#ParsedReport
15-08-2022
Disrupting SEABORGIUMs ongoing phishing operations
https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations
Actors/Campaigns:
Coldriver
Gamaredon
Threats:
Seaborgium
Evilginx_tool
Credential_harvesting_technique
Aitm_technique
Industry:
Education, Financial, Government, Ngo
Geo:
Ukraine, Russia, Russian
IOCs:
Domain: 69
Softs:
microsoft 365 defender, microsoft defender
Links:
15-08-2022
Disrupting SEABORGIUMs ongoing phishing operations
https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations
Actors/Campaigns:
Coldriver
Gamaredon
Threats:
Seaborgium
Evilginx_tool
Credential_harvesting_technique
Aitm_technique
Industry:
Education, Financial, Government, Ngo
Geo:
Ukraine, Russia, Russian
IOCs:
Domain: 69
Softs:
microsoft 365 defender, microsoft defender
Links:
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/SEABORGIUMDomainsAugust2022.yamlhttps://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/Microsoft%20365%20Defender/Campaigns/SEABORGIUMDomainIOCsAug2022.yamlMicrosoft News
Disrupting SEABORGIUM’s ongoing phishing operations
The Microsoft Threat Intelligence Center (MSTIC) has observed and taken actions to disrupt campaigns launched by SEABORGIUM in campaigns involve persistent phishing and credential theft campaigns leading to intrusions and data theft.
#ParsedReport
16-08-2022
Threat in your browser: what dangers innocent-looking extensions hold for users
https://securelist.com/threat-in-your-browser-extensions/107181
Threats:
Websearch
Dealply
Nullmixer
Fbstealer
Industry:
Government, E-commerce, Healthcare, Financial, Petroleum
IOCs:
Domain: 1
Coin: 3
Path: 1
Url: 1
Hash: 6
Softs:
chrome, windows registry, chromium, google chrome
Languages:
javascript
16-08-2022
Threat in your browser: what dangers innocent-looking extensions hold for users
https://securelist.com/threat-in-your-browser-extensions/107181
Threats:
Websearch
Dealply
Nullmixer
Fbstealer
Industry:
Government, E-commerce, Healthcare, Financial, Petroleum
IOCs:
Domain: 1
Coin: 3
Path: 1
Url: 1
Hash: 6
Softs:
chrome, windows registry, chromium, google chrome
Languages:
javascript
Securelist
Threat in your browser: what dangers innocent-looking extensions hold for users
In this research, we observed various types of threats that mimic useful web browser extensions, and the number of users attacked by them.
#ParsedReport
16-08-2022
Banking Trojan SOVA Has New Version with Updated Features
https://socradar.io/banking-trojan-sova-has-new-version-with-updated-features
Threats:
Sova
Industry:
Financial
Geo:
China, Taiwan
TTPs:
Tactics: 1
Technics: 2
IOCs:
File: 1
Hash: 6
Domain: 2
Url: 3
Softs:
android, chrome
16-08-2022
Banking Trojan SOVA Has New Version with Updated Features
https://socradar.io/banking-trojan-sova-has-new-version-with-updated-features
Threats:
Sova
Industry:
Financial
Geo:
China, Taiwan
TTPs:
Tactics: 1
Technics: 2
IOCs:
File: 1
Hash: 6
Domain: 2
Url: 3
Softs:
android, chrome
SOCRadar® Cyber Intelligence Inc.
Banking Trojan SOVA Has New Version with Updated Features - SOCRadar® Cyber Intelligence Inc.
#ParsedReport
16-08-2022
Two more malicious Python packages in the PyPI
https://securelist.com/two-more-malicious-python-packages-in-the-pypi/107218
Threats:
Junk_code_technique
Industry:
Financial
Geo:
French
IOCs:
File: 7
Url: 3
Path: 2
Registry: 1
Hash: 5
Softs:
discord
Languages:
python, javascript
Links:
16-08-2022
Two more malicious Python packages in the PyPI
https://securelist.com/two-more-malicious-python-packages-in-the-pypi/107218
Threats:
Junk_code_technique
Industry:
Financial
Geo:
French
IOCs:
File: 7
Url: 3
Path: 2
Registry: 1
Hash: 5
Softs:
discord
Languages:
python, javascript
Links:
https://github.com/billythegoat356/HyperionSecurelist
Two more malicious Python packages in the PyPI
We used our internal automated system for monitoring open-source repositories and discovered two other malicious Python packages in the PyPI.
