов в отпуск.
Все индикаторы из отчетов продолжат попадать в наш фид автоматически.
winapi_funcs.yml
564 KB
Постепенно выхожу из стазиса.
Напарсил с https://docs.microsoft.com/en-us/windows/win32/api/ список WIN API.
Методы интерфейсов тоже собрал, но пока решил не выкладывать из-за ненадобности )
Как же я долго не хотел прикручивать HyperScan от Intel к парсеру отчетов, но теперь придется.
Напарсил с https://docs.microsoft.com/en-us/windows/win32/api/ список WIN API.
Методы интерфейсов тоже собрал, но пока решил не выкладывать из-за ненадобности )
Как же я долго не хотел прикручивать HyperScan от Intel к парсеру отчетов, но теперь придется.
Кстати ,вот регулярка, которая тоже помогает выявить название WIN API функции в тексте
(^| )((Alpc|Cc|Cm|Dbg|Dbgk|Em|Etw|Ex|FsRtl|Hv|Hvl|Io|Kd|Ke|Kse|Lsa|Mm|Nt|Ob|Pf|Po|PoFx|Pp|Ppm|Ps|Rtl|Se|SH|Sm|Tm|Ttm|Vf|Vsl|Wdi|Wfp|Whea|Wmi|Zw)([A-Z][a-z]+){3,}[A-Z]?)([., ]|$)#ParsedReport
31-07-2022
ASEC (20220718 \~ 20220724). ASEC Weekly Malware Statistics (20220718 \~ 20220724)
https://asec.ahnlab.com/ko/37092
Threats:
Agent_tesla
Azorult
Redline_stealer
Formbook
Clipboard_grabbing_technique
Cloudeye
Remcos_rat
Nanocore_rat
Njrat_rat
Avemaria_rat
Industry:
Transport, Financial
Geo:
Korea
IOCs:
File: 43
Domain: 8
IP: 3
Email: 6
Url: 27
Softs:
nsisinstaller, discord
Languages:
visual_basic
31-07-2022
ASEC (20220718 \~ 20220724). ASEC Weekly Malware Statistics (20220718 \~ 20220724)
https://asec.ahnlab.com/ko/37092
Threats:
Agent_tesla
Azorult
Redline_stealer
Formbook
Clipboard_grabbing_technique
Cloudeye
Remcos_rat
Nanocore_rat
Njrat_rat
Avemaria_rat
Industry:
Transport, Financial
Geo:
Korea
IOCs:
File: 43
Domain: 8
IP: 3
Email: 6
Url: 27
Softs:
nsisinstaller, discord
Languages:
visual_basic
ASEC BLOG
ASEC 주간 악성코드 통계 (20220718 ~ 20220724) - ASEC BLOG
ASEC 분석팀에서는 ASEC 자동 분석 시스템 RAPIT 을 활용하여 알려진 악성코드들에 대한 분류 및 대응을 진행하고 있다. 본 포스팅에서는 2022년 7월 18일 월요일부터 7월 24일 일요일까지 한 주간 수집된 악성코드의 통계를 정리한다. 대분류 상으로는 인포스틸러가 44.7%로 1위를 차지하였으며, 그 다음으로는 백도어 악성코드가 40.3%, 다운로더 14.5%, 랜섬웨어 0.6%로 집계되었다. Top 1 – Agent Tesla 인포스틸러 악성코드인…
#ParsedReport
31-07-2022
CHM. Malicious CHM distribution to domestic universities
https://asec.ahnlab.com/ko/37123
Threats:
Revbshell
Powershell_shell_tool
Trojan/vbs.generic
Dll_hijacking_technique
Industry:
Education
IOCs:
File: 11
Hash: 3
Domain: 1
31-07-2022
CHM. Malicious CHM distribution to domestic universities
https://asec.ahnlab.com/ko/37123
Threats:
Revbshell
Powershell_shell_tool
