#ParsedReport
14-09-2022
SEARCH. Iranian Attackers Upgrade Social Engineering Tactics
https://www.proofpoint.com/us/newsroom/news/iranian-attackers-upgrade-social-engineering-tactics
Actors/Campaigns:
Cleaver
Cosmic_lynx
Bec
Industry:
Education
Geo:
Russia, Iranian, Irans, Iran
Softs:
telegram
14-09-2022
SEARCH. Iranian Attackers Upgrade Social Engineering Tactics
https://www.proofpoint.com/us/newsroom/news/iranian-attackers-upgrade-social-engineering-tactics
Actors/Campaigns:
Cleaver
Cosmic_lynx
Bec
Industry:
Education
Geo:
Russia, Iranian, Irans, Iran
Softs:
telegram
Decipher
Iranian Attackers Upgrade Social Engineering Tactics
Iranian threat actor TA453 has been sending spear-phishing emails that impersonate real individuals from Western foreign policy research institutions.
#ParsedReport
14-09-2022
Opsec Mistakes Reveal COBALT MIRAGE Threat Actors
https://www.secureworks.com/blog/opsec-mistakes-reveal-cobalt-mirage-threat-actors
Actors/Campaigns:
Cobalt_mirage (motivation: cyber_espionage)
Oilrig
Dnspionage
Phosphorus
Agrius
Blackshadow
Threats:
Mirage
Proxyshell_vuln
Rana
Mosesstaff
Industry:
Financial, Government
Geo:
Irans, Iran, Iranian, Iranians, Israel
CVEs:
CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 1.7,
Vulners: Exploitation: True
X-Force: Risk: 6.6
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: 9.1
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 3.4,
Vulners: Exploitation: True
X-Force: Risk: 9
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
IOCs:
File: 1
IP: 3
Hash: 1
Softs:
bitlocker, telegram, android
Win Services:
gupdate
Links:
14-09-2022
Opsec Mistakes Reveal COBALT MIRAGE Threat Actors
https://www.secureworks.com/blog/opsec-mistakes-reveal-cobalt-mirage-threat-actors
Actors/Campaigns:
Cobalt_mirage (motivation: cyber_espionage)
Oilrig
Dnspionage
Phosphorus
Agrius
Blackshadow
Threats:
Mirage
Proxyshell_vuln
Rana
Mosesstaff
Industry:
Financial, Government
Geo:
Irans, Iran, Iranian, Iranians, Israel
CVEs:
CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 1.7,
Vulners: Exploitation: True
X-Force: Risk: 6.6
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: 9.1
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 3.4,
Vulners: Exploitation: True
X-Force: Risk: 9
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
IOCs:
File: 1
IP: 3
Hash: 1
Softs:
bitlocker, telegram, android
Win Services:
gupdate
Links:
https://github.com/fatedier/frpSecureworks
Opsec Mistakes Reveal COBALT MIRAGE Threat Actors
Artifacts exposed personas and companies associated with the Iranian threat group.
