#ParsedReport
14-08-2022
Typosquatting Campaign Targeting Pythons Top Packages, Dropping GitHub Hosted Malware with DGA Capabilities. Attack Vector Typosquatting
https://checkmarx.com/blog/typosquatting-campaign-targeting-pythons-top-packages-dropping-github-hosted-malware-with-dga-capabilities
Threats:
Typosquatting_technique
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 3
Path: 2
Url: 10
Hash: 3
Algorithms:
xor
Languages:
python
Links:
14-08-2022
Typosquatting Campaign Targeting Pythons Top Packages, Dropping GitHub Hosted Malware with DGA Capabilities. Attack Vector Typosquatting
https://checkmarx.com/blog/typosquatting-campaign-targeting-pythons-top-packages-dropping-github-hosted-malware-with-dga-capabilities
Threats:
Typosquatting_technique
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 3
Path: 2
Url: 10
Hash: 3
Algorithms:
xor
Languages:
python
Links:
https://github.com/jagermager999/8746465cdg78cdsxasy8a/commits/mainhttps://github.com/jagermager999https://github.com/jagermager999/8746465cdg78cdsxasy8aCheckmarx.com
Typosquatting Campaign Targeting Python's Top Packages, Dropping GitHub Hosted Malware with DGA Capabilities
Right after Checkmarx’s automatic engines detected the malicious packages we started an analysis process involving our security researchers analyzing this campaign and reverse engineering the dropped embedded malware to understand the full picture.
#ParsedReport
15-08-2022
Shuckworm: Russia-Linked Group Maintains Ukraine Focus
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/russia-ukraine-shuckworm
Actors/Campaigns:
Gamaredon (motivation: cyber_espionage)
Threats:
Giddome
Ammyy_admin_tool
Anydesk_tool
Decay
Geo:
Russian, Ukrainian, Ukraine, Russia
IOCs:
File: 14
Domain: 5
Hash: 43
Url: 10
Path: 1
Functions:
PowerShell, InternetExplorer
Languages:
php
15-08-2022
Shuckworm: Russia-Linked Group Maintains Ukraine Focus
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/russia-ukraine-shuckworm
Actors/Campaigns:
Gamaredon (motivation: cyber_espionage)
Threats:
Giddome
Ammyy_admin_tool
Anydesk_tool
Decay
Geo:
Russian, Ukrainian, Ukraine, Russia
IOCs:
File: 14
Domain: 5
Hash: 43
Url: 10
Path: 1
Functions:
PowerShell, InternetExplorer
Languages:
php
Security
Shuckworm: Russia-Linked Group Maintains Ukraine Focus
Infostealer appears to be payload in recent activity aimed at Ukrainian organizations.
#ParsedReport
15-08-2022
Patchwork APT. Analysis of the characteristics of new activities in Patchwork APT in South Asia
https://mp.weixin.qq.com/s/egG0nORZFvo_rCY_zmTgVQ
Actors/Campaigns:
Dropping_elephant
Threats:
Patchinfecter
Grat2_tool
Industry:
Government, Healthcare
Geo:
China, Asia, Asian, Pakistan
CVEs:
CVE-2021-40444 [Vulners]
Vulners: Score: 6.8, CVSS: 2.2,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -)
- microsoft windows 10 (1607, -, 1809, 1909, 2004, 20h2, 21h1)
- microsoft windows server 2016 (-, 2004, 20h2)
- microsoft windows rt 8.1 (-)
- microsoft windows server 2012 (-, -)
have more...
IOCs:
File: 11
Path: 1
IP: 1
Url: 1
Hash: 4
Softs:
microsoft office
Algorithms:
zip , xor, base64
15-08-2022
Patchwork APT. Analysis of the characteristics of new activities in Patchwork APT in South Asia
https://mp.weixin.qq.com/s/egG0nORZFvo_rCY_zmTgVQ
Actors/Campaigns:
Dropping_elephant
Threats:
Patchinfecter
Grat2_tool
Industry:
Government, Healthcare
Geo:
China, Asia, Asian, Pakistan
CVEs:
CVE-2021-40444 [Vulners]
Vulners: Score: 6.8, CVSS: 2.2,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -)
- microsoft windows 10 (1607, -, 1809, 1909, 2004, 20h2, 21h1)
- microsoft windows server 2016 (-, 2004, 20h2)
- microsoft windows rt 8.1 (-)
- microsoft windows server 2012 (-, -)
have more...