#ParsedReport
16-08-2022
BlackGuard Infostealer Malware: Dissecting the State of Exfiltrated Data
https://www.f5.com/labs/articles/threat-intelligence/blackguard-infostealer-malware-dissecting-the-state-of-exfiltrated-data
Threats:
Blackguard_stealer
Dll_injection_technique
Malibot
Qakbot
Industry:
E-commerce, Education, Iot, Government, Financial
Geo:
Russian, African, Switzerland, Sweden
IOCs:
File: 5
Softs:
android, mozilla firefox, google chrome, dashcore, bitcoincore, telegram, electrum, microsoft edge, chrome, litecoincore, discord
Algorithms:
zip
Languages:
javascript
Platforms:
intel
16-08-2022
BlackGuard Infostealer Malware: Dissecting the State of Exfiltrated Data
https://www.f5.com/labs/articles/threat-intelligence/blackguard-infostealer-malware-dissecting-the-state-of-exfiltrated-data
Threats:
Blackguard_stealer
Dll_injection_technique
Malibot
Qakbot
Industry:
E-commerce, Education, Iot, Government, Financial
Geo:
Russian, African, Switzerland, Sweden
IOCs:
File: 5
Softs:
android, mozilla firefox, google chrome, dashcore, bitcoincore, telegram, electrum, microsoft edge, chrome, litecoincore, discord
Algorithms:
zip
Languages:
javascript
Platforms:
intel
F5 Labs
BlackGuard Infostealer Malware: Dissecting the State of Exfiltrated Data | F5 Labs
Your data is at risk. Are you equipped to combat the risks posed by BlackGuard?
#ParsedReport
16-08-2022
Phishing Site used to Spread Typhon Stealer
https://blog.cyble.com/2022/08/16/phishing-site-used-to-spread-typhon-stealer
Threats:
Typhon_stealer
Xmrig_miner
Backbend
Netstat_tool
Beacon
Industry:
Financial, Entertainment
Geo:
Dubai, Singapore, Australia, Sweden, India, Georgia
TTPs:
Tactics: 8
Technics: 17
IOCs:
File: 13
Coin: 1
Url: 2
Hash: 5
Registry: 3
Path: 1
Softs:
winscp, discord, microsoft edge, telegram
Algorithms:
base64
Functions:
CheckRemoteDebuggerPresent, GetModuleHandle
Languages:
java, php
16-08-2022
Phishing Site used to Spread Typhon Stealer
https://blog.cyble.com/2022/08/16/phishing-site-used-to-spread-typhon-stealer
Threats:
Typhon_stealer
Xmrig_miner
Backbend
Netstat_tool
Beacon
Industry:
Financial, Entertainment
Geo:
Dubai, Singapore, Australia, Sweden, India, Georgia
TTPs:
Tactics: 8
Technics: 17
IOCs:
File: 13
Coin: 1
Url: 2
Hash: 5
Registry: 3
Path: 1
Softs:
winscp, discord, microsoft edge, telegram
Algorithms:
base64
Functions:
CheckRemoteDebuggerPresent, GetModuleHandle
Languages:
java, php
Cyble
Phishing Site used to Spread Typhon Stealer
Cyble analyzes Typhon, an information stealer being spread via a phishing site.
#ParsedReport
16-08-2022
Detecting a Rogue Domain Controller DCShadow Attack
https://www.sentinelone.com/blog/detecting-a-rogue-domain-controller-dcshadow-attack
Threats:
Dcshadow_technique
Dcsync_technique
Lsadump_tool
Mimikatz
Golden_ticket_technique
Trickbot
Softs:
active directory
Functions:
GetNCChanges
Links:
16-08-2022
Detecting a Rogue Domain Controller DCShadow Attack
https://www.sentinelone.com/blog/detecting-a-rogue-domain-controller-dcshadow-attack
Threats:
Dcshadow_technique
Dcsync_technique
Lsadump_tool
Mimikatz
Golden_ticket_technique
Trickbot
Softs:
active directory
Functions:
GetNCChanges
Links:
https://github.com/gentilkiwi/mimikatz/wiki/module-\~-lsadumpSentinelOne
DCShadow Attacks: Detecting a Rogue Domain Controller
Learn what DCShadow attacks are, how they work, methods for detecting them, and effective mitigation strategies to protect your Active Directory environment.