#ParsedReport
14-09-2022
Lorenz Ransomware Group IOCs
https://1275.ru/ioc/669/lorenz-ransomware-group-iocs/?from=rss
Threats:
Lorenz
Lolbin
Lokilocker
Hive
Avoslocker
Evilnominatus
Geo:
Mexico, China, Usa
CVEs:
CVE-2022-29499 [Vulners]
Vulners: Score: 10.0, CVSS: 5.1,
Vulners: Exploitation: True
X-Force: Risk: 7.3
X-Force: Patch: Official fix
Soft:
- mitel mivoice connect (le22.20.2300.0)
IOCs:
IP: 7
Hash: 2
Softs:
bitlocker, esxi
14-09-2022
Lorenz Ransomware Group IOCs
https://1275.ru/ioc/669/lorenz-ransomware-group-iocs/?from=rss
Threats:
Lorenz
Lolbin
Lokilocker
Hive
Avoslocker
Evilnominatus
Geo:
Mexico, China, Usa
CVEs:
CVE-2022-29499 [Vulners]
Vulners: Score: 10.0, CVSS: 5.1,
Vulners: Exploitation: True
X-Force: Risk: 7.3
X-Force: Patch: Official fix
Soft:
- mitel mivoice connect (le22.20.2300.0)
IOCs:
IP: 7
Hash: 2
Softs:
bitlocker, esxi
SEC-1275-1
Lorenz Ransomware Group IOCs - SEC-1275-1
Lorenz Ransomware Group IOCs - Команда Arctic Wolf Labs недавно исследовала вторжение вымогательского ПО Lorenz, которое использовало уязвимость в устройстве Mitel MiVoice VoIP
На правах рекламы :)
https://cisoclub.ru/rst-cloud-i-security-vision-obedinili-ekspertizu-dlya-rassledovaniya-i-reagirovaniya-na-inczidenty-kiberbezopasnosti/
https://cisoclub.ru/rst-cloud-i-security-vision-obedinili-ekspertizu-dlya-rassledovaniya-i-reagirovaniya-na-inczidenty-kiberbezopasnosti/
CISOCLUB
RST Cloud и Security Vision объединили экспертизу для расследования и реагирования на инциденты кибербезопасности
Интеграция продуктов RST Cloud и Security Vision позволит заказчикам использовать в процессах киберразведки и инцидент-менеджмента расширенную актуальную базу индикаторов на основе более чем 260 открытых источников. Компания RST Cloud, поставщик индикаторов…
#ParsedReport
14-09-2022
Fake Security App Found Abusing Japanese Payment System. How Do victims install this malware?
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fake-security-app-found-abusing-japanese-payment-system
Threats:
Emotet
Dexter
Industry:
Financial
Geo:
France, Japanese, Japan
IOCs:
Domain: 1
Hash: 6
Softs:
chrome, instagram, android
Languages:
golang
14-09-2022
Fake Security App Found Abusing Japanese Payment System. How Do victims install this malware?
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fake-security-app-found-abusing-japanese-payment-system
Threats:
Emotet
Dexter
Industry:
Financial
Geo:
France, Japanese, Japan
IOCs:
Domain: 1
Hash: 6
Softs:
chrome, instagram, android
Languages:
golang
McAfee Blog
Fake Security App Found Abuses Japanese Payment System | McAfee Blog
Authored by SangRyol Ryu and Yukihiro Okutomi McAfee’s Mobile Research team recently analyzed new malware targeting mobile payment users in Japan. The
#ParsedReport
15-09-2022
Change in Magniber Ransomware (*.cpl *.jse) September 8th
https://asec.ahnlab.com/en/38808
Threats:
Magniber
Typosquatting_technique
Geo:
Korean
IOCs:
Hash: 1
Softs:
chrome
Algorithms:
zip
15-09-2022
Change in Magniber Ransomware (*.cpl *.jse) September 8th
https://asec.ahnlab.com/en/38808
Threats:
Magniber
Typosquatting_technique
Geo:
Korean
IOCs:
Hash: 1
Softs:
chrome
Algorithms:
zip
ASEC
Change in Magniber Ransomware (*.cpl → *.jse) – September 8th - ASEC
Change in Magniber Ransomware (*.cpl → *.jse) – September 8th ASEC
#ParsedReport
15-09-2022
JPCERT/CC Eyes
https://blogs.jpcert.or.jp/en/2022/09/bigip-exploit.html
Actors/Campaigns:
Blacktech
Threats:
Hipid
Plead
Bifrose
Industry:
Iot
Geo:
Usa, Japanese
CVEs:
CVE-2022-1388 [Vulners]
Vulners: Score: 7.5, CVSS: 3.8,
Vulners: Exploitation: True
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- f5 big-ip access policy manager (le11.6.5, le12.1.6, <16.1.2.2, <15.1.5.1, <14.1.4.6, <13.1.5)
- f5 big-ip advanced firewall manager (le11.6.5, le12.1.6, <15.1.5.1, <14.1.4.6, <13.1.5, <16.1.2.2)
- f5 big-ip analytics (le11.6.5, le12.1.6, <16.1.2.2, <15.1.5.1, <14.1.4.6, <13.1.5)
- f5 big-ip application acceleration manager (le11.6.5, le12.1.6, <16.1.2.2, <15.1.5.1, <14.1.4.6, <13.1.5)
- f5 big-ip application security manager (le11.6.5, le12.1.6, <16.1.2.2, <15.1.5.1, <14.1.4.6, <13.1.5)
have more...