Trojan/vbs.generic
Dll_hijacking_technique
Industry:
Education
IOCs:
File: 11
Hash: 3
Domain: 1
ASEC BLOG
국내 대학교 대상으로 악성 CHM 유포 중 - ASEC BLOG
ASEC 분석팀은 국내 특정 대학교를 대상으로 악성 CHM 파일이 다수 유포되고 있는 정황을 포착하였다. 유포 중인 악성 CHM 파일은 지난 5월에 소개했던 유형과 동일한 유형인 것으로 확인하였다. [그림 1] 은 악성 CHM 내부에 존재하는 HTM 파일의 코드이며, 파일명 “2022년도_기초과학연구역량강화사업_착수보고회_개최_계획 Ver1.1.chm” 으로 유포 중인 것으로 추정된다. 사용자가 악성 CHM 파일을 실행하게 되면, 해당 HTM 파일의 코드가…
#ParsedReport
31-07-2022
(Kimsuky). Word document (Kimsuky) provided as an external link when replying to the attacker mail
https://asec.ahnlab.com/ko/37175
Actors/Campaigns:
Kimsuky
Geo:
Korea
IOCs:
File: 7
Path: 1
Url: 2
Hash: 2
31-07-2022
(Kimsuky). Word document (Kimsuky) provided as an external link when replying to the attacker mail
https://asec.ahnlab.com/ko/37175
Actors/Campaigns:
Kimsuky
Geo:
Korea
IOCs:
File: 7
Path: 1
Url: 2
Hash: 2
ASEC BLOG
공격자 메일에 회신한 경우에 외부 링크로 제공되는 워드문서 (Kimsuky) - ASEC BLOG
ASEC 분석팀은 대북 관련 내용의 악성 워드 문서가 꾸준히 유포되고 있음을 확인하였다. 확인된 워드 문서는 안랩 TIP에 공개된 “2021년 Kimsuky 공격 워드(word) 문서 사례 총 정리 분석 보고서” 및 ‘외교/안보 관련 내용의 워드문서 유포 중‘ 에서 공유한 워드 문서 유형과 더불어 mshta를 이용하는 유형이 확인되었다. 악성 워드 문서는 다음과 같이 다양한 파일명으로 유포되고 있다. 김** 이력서(한미**협회,220711).doc 양**_**재단…
#ParsedReport
31-07-2022
(Gwisin). Ghost (GWISIN) ransomware
https://asec.ahnlab.com/ko/37233
Threats:
Gwisin
Magniber
IOCs:
File: 5
Path: 1
Softs:
bcdedit
31-07-2022
(Gwisin). Ghost (GWISIN) ransomware
https://asec.ahnlab.com/ko/37233
Threats:
Gwisin
Magniber
IOCs:
File: 5
Path: 1
Softs:
bcdedit
ASEC BLOG
국내 기업 대상의 귀신(Gwisin) 랜섬웨어 - ASEC BLOG
최근 국내 기업을 대상으로 한 귀신(Gwisin) 랜섬웨어 피해가 증가하고 있다. 이 랜섬웨어는 특정 기업을 타겟으로 제작되어 유포되고 있으며, 매그니베르(Magniber)와 동일하게 MSI 설치 파일 형태로 동작한다. 불특정 다수를 대상으로 유포되는 매그니베르와 달리 귀신 랜섬웨어는 파일 단독 실행 만으로는 행위가 발현되지 않고, 특별한 실행 인자 값이 필요하다. 이러한 인자 값은 MSI 내부에 포함된 DLL 파일의 구동에 필요한 키 정보로 활용된다.…
#ParsedReport
31-07-2022
Ransomware Groups Ramping Up Operations
https://blog.cyble.com/2022/07/28/ransomware-groups-ramping-up-operations
Actors/Campaigns:
Blackcat
Karakurt
Threats:
Solidbit
Lockbit
Yashma
Conti
Blackcat
Industry:
Financial, Government
Languages:
rust
31-07-2022
Ransomware Groups Ramping Up Operations
https://blog.cyble.com/2022/07/28/ransomware-groups-ramping-up-operations
Actors/Campaigns:
Blackcat
Karakurt
Threats:
Solidbit
Lockbit
Yashma
Conti
Blackcat
Industry:
Financial, Government
Languages:
rust
Cyble
Ransomware Groups Ramping Up Operations
Cyble Research Labs analyzes new extortion activities used as ransomware groups resort to even more unscrupulous techniques.