#ParsedReport
16-08-2022
BitRAT, XMRig. Bitrat, XMRIG Coin Minor, distributed using the Windows Genuine Certification tool
https://asec.ahnlab.com/ko/37602
Threats:
Sbit_rat
Xmrig_miner
Trojan/win.generic.c5223158
Malware/mdp.download.m1197
Malware/mdp.drivebydownload.m1298
IOCs:
File: 14
Domain: 1
Hash: 4
Url: 3
IP: 1
Softs:
telegram, google chrome
16-08-2022
BitRAT, XMRig. Bitrat, XMRIG Coin Minor, distributed using the Windows Genuine Certification tool
https://asec.ahnlab.com/ko/37602
Threats:
Sbit_rat
Xmrig_miner
Trojan/win.generic.c5223158
Malware/mdp.download.m1197
Malware/mdp.drivebydownload.m1298
IOCs:
File: 14
Domain: 1
Hash: 4
Url: 3
IP: 1
Softs:
telegram, google chrome
ASEC BLOG
윈도우 정품 인증 툴을 이용해 유포 중인 BitRAT, XMRig 코인 마이너 - ASEC BLOG
ASEC 분석팀에서는 최근 윈도우 정품 인증 툴을 위장하여 BitRAT과 XMRig 코인 마이너가 유포 중인 것을 확인하였다. BitRAT은 아래의 블로그들에서 다룬 바와 같이 이전에도 웹하드를 통해 MS 윈도우 정품 인증 툴과 MS 오피스 설치 프로그램으로 위장하여 유포된 이력이 있으며, 현재 블로그에서 다루는 사례도 동일한 공격자로 추정된다. 특이한 점으로는 V3 설치되지 않은 환경에서는 BitRAT 원격제어툴이 설치되며, V3 설치 환경에서는 (BitRAT…
#ParsedReport
16-08-2022
Vast Malvertising Network Hijacks Browser Settings to Spread Riskware
https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/vast-malvertising-network-hijacks-browser-settings-to-spread-riskware
Threats:
Log4shell_vuln
Sbit_rat
Xmrig_miner
Geo:
Cyprus, Panama
TTPs:
Tactics: 3
Technics: 0
IOCs:
Domain: 32
IP: 14
Functions:
VexTrio
Languages:
javascript, php
Links:
16-08-2022
Vast Malvertising Network Hijacks Browser Settings to Spread Riskware
https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/vast-malvertising-network-hijacks-browser-settings-to-spread-riskware
Threats:
Log4shell_vuln
Sbit_rat
Xmrig_miner
Geo:
Cyprus, Panama
TTPs:
Tactics: 3
Technics: 0
IOCs:
Domain: 32
IP: 14
Functions:
VexTrio
Languages:
javascript, php
Links:
https://github.com/infobloxopen/threat-intelligence/tree/main/cta\_indicators
https://github.com/infobloxopen/threat-intelligence
https://github.com/LorenzoSapora/bad-asn-list
https://github.com/brianhama/bad-asn-listInfoblox Blog
Omnatuor Malvertising Exploits Wordpress to Spread Riskware, Spyware & Adware | Infoblox
The Omnatuor malvertising network uses a clever technique to persistently serve ads to users even if they navigate away from a page. Learn more in this article.