IOCs:
File: 11
Path: 1
IP: 1
Url: 1
Hash: 4
Softs:
microsoft office
Algorithms:
zip , xor, base64
Weixin Official Accounts Platform
南亚Patchwork APT组织新活动特点分析
PatchWork APT在近期攻击活动中应用了跟以往不同的攻击工具。
#ParsedReport
15-08-2022
Ransomware Gangs Adopt Callback Phishing Techniques for Gaining Initial Network Access
https://www.hipaajournal.com/ransomware-gangs-adopt-callback-phishing-techniques-for-gaining-initial-network-access
Actors/Campaigns:
Luna_moth
Threats:
Bazarbackdoor
Ryuk
Conti
Quantum_tool
Zeon
Industry:
Healthcare, Financial
Languages:
javascript
15-08-2022
Ransomware Gangs Adopt Callback Phishing Techniques for Gaining Initial Network Access
https://www.hipaajournal.com/ransomware-gangs-adopt-callback-phishing-techniques-for-gaining-initial-network-access
Actors/Campaigns:
Luna_moth
Threats:
Bazarbackdoor
Ryuk
Conti
Quantum_tool
Zeon
Industry:
Healthcare, Financial
Languages:
javascript
HIPAA Journal
Ransomware Gangs Adopt Callback Phishing Techniques for Gaining Initial Network Access
Multiple ransomware groups have adopted the BazarCall callback phishing technique to gain initial access to victims’ networks, including threat actors More ransomware gangs have adopted the BazarCall callback phishing technique to gain initial access to victims’…
#ParsedReport
15-08-2022
Disrupting SEABORGIUMs ongoing phishing operations
https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations
Actors/Campaigns:
Coldriver
Gamaredon
Threats:
Seaborgium
Evilginx_tool
Credential_harvesting_technique
Aitm_technique
Industry:
Education, Financial, Government, Ngo
Geo:
Ukraine, Russia, Russian
IOCs:
Domain: 69
Softs:
microsoft 365 defender, microsoft defender
Links:
15-08-2022
Disrupting SEABORGIUMs ongoing phishing operations
https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations
Actors/Campaigns:
Coldriver
Gamaredon
Threats:
Seaborgium
Evilginx_tool
Credential_harvesting_technique
Aitm_technique
Industry:
Education, Financial, Government, Ngo
Geo:
Ukraine, Russia, Russian
IOCs:
Domain: 69
Softs:
microsoft 365 defender, microsoft defender
Links:
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/SEABORGIUMDomainsAugust2022.yamlhttps://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/Microsoft%20365%20Defender/Campaigns/SEABORGIUMDomainIOCsAug2022.yamlMicrosoft News
Disrupting SEABORGIUM’s ongoing phishing operations
The Microsoft Threat Intelligence Center (MSTIC) has observed and taken actions to disrupt campaigns launched by SEABORGIUM in campaigns involve persistent phishing and credential theft campaigns leading to intrusions and data theft.
#ParsedReport
16-08-2022
Threat in your browser: what dangers innocent-looking extensions hold for users
https://securelist.com/threat-in-your-browser-extensions/107181
Threats:
Websearch
Dealply
Nullmixer
Fbstealer
Industry:
Government, E-commerce, Healthcare, Financial, Petroleum
IOCs:
Domain: 1
Coin: 3
Path: 1
Url: 1
Hash: 6
Softs:
chrome, windows registry, chromium, google chrome
Languages:
javascript
16-08-2022
Threat in your browser: what dangers innocent-looking extensions hold for users
https://securelist.com/threat-in-your-browser-extensions/107181
Threats:
Websearch
Dealply
Nullmixer
Fbstealer
Industry:
Government, E-commerce, Healthcare, Financial, Petroleum
IOCs:
Domain: 1
Coin: 3
Path: 1
Url: 1
Hash: 6
Softs:
chrome, windows registry, chromium, google chrome
Languages:
javascript
Securelist
Threat in your browser: what dangers innocent-looking extensions hold for users
In this research, we observed various types of threats that mimic useful web browser extensions, and the number of users attacked by them.