#ParsedReport
31-07-2022
Targeted Attacks being carried out via DLL SideLoading
https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading
Threats:
Cobalt_strike
Beacon
Qakbot
Mimikatz
Geo:
Italy
TTPs:
Tactics: 3
Technics: 5
IOCs:
File: 4
Url: 1
Hash: 2
Softs:
microsoft teams
Algorithms:
base64
Functions:
process, EnableContent, GetParagraph, AutoOpen
31-07-2022
Targeted Attacks being carried out via DLL SideLoading
https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading
Threats:
Cobalt_strike
Beacon
Qakbot
Mimikatz
Geo:
Italy
TTPs:
Tactics: 3
Technics: 5
IOCs:
File: 4
Url: 1
Hash: 2
Softs:
microsoft teams
Algorithms:
base64
Functions:
process, EnableContent, GetParagraph, AutoOpen
Cyble
Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading
Cyble Analyzes how Threat Actors are leveraging Microsoft applications and DLL Sideloading to deliver Cobalt Strike Beacons
#ParsedReport
31-07-2022
Underground Clipper Malware Targeting IBAN Transactions & Cryptocurrency
https://blog.cyble.com/2022/07/28/underground-clipper-malware-targeting-iban-transactions-cryptocurrency
Threats:
Iban_clipper
Stealerium_keylogger
Industry:
Financial
Geo:
Poland
Softs:
telegram
31-07-2022
Underground Clipper Malware Targeting IBAN Transactions & Cryptocurrency
https://blog.cyble.com/2022/07/28/underground-clipper-malware-targeting-iban-transactions-cryptocurrency
Threats:
Iban_clipper
Stealerium_keylogger
Industry:
Financial
Geo:
Poland
Softs:
telegram
Cyble
Underground Clipper Malware Targeting IBAN Transactions & Cryptocurrency
Cyble Analyzes Threat Actors selling Clipper Malware targeting IBAN transactions and cryptocurrency on cybercrime forums.
#ParsedReport
01-08-2022
Heres a Simple Script to Detect the Stealthy Nation-State BPFDoor
https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor
Threats:
Bpfdoor
Red_menshen
Mangzamel
Gh0st_rat
Metasploit_tool
Timestomp_technique
Industry:
Government, Telco, Education, Logistic
Geo:
Taiwan, Asia, India, Vietnam, Myanmar, Turkey, Chinese, Korea
TTPs:
Tactics: 1
Technics: 7
IOCs:
Hash: 18
Softs:
unix
Functions:
utimes
Languages:
python, perl, lua
YARA: Found
01-08-2022
Heres a Simple Script to Detect the Stealthy Nation-State BPFDoor
https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor
Threats:
Bpfdoor
Red_menshen
Mangzamel
Gh0st_rat
Metasploit_tool
Timestomp_technique
Industry:
Government, Telco, Education, Logistic
Geo:
Taiwan, Asia, India, Vietnam, Myanmar, Turkey, Chinese, Korea
TTPs:
Tactics: 1
Technics: 7
IOCs:
Hash: 18
Softs:
unix
Functions:
utimes
Languages:
python, perl, lua
YARA: Found
Qualys
Here’s a Simple Script to Detect the Stealthy Nation-State BPFDoor | Qualys
In this blog, the Qualys Research Team explains the mechanics of a Linux malware variant named BPFdoor. We then demonstrate the efficacy of Qualys Custom Assessment and Remediation to detect it…