#ParsedReport
16-08-2022
ASEC (20220808 \~ 20220814). ASEC Weekly Malware Statistics (20220808 \~ 20220814)
https://asec.ahnlab.com/ko/37637
Threats:
Agent_tesla
Azorult
Remcos_rat
Formbook
Nanocore_rat
Smokeloader
Clipboard_grabbing_technique
Redline_stealer
Beamwinhttp_loader
Postealer
Industry:
Transport
Geo:
Korea
IOCs:
File: 33
Domain: 7
IP: 3
Email: 6
Url: 27
Softs:
discord
16-08-2022
ASEC (20220808 \~ 20220814). ASEC Weekly Malware Statistics (20220808 \~ 20220814)
https://asec.ahnlab.com/ko/37637
Threats:
Agent_tesla
Azorult
Remcos_rat
Formbook
Nanocore_rat
Smokeloader
Clipboard_grabbing_technique
Redline_stealer
Beamwinhttp_loader
Postealer
Industry:
Transport
Geo:
Korea
IOCs:
File: 33
Domain: 7
IP: 3
Email: 6
Url: 27
Softs:
discord
ASEC BLOG
ASEC 주간 악성코드 통계 (20220808 ~ 20220814) - ASEC BLOG
ASEC 분석팀에서는 ASEC 자동 분석 시스템 RAPIT 을 활용하여 알려진 악성코드들에 대한 분류 및 대응을 진행하고 있다. 본 포스팅에서는 2022년 8월 8일 월요일부터 8월 14일 일요일까지 한 주간 수집된 악성코드의 통계를 정리한다. 대분류 상으로는 인포스틸러가 41.9%로 1위를 차지하였으며, 그 다음으로는 백도어 악성코드가 38.4%, 다운로더 16.8%, 랜섬웨어 2.2%, 코인마이너 악성코드가 0.6%로 집계되었다. Top 1 – Agent…
#ParsedReport
16-08-2022
. Move forward, prevent problems before -the 5G era of network security risk trends and industrial response to thinking
https://www.antiy.cn/research/notice&report/research_report/20220815.html
Threats:
Neuron
Pacemaker
Industry:
Healthcare, Energy, Financial, Iot, Transport
Geo:
China, Chinese, Vietnamese
IOCs:
File: 4
Softs:
android
16-08-2022
. Move forward, prevent problems before -the 5G era of network security risk trends and industrial response to thinking
https://www.antiy.cn/research/notice&report/research_report/20220815.html
Threats:
Neuron
Pacemaker
Industry:
Healthcare, Energy, Financial, Iot, Transport
Geo:
China, Chinese, Vietnamese
IOCs:
File: 4
Softs:
android
www.antiy.cn
关口前移，防患于未然——5G时代的网络安全风险趋势与产业应对思考
安天是引领威胁检测与防御能力发展的网络安全国家队，为客户构建端点防护、流量监测、边界防护、导流捕获、深度分析、应急处置的安全基石
#ParsedReport
17-08-2022
CISA and FBI issue alert about Zeppelin ransomware
https://www.malwarebytes.com/blog/news/2022/08/cisa-and-fbi-issue-alert-about-zeppelin-ransomware
Threats:
Zeppelin
Vega_locker
Industry:
Healthcare
Languages:
delphi
YARA: Found
17-08-2022
CISA and FBI issue alert about Zeppelin ransomware
https://www.malwarebytes.com/blog/news/2022/08/cisa-and-fbi-issue-alert-about-zeppelin-ransomware
Threats:
Zeppelin
Vega_locker
Industry:
Healthcare
Languages:
delphi
YARA: Found
ThreatDown by Malwarebytes
CISA and FBI issue alert about Zeppelin ransomware - ThreatDown by Malwarebytes
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have released a joint Cybersecurity Advisory (CSA) about Zeppelin ransomware.
#ParsedReport
17-08-2022
ASEC Weekly Malware Statistics (August 1st, 2022 August 7th, 2022)
https://asec.ahnlab.com/en/37593
Threats:
Agent_tesla
Formbook
Clipboard_grabbing_technique
Cloudeye
Remcos_rat
Nanocore_rat
Redline_stealer
Beamwinhttp_loader
Vidar_stealer
Industry:
Financial, Transport
Geo:
Korea
IOCs:
Domain: 3
IP: 3
Email: 5
File: 20
Url: 25
Softs:
nsis installer, discord
Languages:
visual_basic
17-08-2022
ASEC Weekly Malware Statistics (August 1st, 2022 August 7th, 2022)
https://asec.ahnlab.com/en/37593
Threats:
Agent_tesla
Formbook
Clipboard_grabbing_technique
Cloudeye
Remcos_rat
Nanocore_rat
Redline_stealer
Beamwinhttp_loader
Vidar_stealer
Industry:
Financial, Transport
Geo:
Korea
IOCs:
Domain: 3
IP: 3
Email: 5
File: 20
Url: 25
Softs:
nsis installer, discord
Languages:
visual_basic
ASEC BLOG
ASEC Weekly Malware Statistics (August 1st, 2022 – August 7th, 2022) - ASEC BLOG
The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from August 1st, 2022 (Monday) to August 7th, 2022 (Sunday). For the main category, info-stealer…