#ParsedReport
16-08-2022
Banking Trojan SOVA Has New Version with Updated Features
https://socradar.io/banking-trojan-sova-has-new-version-with-updated-features
Threats:
Sova
Industry:
Financial
Geo:
China, Taiwan
TTPs:
Tactics: 1
Technics: 2
IOCs:
File: 1
Hash: 6
Domain: 2
Url: 3
Softs:
android, chrome
16-08-2022
Banking Trojan SOVA Has New Version with Updated Features
https://socradar.io/banking-trojan-sova-has-new-version-with-updated-features
Threats:
Sova
Industry:
Financial
Geo:
China, Taiwan
TTPs:
Tactics: 1
Technics: 2
IOCs:
File: 1
Hash: 6
Domain: 2
Url: 3
Softs:
android, chrome
SOCRadar® Cyber Intelligence Inc.
Banking Trojan SOVA Has New Version with Updated Features - SOCRadar® Cyber Intelligence Inc.
#ParsedReport
16-08-2022
Two more malicious Python packages in the PyPI
https://securelist.com/two-more-malicious-python-packages-in-the-pypi/107218
Threats:
Junk_code_technique
Industry:
Financial
Geo:
French
IOCs:
File: 7
Url: 3
Path: 2
Registry: 1
Hash: 5
Softs:
discord
Languages:
python, javascript
Links:
16-08-2022
Two more malicious Python packages in the PyPI
https://securelist.com/two-more-malicious-python-packages-in-the-pypi/107218
Threats:
Junk_code_technique
Industry:
Financial
Geo:
French
IOCs:
File: 7
Url: 3
Path: 2
Registry: 1
Hash: 5
Softs:
discord
Languages:
python, javascript
Links:
https://github.com/billythegoat356/HyperionSecurelist
Two more malicious Python packages in the PyPI
We used our internal automated system for monitoring open-source repositories and discovered two other malicious Python packages in the PyPI.
#ParsedReport
16-08-2022
BlackGuard Infostealer Malware: Dissecting the State of Exfiltrated Data
https://www.f5.com/labs/articles/threat-intelligence/blackguard-infostealer-malware-dissecting-the-state-of-exfiltrated-data
Threats:
Blackguard_stealer
Dll_injection_technique
Malibot
Qakbot
Industry:
E-commerce, Education, Iot, Government, Financial
Geo:
Russian, African, Switzerland, Sweden
IOCs:
File: 5
Softs:
android, mozilla firefox, google chrome, dashcore, bitcoincore, telegram, electrum, microsoft edge, chrome, litecoincore, discord
Algorithms:
zip
Languages:
javascript
Platforms:
intel
16-08-2022
BlackGuard Infostealer Malware: Dissecting the State of Exfiltrated Data
https://www.f5.com/labs/articles/threat-intelligence/blackguard-infostealer-malware-dissecting-the-state-of-exfiltrated-data
Threats:
Blackguard_stealer
Dll_injection_technique
Malibot
Qakbot
Industry:
E-commerce, Education, Iot, Government, Financial
Geo:
Russian, African, Switzerland, Sweden
IOCs:
File: 5
Softs:
android, mozilla firefox, google chrome, dashcore, bitcoincore, telegram, electrum, microsoft edge, chrome, litecoincore, discord
Algorithms:
zip
Languages:
javascript
Platforms:
intel
F5 Labs
BlackGuard Infostealer Malware: Dissecting the State of Exfiltrated Data | F5 Labs
Your data is at risk. Are you equipped to combat the risks posed by BlackGuard?