IOCs:
Hash: 3
Softs:
big-ip
Algorithms:
rc4, base32
Languages:
javascript
Platforms:
x64, arm
15-09-2022
JPCERT/CC Eyes
https://blogs.jpcert.or.jp/en/2022/09/bigip-exploit.html
Actors/Campaigns:
Blacktech
Threats:
Hipid
Plead
Bifrose
Industry:
Iot
Geo:
Usa, Japanese
CVEs:
CVE-2022-1388 [Vulners]
Vulners: Score: 7.5, CVSS: 3.8,
Vulners: Exploitation: True
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- f5 big-ip access policy manager (le11.6.5, le12.1.6, <16.1.2.2, <15.1.5.1, <14.1.4.6, <13.1.5)
- f5 big-ip advanced firewall manager (le11.6.5, le12.1.6, <15.1.5.1, <14.1.4.6, <13.1.5, <16.1.2.2)
- f5 big-ip analytics (le11.6.5, le12.1.6, <16.1.2.2, <15.1.5.1, <14.1.4.6, <13.1.5)
- f5 big-ip application acceleration manager (le11.6.5, le12.1.6, <16.1.2.2, <15.1.5.1, <14.1.4.6, <13.1.5)
- f5 big-ip application security manager (le11.6.5, le12.1.6, <16.1.2.2, <15.1.5.1, <14.1.4.6, <13.1.5)
have more...
IOCs:
Hash: 3
Softs:
big-ip
Algorithms:
rc4, base32
Languages:
javascript
Platforms:
x64, arm
JPCERT/CC Eyes
F5 BIG-IP Vulnerability (CVE-2022-1388) Exploited by BlackTech - JPCERT/CC Eyes
Around May 2022, JPCERT/CC confirmed an attack activity against Japanese organizations that exploited F5 BIG-IP vulnerability (CVE-2022-1388). The targeted organizations have confirmed that data in BIG-IP has been compromised. We consider that this attack…
#ParsedReport
15-09-2022
EvilProxy IOCs
https://1275.ru/ioc/670/evilproxy-iocs/?from=rss
Threats:
Evilproxy
Moloch
Industry:
Financial
IOCs:
IP: 3
Softs:
cpanel
15-09-2022
EvilProxy IOCs
https://1275.ru/ioc/670/evilproxy-iocs/?from=rss
Threats:
Evilproxy
Moloch
Industry:
Financial
IOCs:
IP: 3
Softs:
cpanel
SEC-1275-1
EvilProxy IOCs - SEC-1275-1
EvilProxy IOCs - После недавнего взлома Twilio, приведшего к утечке кодов 2FA (OTP), киберпреступники продолжают совершенствовать свой арсенал атак для организации
#ParsedReport
15-09-2022
Self-spreading stealer attacks gamers via YouTube
https://securelist.com/self-spreading-stealer-attacks-gamers-via-youtube/107407
Threats:
Redline_stealer
Industry:
Entertainment, Financial
IOCs:
File: 7
Path: 1
Url: 10
IP: 1
Softs:
chrome, microsoft edge, discord
Languages:
rust
15-09-2022
Self-spreading stealer attacks gamers via YouTube
https://securelist.com/self-spreading-stealer-attacks-gamers-via-youtube/107407
Threats:
Redline_stealer
Industry:
Entertainment, Financial
IOCs:
File: 7
Path: 1
Url: 10
IP: 1
Softs:
chrome, microsoft edge, discord
Languages:
rust
Securelist
RedLine spreads through ads for cheats and cracks on YouTube
A malicious bundle containing the RedLine stealer and a miner is distributed on YouTube through cheats and cracks ads for popular games.