#ParsedReport
17-08-2022
Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors
https://www.mandiant.com/resources/suspected-iranian-actor-targeting-israeli-shipping
Actors/Campaigns:
Unc3890 (motivation: cyber_espionage)
Fox_kitten
Cleaver
Threats:
Watering_hole_technique
Sugarush
Sugardump
Metasploit_tool
Northstar_tool
Credential_harvesting_technique
Industry:
Energy, Healthcare, Government, Maritime, Transport, Aerospace
Geo:
Israel, Iran, Israeli, Iranian
IOCs:
Domain: 9
Url: 1
Hash: 1
Softs:
instagram
Algorithms:
zip
17-08-2022
Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors
https://www.mandiant.com/resources/suspected-iranian-actor-targeting-israeli-shipping
Actors/Campaigns:
Unc3890 (motivation: cyber_espionage)
Fox_kitten
Cleaver
Threats:
Watering_hole_technique
Sugarush
Sugardump
Metasploit_tool
Northstar_tool
Credential_harvesting_technique
Industry:
Energy, Healthcare, Government, Maritime, Transport, Aerospace
Geo:
Israel, Iran, Israeli, Iranian
IOCs:
Domain: 9
Url: 1
Hash: 1
Softs:
Algorithms:
zip
Google Cloud Blog
UNC3890: Suspected Iranian Threat Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors | Google Cloud Blog
#ParsedReport
17-08-2022
Malicious PyPi User Strikes Again with Typosquatting, StarJacking and Unpacks Tailor-made Malware written in C#. Intro
https://checkmarx.com/blog/malicious-pypi-user-strikes-again-with-typosquatting-starjacking-and-unpacks-tailor-made-malware-written-in-c
Threats:
Typosquatting_technique
Starjacking_technique
Joao
Cobalt_strike
Beacon
Intellilock_tool
Geo:
Kazakhstan
IOCs:
Path: 1
Url: 2
IP: 1
Hash: 4
Algorithms:
base64, exhibit
Languages:
python
17-08-2022
Malicious PyPi User Strikes Again with Typosquatting, StarJacking and Unpacks Tailor-made Malware written in C#. Intro
https://checkmarx.com/blog/malicious-pypi-user-strikes-again-with-typosquatting-starjacking-and-unpacks-tailor-made-malware-written-in-c
Threats:
Typosquatting_technique
Starjacking_technique
Joao
Cobalt_strike
Beacon
Intellilock_tool
Geo:
Kazakhstan
IOCs:
Path: 1
Url: 2
IP: 1
Hash: 4
Algorithms:
base64, exhibit
Languages:
python
Checkmarx
Malicious PyPi User Strikes Again with Typosquatting, StarJacking and Unpacks Tailor-made Malware written in C#
On Saturday, August 13th, Checkmarx's Software Supply Chain Security Typosquatting and StarJacking engines detected what seemed like an attack on the Python ecosystem. Further investigation revealed multiple evasion and obfuscation techniques, C2 communication…
#ParsedReport
17-08-2022
MasterFred Using Gymdrop to Distribute Xenomorph Android Banking Trojan
https://blog.cyble.com/2022/08/17/masterfred-using-gymdrop-to-distribute-xenomorph-android-banking-trojan
Actors/Campaigns:
Hadoken_security
Threats:
Masterfred
Gymdrop
Xenomorph
Hostile
Opendir
Hydra
Alien
Octo
Typhon_stealer
Industry:
Financial
Geo:
India, Dubai, Georgia, Poland, Australia, Singapore, Turkey
TTPs:
Tactics: 5
Technics: 9
IOCs:
Url: 7
File: 3
Hash: 2
Softs:
android
17-08-2022
MasterFred Using Gymdrop to Distribute Xenomorph Android Banking Trojan
https://blog.cyble.com/2022/08/17/masterfred-using-gymdrop-to-distribute-xenomorph-android-banking-trojan
Actors/Campaigns:
Hadoken_security
Threats:
Masterfred
Gymdrop
Xenomorph
Hostile
Opendir
Hydra
Alien
Octo
Typhon_stealer
Industry:
Financial
Geo:
India, Dubai, Georgia, Poland, Australia, Singapore, Turkey
TTPs:
Tactics: 5
Technics: 9
IOCs:
Url: 7
File: 3
Hash: 2
Softs:
android
Cyble
MasterFred Using Gymdrop to Distribute Xenomorph Android Banking Trojan
Cyble analyzes the new variant of MasterFred, which acts as the Hostile Downloader and distributes Xenomorph Banking Trojan.