#ParsedReport
16-08-2022
Phishing Site used to Spread Typhon Stealer
https://blog.cyble.com/2022/08/16/phishing-site-used-to-spread-typhon-stealer
Threats:
Typhon_stealer
Xmrig_miner
Backbend
Netstat_tool
Beacon
Industry:
Financial, Entertainment
Geo:
Dubai, Singapore, Australia, Sweden, India, Georgia
TTPs:
Tactics: 8
Technics: 17
IOCs:
File: 13
Coin: 1
Url: 2
Hash: 5
Registry: 3
Path: 1
Softs:
winscp, discord, microsoft edge, telegram
Algorithms:
base64
Functions:
CheckRemoteDebuggerPresent, GetModuleHandle
Languages:
java, php
16-08-2022
Phishing Site used to Spread Typhon Stealer
https://blog.cyble.com/2022/08/16/phishing-site-used-to-spread-typhon-stealer
Threats:
Typhon_stealer
Xmrig_miner
Backbend
Netstat_tool
Beacon
Industry:
Financial, Entertainment
Geo:
Dubai, Singapore, Australia, Sweden, India, Georgia
TTPs:
Tactics: 8
Technics: 17
IOCs:
File: 13
Coin: 1
Url: 2
Hash: 5
Registry: 3
Path: 1
Softs:
winscp, discord, microsoft edge, telegram
Algorithms:
base64
Functions:
CheckRemoteDebuggerPresent, GetModuleHandle
Languages:
java, php
Cyble
Phishing Site used to Spread Typhon Stealer
Cyble analyzes Typhon, an information stealer being spread via a phishing site.
#ParsedReport
16-08-2022
Detecting a Rogue Domain Controller DCShadow Attack
https://www.sentinelone.com/blog/detecting-a-rogue-domain-controller-dcshadow-attack
Threats:
Dcshadow_technique
Dcsync_technique
Lsadump_tool
Mimikatz
Golden_ticket_technique
Trickbot
Softs:
active directory
Functions:
GetNCChanges
Links:
16-08-2022
Detecting a Rogue Domain Controller DCShadow Attack
https://www.sentinelone.com/blog/detecting-a-rogue-domain-controller-dcshadow-attack
Threats:
Dcshadow_technique
Dcsync_technique
Lsadump_tool
Mimikatz
Golden_ticket_technique
Trickbot
Softs:
active directory
Functions:
GetNCChanges
Links:
https://github.com/gentilkiwi/mimikatz/wiki/module-\~-lsadumpSentinelOne
DCShadow Attacks: Detecting a Rogue Domain Controller
Learn what DCShadow attacks are, how they work, methods for detecting them, and effective mitigation strategies to protect your Active Directory environment.
#ParsedReport
16-08-2022
BitRAT, XMRig. Bitrat, XMRIG Coin Minor, distributed using the Windows Genuine Certification tool
https://asec.ahnlab.com/ko/37602
Threats:
Sbit_rat
Xmrig_miner
Trojan/win.generic.c5223158
Malware/mdp.download.m1197
Malware/mdp.drivebydownload.m1298
IOCs:
File: 14
Domain: 1
Hash: 4
Url: 3
IP: 1
Softs:
telegram, google chrome
16-08-2022
BitRAT, XMRig. Bitrat, XMRIG Coin Minor, distributed using the Windows Genuine Certification tool
https://asec.ahnlab.com/ko/37602
Threats:
Sbit_rat
Xmrig_miner
Trojan/win.generic.c5223158
Malware/mdp.download.m1197
Malware/mdp.drivebydownload.m1298
IOCs:
File: 14
Domain: 1
Hash: 4
Url: 3
IP: 1
Softs:
telegram, google chrome
ASEC BLOG
윈도우 정품 인증 툴을 이용해 유포 중인 BitRAT, XMRig 코인 마이너 - ASEC BLOG
ASEC 분석팀에서는 최근 윈도우 정품 인증 툴을 위장하여 BitRAT과 XMRig 코인 마이너가 유포 중인 것을 확인하였다. BitRAT은 아래의 블로그들에서 다룬 바와 같이 이전에도 웹하드를 통해 MS 윈도우 정품 인증 툴과 MS 오피스 설치 프로그램으로 위장하여 유포된 이력이 있으며, 현재 블로그에서 다루는 사례도 동일한 공격자로 추정된다. 특이한 점으로는 V3 설치되지 않은 환경에서는 BitRAT 원격제어툴이 설치되며, V3 설치 환경에서는 (BitRAT…
#ParsedReport
16-08-2022
Vast Malvertising Network Hijacks Browser Settings to Spread Riskware
https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/vast-malvertising-network-hijacks-browser-settings-to-spread-riskware
Threats:
Log4shell_vuln
Sbit_rat
Xmrig_miner
Geo:
Cyprus, Panama
TTPs:
Tactics: 3
Technics: 0
IOCs:
Domain: 32
IP: 14
Functions:
VexTrio
Languages:
javascript, php
Links:
16-08-2022
Vast Malvertising Network Hijacks Browser Settings to Spread Riskware
https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/vast-malvertising-network-hijacks-browser-settings-to-spread-riskware
Threats:
Log4shell_vuln
Sbit_rat
Xmrig_miner
Geo:
Cyprus, Panama
TTPs:
Tactics: 3
Technics: 0
IOCs:
Domain: 32
IP: 14
Functions:
VexTrio
Languages:
javascript, php
Links:
https://github.com/infobloxopen/threat-intelligence/tree/main/cta\_indicators
https://github.com/infobloxopen/threat-intelligence
https://github.com/LorenzoSapora/bad-asn-list
https://github.com/brianhama/bad-asn-listInfoblox Blog
Omnatuor Malvertising Exploits Wordpress to Spread Riskware, Spyware & Adware | Infoblox
The Omnatuor malvertising network uses a clever technique to persistently serve ads to users even if they navigate away from a page. Learn more in this article.