#ParsedReport
15-09-2022
SideWalk Backdoor IOCs
https://1275.ru/ioc/671/sidewalk-backdoor-iocs/?from=rss
Actors/Campaigns:
Sparklinggoblin
Axiom
Threats:
Sidewalk
Stageclients
Specter_rat
Crosswalk
Plugx_rat
Shadowpad
Industry:
Education
Geo:
Asia
IOCs:
File: 3
IP: 2
Hash: 2
Algorithms:
chacha20
15-09-2022
SideWalk Backdoor IOCs
https://1275.ru/ioc/671/sidewalk-backdoor-iocs/?from=rss
Actors/Campaigns:
Sparklinggoblin
Axiom
Threats:
Sidewalk
Stageclients
Specter_rat
Crosswalk
Plugx_rat
Shadowpad
Industry:
Education
Geo:
Asia
IOCs:
File: 3
IP: 2
Hash: 2
Algorithms:
chacha20
SEC-1275-1
SideWalk Backdoor IOCs - SEC-1275-1
SideWalk Backdoor IOCs - Исследователи ESET обнаружили Linux-вариант бэкдора SideWalk, одного из многочисленных пользовательских имплантов, используемых APT-группой
#ParsedReport
15-09-2022
Attackers Continue to Abuse Google Sites and Microsoft Azure to Host Cryptocurrency Phishing
https://www.netskope.com/blog/attackers-continue-to-abuse-google-sites-and-microsoft-azure-to-host-cryptocurrency-phishing
Threats:
Kraken
Lampion
Asyncrat_rat
IOCs:
Url: 95
Softs:
coinbase
15-09-2022
Attackers Continue to Abuse Google Sites and Microsoft Azure to Host Cryptocurrency Phishing
https://www.netskope.com/blog/attackers-continue-to-abuse-google-sites-and-microsoft-azure-to-host-cryptocurrency-phishing
Threats:
Kraken
Lampion
Asyncrat_rat
IOCs:
Url: 95
Softs:
coinbase
Netskope
Attackers Continue to Abuse Google Sites and Microsoft Azure to Host Cryptocurrency Phishing
Summary On August 9, 2022, we released a blog post about a phishing campaign where attackers were abusing Google Sites and Microsoft Azure Web Apps to
#ParsedReport
15-09-2022
Notepad++. Using NOTEPAD ++ plugins for evasion and persistence
https://1275.ru/ioc/672/ispolzovanie-plaginov-notepad-dlya-ukloneniya-i-persistentnosti/?from=rss
Threats:
Strongpity
IOCs:
Hash: 1
15-09-2022
Notepad++. Using NOTEPAD ++ plugins for evasion and persistence
https://1275.ru/ioc/672/ispolzovanie-plaginov-notepad-dlya-ukloneniya-i-persistentnosti/?from=rss
Threats:
Strongpity
IOCs:
Hash: 1
SEC-1275-1
Использование плагинов Notepad++ для уклонения и персистентности - SEC-1275-1
Использование плагинов Notepad++ для уклонения и персистентности - Аналитики команды Cybereason GSOC проанализировали специфическую технику, использующую плагины Notepad++ для сохранения и обхода механизмов безопасности
#ParsedReport
15-09-2022
Gamaredon APT targets Ukrainian government agencies in new campaign
http://blog.talosintelligence.com/2022/09/gamaredon-apt-targets-ukrainian-agencies.html
Actors/Campaigns:
Gamaredon (motivation: cyber_espionage)
Threats:
Gammaload
Gammasteel
Giddome
Industry:
Government
Geo:
Ukrainian, Russian, Russia, Ukraine
TTPs:
Tactics: 2
Technics: 0
IOCs:
File: 7
Url: 24
Domain: 4
Registry: 2
Hash: 13
IP: 1
Softs:
microsoft office
Algorithms:
xor
Functions:
Get-IP
Platforms:
x86
Links:
15-09-2022