#ParsedReport
17-08-2022
DarkTortilla Malware Analysis
https://www.secureworks.com/research/darktortilla-malware-analysis
Threats:
Darktortilla
Agent_tesla
Asyncrat_rat
Nanocore_rat
Redline_stealer
Cobalt_strike
Metasploit_tool
Process_injection_technique
Confuserex_tool
Junk_code_technique
Industry:
Logistic
Geo:
German, Italian, Romanian, Spanish
TTPs:
Tactics: 2
Technics: 0
IOCs:
File: 35
Hash: 56
Softs:
virtualbox, .net framework, windows shell, winlogon, windows registry, discord, hyper-v
Algorithms:
aes
Links:
17-08-2022
DarkTortilla Malware Analysis
https://www.secureworks.com/research/darktortilla-malware-analysis
Threats:
Darktortilla
Agent_tesla
Asyncrat_rat
Nanocore_rat
Redline_stealer
Cobalt_strike
Metasploit_tool
Process_injection_technique
Confuserex_tool
Junk_code_technique
Industry:
Logistic
Geo:
German, Italian, Romanian, Spanish
TTPs:
Tactics: 2
Technics: 0
IOCs:
File: 35
Hash: 56
Softs:
virtualbox, .net framework, windows shell, winlogon, windows registry, discord, hyper-v
Algorithms:
aes
Links:
https://github.com/malwares/Crypter/tree/master/%5BC%23%5D%20The%20RATs%20Crew%20Crypterhttps://github.com/malwares/Crypter/blob/master/%5BC%23%5D%20The%20RATs%20Crew%20Crypter/Form1.cs#L161-L163https://github.com/dnSpyEx/dnSpySophos
DarkTortilla Malware Analysis
Learn how Secureworks CTU researchers have identified DarkTortilla samples delivering targeted malicious payloads, benign decoy documents, and executables.
#ParsedReport
17-08-2022
THREAT ANALYSIS REPORT: Bumblebee Loader The High Road to Enterprise Domain Control
https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
Threats:
Bumblebee
Bazarbackdoor
Trickbot
Icedid
Cobalt_strike
Meterpreter_tool
Zerologon_vuln
Beacon
Adfind_tool
Lolbin
Uac_bypass_technique
Process_injection_technique
Anydesk_tool
Industry:
Government
CVEs:
CVE-2020-1472 [Vulners]
Vulners: Score: 9.3, CVSS: 3.8,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2)
- microsoft windows server 2012 (-, r2)
- microsoft windows server 2016 (-, 1903, 1909, 2004)
- microsoft windows server 2019 (-)
- fedoraproject fedora (31, 32, 33)
have more...
TTPs:
Tactics: 10
Technics: 24
IOCs:
File: 19
Path: 5
Domain: 1
IP: 1
Hash: 1
Softs:
winlogon, active directory, microsoft exchange, local security authority, curl, vssadmin
Links:
17-08-2022
THREAT ANALYSIS REPORT: Bumblebee Loader The High Road to Enterprise Domain Control
https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
Threats:
Bumblebee
Bazarbackdoor
Trickbot
Icedid
Cobalt_strike
Meterpreter_tool
Zerologon_vuln
Beacon
Adfind_tool
Lolbin
Uac_bypass_technique
Process_injection_technique
Anydesk_tool
Industry:
Government
CVEs:
CVE-2020-1472 [Vulners]
Vulners: Score: 9.3, CVSS: 3.8,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2)
- microsoft windows server 2012 (-, r2)
- microsoft windows server 2016 (-, 1903, 1909, 2004)
- microsoft windows server 2019 (-)
- fedoraproject fedora (31, 32, 33)
have more...