#ParsedReport
16-08-2022
ASEC (20220808 \~ 20220814). ASEC Weekly Malware Statistics (20220808 \~ 20220814)
https://asec.ahnlab.com/ko/37637
Threats:
Agent_tesla
Azorult
Remcos_rat
Formbook
Nanocore_rat
Smokeloader
Clipboard_grabbing_technique
Redline_stealer
Beamwinhttp_loader
Postealer
Industry:
Transport
Geo:
Korea
IOCs:
File: 33
Domain: 7
IP: 3
Email: 6
Url: 27
Softs:
discord
16-08-2022
ASEC (20220808 \~ 20220814). ASEC Weekly Malware Statistics (20220808 \~ 20220814)
https://asec.ahnlab.com/ko/37637
Threats:
Agent_tesla
Azorult
Remcos_rat
Formbook
Nanocore_rat
Smokeloader
Clipboard_grabbing_technique
Redline_stealer
Beamwinhttp_loader
Postealer
Industry:
Transport
Geo:
Korea
IOCs:
File: 33
Domain: 7
IP: 3
Email: 6
Url: 27
Softs:
discord
ASEC BLOG
ASEC 주간 악성코드 통계 (20220808 ~ 20220814) - ASEC BLOG
ASEC 분석팀에서는 ASEC 자동 분석 시스템 RAPIT 을 활용하여 알려진 악성코드들에 대한 분류 및 대응을 진행하고 있다. 본 포스팅에서는 2022년 8월 8일 월요일부터 8월 14일 일요일까지 한 주간 수집된 악성코드의 통계를 정리한다. 대분류 상으로는 인포스틸러가 41.9%로 1위를 차지하였으며, 그 다음으로는 백도어 악성코드가 38.4%, 다운로더 16.8%, 랜섬웨어 2.2%, 코인마이너 악성코드가 0.6%로 집계되었다. Top 1 – Agent…
#ParsedReport
16-08-2022
. Move forward, prevent problems before -the 5G era of network security risk trends and industrial response to thinking
https://www.antiy.cn/research/notice&report/research_report/20220815.html
Threats:
Neuron
Pacemaker
Industry:
Healthcare, Energy, Financial, Iot, Transport
Geo:
China, Chinese, Vietnamese
IOCs:
File: 4
Softs:
android
16-08-2022
. Move forward, prevent problems before -the 5G era of network security risk trends and industrial response to thinking
https://www.antiy.cn/research/notice&report/research_report/20220815.html
Threats:
Neuron
Pacemaker
Industry:
Healthcare, Energy, Financial, Iot, Transport
Geo:
China, Chinese, Vietnamese
IOCs:
File: 4
Softs:
android
www.antiy.cn
关口前移，防患于未然——5G时代的网络安全风险趋势与产业应对思考
安天是引领威胁检测与防御能力发展的网络安全国家队，为客户构建端点防护、流量监测、边界防护、导流捕获、深度分析、应急处置的安全基石
#ParsedReport
17-08-2022
CISA and FBI issue alert about Zeppelin ransomware
https://www.malwarebytes.com/blog/news/2022/08/cisa-and-fbi-issue-alert-about-zeppelin-ransomware
Threats:
Zeppelin
Vega_locker
Industry:
Healthcare
Languages:
delphi
YARA: Found
17-08-2022
CISA and FBI issue alert about Zeppelin ransomware
https://www.malwarebytes.com/blog/news/2022/08/cisa-and-fbi-issue-alert-about-zeppelin-ransomware
Threats:
Zeppelin
Vega_locker
Industry:
Healthcare
Languages:
delphi
YARA: Found
ThreatDown by Malwarebytes
CISA and FBI issue alert about Zeppelin ransomware - ThreatDown by Malwarebytes
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have released a joint Cybersecurity Advisory (CSA) about Zeppelin ransomware.