Gamaredon APT targets Ukrainian government agencies in new campaign
http://blog.talosintelligence.com/2022/09/gamaredon-apt-targets-ukrainian-agencies.html
Actors/Campaigns:
Gamaredon (motivation: cyber_espionage)
Threats:
Gammaload
Gammasteel
Giddome
Industry:
Government
Geo:
Ukrainian, Russian, Russia, Ukraine
TTPs:
Tactics: 2
Technics: 0
IOCs:
File: 7
Url: 24
Domain: 4
Registry: 2
Hash: 13
IP: 1
Softs:
microsoft office
Algorithms:
xor
Functions:
Get-IP
Platforms:
x86
Links:
https://github.com/Cisco-Talos/IOCs/tree/main/2022/09Cisco Talos Blog
Gamaredon APT targets Ukrainian government agencies in new campaign
Cisco Talos discovered Gamaredon APT activity targeting users in Ukraine with malicious LNK files distributed in RAR archives.
#ParsedReport
15-09-2022
Webworm: Espionage Attackers Testing and Using Older Modified RATs
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/webworm-espionage-rats
Actors/Campaigns:
Webworm (motivation: cyber_espionage)
Threats:
Gh0st_rat
Trochilus_rat
9002
Plugx_rat
Ghostnet
Industry:
Aerospace, Energy, Government
Geo:
Georgia, Korea, Asian, Russia, Mongolia
IOCs:
Hash: 17
File: 7
Path: 7
Algorithms:
lzw
Win API:
LoadLibraryA, CreateProcessAsUserW
15-09-2022
Webworm: Espionage Attackers Testing and Using Older Modified RATs
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/webworm-espionage-rats
Actors/Campaigns:
Webworm (motivation: cyber_espionage)
Threats:
Gh0st_rat
Trochilus_rat
9002
Plugx_rat
Ghostnet
Industry:
Aerospace, Energy, Government
Geo:
Georgia, Korea, Asian, Russia, Mongolia
IOCs:
Hash: 17
File: 7
Path: 7
Algorithms:
lzw
Win API:
LoadLibraryA, CreateProcessAsUserW
Security
Webworm: Espionage Attackers Testing and Using Older Modified RATs
The attackers are working on a number of malware threats, some of which have been used in attacks while others are in pre-deployment or testing stages.
#ParsedReport
15-09-2022
From the Front Lines \| Slam! Anatomy of a Publicly-Available Ransomware Builder
https://www.sentinelone.com/blog/from-the-front-lines-slam-anatomy-of-a-publicly-available-ransomware-builder
Threats:
Slam
Uac_bypass_technique
Uacme
Multiplug
Dyre
Icedid
Alpha_mbr_tool
Industry:
Education
Geo:
Spanish
TTPs:
IOCs:
File: 6
IP: 1
Path: 2
Hash: 46
Softs:
vssadmin, bcdedit
Algorithms:
aes-256
15-09-2022
From the Front Lines \| Slam! Anatomy of a Publicly-Available Ransomware Builder
https://www.sentinelone.com/blog/from-the-front-lines-slam-anatomy-of-a-publicly-available-ransomware-builder
Threats:
Slam
Uac_bypass_technique
Uacme
Multiplug
Dyre
Icedid
Alpha_mbr_tool
Industry:
Education
Geo:
Spanish
TTPs:
IOCs:
File: 6
IP: 1
Path: 2
Hash: 46
Softs:
vssadmin, bcdedit
Algorithms:
aes-256
SentinelOne
From the Front Lines | Slam! Anatomy of a Publicly-Available Ransomware Builder
The barrier to entry into the world of ransomware and cybercrime has never been lower, and even low-level threats can be surprisingly effective.