TTPs:
Tactics: 10
Technics: 24
IOCs:
File: 19
Path: 5
Domain: 1
IP: 1
Hash: 1
Softs:
winlogon, active directory, microsoft exchange, local security authority, curl, vssadmin
Links:
https://github.com/leitosama/SharpZeroLogonCybereason
THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control
Cybereason GSOC observed distribution of the Bumblebee Loader and post-exploitation activities including privilege escalation, reconnaissance and credential theft. Bumblebee operators use the Cobalt Strike framework throughout the attack and abuse credentials…
#ParsedReport
17-08-2022
An In-Depth Look at Quantum Ransomware
https://explore.avertium.com/resource/an-in-depth-look-at-quantum-ransomware
Actors/Campaigns:
Xinglocker
Jormungandr
Threats:
Quantum_locker
Astrolocker
Mountlocker
Conti
Bazarbackdoor
Ryuk
Zeon
Icedid
Cobalt_strike
Adfind_tool
Metasploit_tool
Beacon
Industry:
Healthcare, Financial
Geo:
India
IOCs:
File: 10
Domain: 3
IP: 1
Hash: 8
Softs:
psexec, active directory
17-08-2022
An In-Depth Look at Quantum Ransomware
https://explore.avertium.com/resource/an-in-depth-look-at-quantum-ransomware
Actors/Campaigns:
Xinglocker
Jormungandr
Threats:
Quantum_locker
Astrolocker
Mountlocker
Conti
Bazarbackdoor
Ryuk
Zeon
Icedid
Cobalt_strike
Adfind_tool
Metasploit_tool
Beacon
Industry:
Healthcare, Financial
Geo:
India
IOCs:
File: 10
Domain: 3
IP: 1
Hash: 8
Softs:
psexec, active directory
Avertium
An In-Depth Look at Quantum Ransomware
Quantum ransomware is a newer, lesser-known ransomware that operates with the RaaS model & has been successful with compromising healthcare organizations.
#ParsedReport
17-08-2022
AsyncRAT C2 Framework: Overview, Technical Analysis & Detection
https://blog.qualys.com/vulnerabilities-threat-research/2022/08/16/asyncrat-c2-framework-overview-technical-analysis-and-detection
Actors/Campaigns:
Layover
Ta2541
Threats:
Asyncrat_rat
Follina_vuln
Antidebugging_technique
Limelogger_tool
Industry:
Transport, Aerospace, Healthcare, Government
Geo:
Thailand, Asia, America, Australia
TTPs:
Tactics: 3
Technics: 9
IOCs:
File: 4
Softs:
virtualbox
Algorithms:
pbkdf2, aes-256
Functions:
GetKeyState, GetModuleHandle, GetForegroundWindow, GetKeyboardLayout, SetThreadExecutionState, RtlSetProcessIsCritical
Links:
17-08-2022
AsyncRAT C2 Framework: Overview, Technical Analysis & Detection
https://blog.qualys.com/vulnerabilities-threat-research/2022/08/16/asyncrat-c2-framework-overview-technical-analysis-and-detection
Actors/Campaigns:
Layover
Ta2541
Threats:
Asyncrat_rat
Follina_vuln
Antidebugging_technique
Limelogger_tool
Industry:
Transport, Aerospace, Healthcare, Government
Geo:
Thailand, Asia, America, Australia
TTPs:
Tactics: 3
Technics: 9
IOCs:
File: 4
Softs:
virtualbox
Algorithms:
pbkdf2, aes-256
Functions:
GetKeyState, GetModuleHandle, GetForegroundWindow, GetKeyboardLayout, SetThreadExecutionState, RtlSetProcessIsCritical
Links:
https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharphttps://github.com/NYAN-x-CAT/LimeLogger/blob/master/LimeLogger/LimeLogger.csQualys
AsyncRAT C2 Framework: Overview, Technical Analysis & Detection | Qualys
In this blog we describe the AsyncRAT C2 (command & control) Framework, which allows attackers to remotely monitor and control other computers over a secure encrypted link. We provide an overview of…
#ParsedReport
17-08-2022
FileLess AsyncRAT
https://asec.ahnlab.com/ko/37676
Threats:
Asyncrat_rat
Trojan/vbs.runner
IOCs:
File: 14
Path: 6
Url: 1
Domain: 1
Hash: 11
Softs:
task scheduler
17-08-2022
FileLess AsyncRAT
https://asec.ahnlab.com/ko/37676
Threats:
Asyncrat_rat
Trojan/vbs.runner
IOCs:
File: 14
Path: 6
Url: 1
Domain: 1
Hash: 11
Softs:
task scheduler
ASEC BLOG
FileLess 형태로 유포 중인 AsyncRAT - ASEC BLOG
ASEC 분석팀은 최근 FileLess 형태로 AsyncRAT 악성코드가 유포 중인 것을 확인하였다. 유포 중인 AsyncRAT 은 다수의 스크립트 파일을 통해 FileLess 형태로 실행되며, 이메일 내 압축파일로 첨부되어 유포되는 것으로 추정된다. AsyncRAT 은 닷넷으로 개발된 오픈 소스 RAT 악성코드로 공격자의 명령을 받아 다양한 악성 행위를 수행할 수 있다. 피싱 메일을 통해 유포되는 압축파일 내부에는 html 파일이 존재하며, 실행 시…