#ParsedReport
17-08-2022
ASEC Weekly Malware Statistics (August 1st, 2022 August 7th, 2022)
https://asec.ahnlab.com/en/37593
Threats:
Agent_tesla
Formbook
Clipboard_grabbing_technique
Cloudeye
Remcos_rat
Nanocore_rat
Redline_stealer
Beamwinhttp_loader
Vidar_stealer
Industry:
Financial, Transport
Geo:
Korea
IOCs:
Domain: 3
IP: 3
Email: 5
File: 20
Url: 25
Softs:
nsis installer, discord
Languages:
visual_basic
17-08-2022
ASEC Weekly Malware Statistics (August 1st, 2022 August 7th, 2022)
https://asec.ahnlab.com/en/37593
Threats:
Agent_tesla
Formbook
Clipboard_grabbing_technique
Cloudeye
Remcos_rat
Nanocore_rat
Redline_stealer
Beamwinhttp_loader
Vidar_stealer
Industry:
Financial, Transport
Geo:
Korea
IOCs:
Domain: 3
IP: 3
Email: 5
File: 20
Url: 25
Softs:
nsis installer, discord
Languages:
visual_basic
ASEC BLOG
ASEC Weekly Malware Statistics (August 1st, 2022 – August 7th, 2022) - ASEC BLOG
The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from August 1st, 2022 (Monday) to August 7th, 2022 (Sunday). For the main category, info-stealer…
#ParsedReport
17-08-2022
Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors
https://www.mandiant.com/resources/suspected-iranian-actor-targeting-israeli-shipping
Actors/Campaigns:
Unc3890 (motivation: cyber_espionage)
Fox_kitten
Cleaver
Threats:
Watering_hole_technique
Sugarush
Sugardump
Metasploit_tool
Northstar_tool
Credential_harvesting_technique
Industry:
Energy, Healthcare, Government, Maritime, Transport, Aerospace
Geo:
Israel, Iran, Israeli, Iranian
IOCs:
Domain: 9
Url: 1
Hash: 1
Softs:
instagram
Algorithms:
zip
17-08-2022
Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors
https://www.mandiant.com/resources/suspected-iranian-actor-targeting-israeli-shipping
Actors/Campaigns:
Unc3890 (motivation: cyber_espionage)
Fox_kitten
Cleaver
Threats:
Watering_hole_technique
Sugarush
Sugardump
Metasploit_tool
Northstar_tool
Credential_harvesting_technique
Industry:
Energy, Healthcare, Government, Maritime, Transport, Aerospace
Geo:
Israel, Iran, Israeli, Iranian
IOCs:
Domain: 9
Url: 1
Hash: 1
Softs:
Algorithms:
zip
Google Cloud Blog
UNC3890: Suspected Iranian Threat Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors | Google Cloud Blog
#ParsedReport
17-08-2022
Malicious PyPi User Strikes Again with Typosquatting, StarJacking and Unpacks Tailor-made Malware written in C#. Intro
https://checkmarx.com/blog/malicious-pypi-user-strikes-again-with-typosquatting-starjacking-and-unpacks-tailor-made-malware-written-in-c
Threats:
Typosquatting_technique
Starjacking_technique
Joao
Cobalt_strike
Beacon
Intellilock_tool
Geo:
Kazakhstan
IOCs:
Path: 1
Url: 2
IP: 1
Hash: 4
Algorithms:
base64, exhibit
Languages:
python
17-08-2022
Malicious PyPi User Strikes Again with Typosquatting, StarJacking and Unpacks Tailor-made Malware written in C#. Intro
https://checkmarx.com/blog/malicious-pypi-user-strikes-again-with-typosquatting-starjacking-and-unpacks-tailor-made-malware-written-in-c
Threats:
Typosquatting_technique
Starjacking_technique
Joao
Cobalt_strike
Beacon
Intellilock_tool
Geo:
Kazakhstan