#ParsedReport
15-09-2022
Phishing Campaign Targets Greek Banking Users
https://blog.cyble.com/2022/09/14/phishing-campaign-targets-greek-banking-users
Industry:
Financial, Government
Geo:
Greek, Greece, Singapore, Dubai, Georgia, Australia, Greeces, India
TTPs:
Tactics: 1
Technics: 3
IOCs:
Url: 12
IP: 1
Languages:
javascript
15-09-2022
Phishing Campaign Targets Greek Banking Users
https://blog.cyble.com/2022/09/14/phishing-campaign-targets-greek-banking-users
Industry:
Financial, Government
Geo:
Greek, Greece, Singapore, Dubai, Georgia, Australia, Greeces, India
TTPs:
Tactics: 1
Technics: 3
IOCs:
Url: 12
IP: 1
Languages:
javascript
Cyble
Phishing Campaign Targets Greek Banking Users
Cyble Research and Intelligence Labs analyzes a sophisticated phishing campaign targeting Greek bank users.
#ParsedReport
15-09-2022
PrivateLoader: the loader of the prevalent ruzki PPI service
https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service
Actors/Campaigns:
Shell_crew
Threats:
Privateloader
Ruzki_actor
Traffer
Dead_drop_technique
Redline_stealer
Vidar_stealer
Raccoon_stealer
Socelars
Fabookie
Ytstealer
Agent_tesla
Phoenix_keylogger
Stop
Danabot
Smokeloader
Xmrig_miner
Glupteba
Dcrat_rat
Netsupportmanager_rat
Nymaim
Industry:
Financial
Geo:
Czechia, Russia, Russian, Germany
TTPs:
Tactics: 2
Technics: 9
IOCs:
IP: 13
Url: 12
Hash: 20
Softs:
telegram, windows defender, discord
Algorithms:
xor
Languages:
php, python
Links:
15-09-2022
PrivateLoader: the loader of the prevalent ruzki PPI service
https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service
Actors/Campaigns:
Shell_crew
Threats:
Privateloader
Ruzki_actor
Traffer
Dead_drop_technique
Redline_stealer
Vidar_stealer
Raccoon_stealer
Socelars
Fabookie
Ytstealer
Agent_tesla
Phoenix_keylogger
Stop
Danabot
Smokeloader
Xmrig_miner
Glupteba
Dcrat_rat
Netsupportmanager_rat
Nymaim
Industry:
Financial
Geo:
Czechia, Russia, Russian, Germany
TTPs:
Tactics: 2
Technics: 9
IOCs:
IP: 13
Url: 12
Hash: 20
Softs:
telegram, windows defender, discord
Algorithms:
xor
Languages:
php, python
Links:
https://github.com/SEKOIA-IO/Community/blob/main/IOCs/20220914\_privateloader\_IOC.csvSekoia.io Blog
PrivateLoader: the loader of the prevalent ruzki PPI service
PrivateLoader is a downloader malware family. It is used as part of a PPI service, to deliver payloads of multiple malware families.
Bvp47 Technical Details Report II
https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group_ii.en.pdf
https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group_ii.en.pdf
#ParsedReport
16-09-2022
PAC_Requestor and Golden Ticket Attacks
https://www.varonis.com/blog/pac_requestor-and-golden-ticket-attacks
Threats:
Golden_ticket_technique
Mimikatz
Rubeus_tool
CVEs:
CVE-2021-42287 [Vulners]
Vulners: Score: 6.5, CVSS: 4.2,
Vulners: Exploitation: True
X-Force: Risk: 7.5
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -, -)
- microsoft windows server 2012 (r2, -)
- microsoft windows server 2016 (-, 2004)
- microsoft windows server 2019 (-)
- microsoft windows server 2022 (*)
have more...
Softs:
active directory
16-09-2022
PAC_Requestor and Golden Ticket Attacks
https://www.varonis.com/blog/pac_requestor-and-golden-ticket-attacks
Threats:
Golden_ticket_technique
Mimikatz
Rubeus_tool
CVEs:
CVE-2021-42287 [Vulners]
Vulners: Score: 6.5, CVSS: 4.2,
Vulners: Exploitation: True
X-Force: Risk: 7.5
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -, -)
- microsoft windows server 2012 (r2, -)
- microsoft windows server 2016 (-, 2004)
- microsoft windows server 2019 (-)
- microsoft windows server 2022 (*)
have more...
Softs:
active directory
Varonis
Fighting Golden Ticket Attacks with Privileged Attribute Certificate (PAC)
Learn how and why to control the Active Directory Environment state with PACRequestorEnforcement, the implications of doing so and how to detect Golden Ticket attacks happening in your network.
#ParsedReport
16-09-2022
V3 (AMSI + ). Latest Magniverse Ransomware V3 Class Video (AMSI + Memory Diagnosis)
https://asec.ahnlab.com/ko/38854
Threats:
Magniber
IOCs:
File: 4
Hash: 2
Languages:
javascript, java
16-09-2022
V3 (AMSI + ). Latest Magniverse Ransomware V3 Class Video (AMSI + Memory Diagnosis)
https://asec.ahnlab.com/ko/38854
Threats:
Magniber
IOCs:
File: 4
Hash: 2
Languages:
javascript, java
ASEC BLOG
최신 매그니베르 랜섬웨어 V3 차단 영상 (AMSI + 메모리진단) - ASEC BLOG
ASEC 분석팀은 지난 09/08 블로그를 통해 매그니베르 변형에 대한 내용을 소개하였다. 금일부터는 매그니베르 랜섬웨어 스크립트가 자바 스크립트 인것은 동일하지만, 확장자가 기존 *.jse에서 *.js로 변경되었다. 매그니베르가 09/08을 기점으로 자바 스크립트로 바뀌면서 동작 방식 또한 기존과 달라졌다. 현재 유포 중인 자바 스크립트 파일 내부에는 [그림 2]와 같은 닷넷 DLL이 포함되어 매그니베르 쉘코드를 실행 중인 프로세스에 인젝션 한다. 최신…
#ParsedReport
16-09-2022
ASEC (20220905 \~ 20220911). ASEC Weekly Malware Statistics (20220905 \~ 20220911)
https://asec.ahnlab.com/ko/38815
Threats:
Cloudeye
Postealer
Formbook
Agent_tesla
Remcos_rat
Nanocore_rat
Azorult
Lokibot_stealer
Smokeloader
Clipboard_grabbing_technique
Industry:
Transport
Geo:
Korea
IOCs:
File: 22
Url: 30
Email: 4
Softs:
nsis installer, discord
Languages:
visual_basic
16-09-2022
ASEC (20220905 \~ 20220911). ASEC Weekly Malware Statistics (20220905 \~ 20220911)
https://asec.ahnlab.com/ko/38815
Threats:
Cloudeye
Postealer
Formbook
Agent_tesla
Remcos_rat
Nanocore_rat
Azorult
Lokibot_stealer
Smokeloader
Clipboard_grabbing_technique
Industry:
Transport
Geo:
Korea
IOCs:
File: 22
Url: 30
Email: 4
Softs:
nsis installer, discord
Languages:
visual_basic
ASEC BLOG
ASEC 주간 악성코드 통계 (20220905 ~ 20220911) - ASEC BLOG
ASEC 분석팀에서는 ASEC 자동 분석 시스템 RAPIT 을 활용하여 알려진 악성코드들에 대한 분류 및 대응을 진행하고 있다. 본 포스팅에서는 2022년 9월 5일 월요일부터 9월 11일 일요일까지 한 주간 수집된 악성코드의 통계를 정리한다. 대분류 상으로는 인포스틸러가 47.1%로 1위를 차지하였으며, 그 다음으로는 다운로더 악성코드가 32.7%, 백도어 12.5%, 랜섬웨어 7.7%로 집계되었다. Top 1 – GuLoader 21.2%를 차지하는…