IOCs:
Path: 1
Url: 2
IP: 1
Hash: 4
Algorithms:
base64, exhibit
Languages:
python
Checkmarx
Malicious PyPi User Strikes Again with Typosquatting, StarJacking and Unpacks Tailor-made Malware written in C#
On Saturday, August 13th, Checkmarx's Software Supply Chain Security Typosquatting and StarJacking engines detected what seemed like an attack on the Python ecosystem. Further investigation revealed multiple evasion and obfuscation techniques, C2 communication…
#ParsedReport
17-08-2022
MasterFred Using Gymdrop to Distribute Xenomorph Android Banking Trojan
https://blog.cyble.com/2022/08/17/masterfred-using-gymdrop-to-distribute-xenomorph-android-banking-trojan
Actors/Campaigns:
Hadoken_security
Threats:
Masterfred
Gymdrop
Xenomorph
Hostile
Opendir
Hydra
Alien
Octo
Typhon_stealer
Industry:
Financial
Geo:
India, Dubai, Georgia, Poland, Australia, Singapore, Turkey
TTPs:
Tactics: 5
Technics: 9
IOCs:
Url: 7
File: 3
Hash: 2
Softs:
android
17-08-2022
MasterFred Using Gymdrop to Distribute Xenomorph Android Banking Trojan
https://blog.cyble.com/2022/08/17/masterfred-using-gymdrop-to-distribute-xenomorph-android-banking-trojan
Actors/Campaigns:
Hadoken_security
Threats:
Masterfred
Gymdrop
Xenomorph
Hostile
Opendir
Hydra
Alien
Octo
Typhon_stealer
Industry:
Financial
Geo:
India, Dubai, Georgia, Poland, Australia, Singapore, Turkey
TTPs:
Tactics: 5
Technics: 9
IOCs:
Url: 7
File: 3
Hash: 2
Softs:
android
Cyble
MasterFred Using Gymdrop to Distribute Xenomorph Android Banking Trojan
Cyble analyzes the new variant of MasterFred, which acts as the Hostile Downloader and distributes Xenomorph Banking Trojan.
#ParsedReport
17-08-2022
DarkTortilla Malware Analysis
https://www.secureworks.com/research/darktortilla-malware-analysis
Threats:
Darktortilla
Agent_tesla
Asyncrat_rat
Nanocore_rat
Redline_stealer
Cobalt_strike
Metasploit_tool
Process_injection_technique
Confuserex_tool
Junk_code_technique
Industry:
Logistic
Geo:
German, Italian, Romanian, Spanish
TTPs:
Tactics: 2
Technics: 0
IOCs:
File: 35
Hash: 56
Softs:
virtualbox, .net framework, windows shell, winlogon, windows registry, discord, hyper-v
Algorithms:
aes
Links:
17-08-2022
DarkTortilla Malware Analysis
https://www.secureworks.com/research/darktortilla-malware-analysis
Threats:
Darktortilla
Agent_tesla
Asyncrat_rat
Nanocore_rat
Redline_stealer
Cobalt_strike
Metasploit_tool
Process_injection_technique
Confuserex_tool
Junk_code_technique
Industry:
Logistic
Geo:
German, Italian, Romanian, Spanish
TTPs:
Tactics: 2
Technics: 0
IOCs:
File: 35
Hash: 56
Softs:
virtualbox, .net framework, windows shell, winlogon, windows registry, discord, hyper-v
Algorithms:
aes
Links:
https://github.com/malwares/Crypter/tree/master/%5BC%23%5D%20The%20RATs%20Crew%20Crypterhttps://github.com/malwares/Crypter/blob/master/%5BC%23%5D%20The%20RATs%20Crew%20Crypter/Form1.cs#L161-L163https://github.com/dnSpyEx/dnSpySophos
DarkTortilla Malware Analysis
Learn how Secureworks CTU researchers have identified DarkTortilla samples delivering targeted malicious payloads, benign decoy documents, and executables.