CTT Report Hub
@aptreports
3.22K subscribers
7.92K photos
6 videos
67 files
11.6K links
Threat Intelligence Report Hub
https://cyberthreat.tech
ООО Технологии киберугроз
Contact: @nikolaiav
Download Telegram
About
Blog
Apps
Platform
Join
CTT Report Hub
3.22K subscribers
CTT Report Hub
#ParsedReport
05-12-2022

Alert (AA22-335A)

https://us-cert.cisa.gov/ncas/alerts/aa22-335a

Actors/Campaigns:
Lapsus

Threats:
Cuba
Romcom_rat
Ransomware.gov
Hancitor
Kerberoasting_technique
Kerbercache_tool
Zerologon_vuln
Qakbot
Impacket_tool
Meterpreter_tool
Iobit_tool
Powerview

Industry:
Foodtech, Government, E-commerce, Healthcare, Financial

Geo:
Ukrainian, Ukraine

CVEs:
CVE-2022-24521 [Vulners]
Vulners: Score: 4.6, CVSS: 4.2,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows 10 (-, 20h2, 21h1, 21h2, 1607, 1809, 1909)
- microsoft windows 11 (-, -)
- microsoft windows 7 (-)
- microsoft windows 8.1 (-)
- microsoft windows rt 8.1 (-)
have more...
CVE-2020-1472 [Vulners]
Vulners: Score: 9.3, CVSS: 3.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows server 2008 (r2)
- microsoft windows server 2012 (-, r2)
- microsoft windows server 2016 (-, 1903, 1909, 2004)
- microsoft windows server 2019 (-)
- fedoraproject fedora (31, 32, 33)
have more...

TTPs:
Tactics: 8
Technics: 13

IOCs:
File: 71
Path: 1
Hash: 48
IP: 53
Email: 4

Softs:
active directory, local security authority, keepass
www.cisa.gov
#StopRansomware: Cuba Ransomware | CISA
Actions to take today to mitigate cyber threats from ransomware: • Prioritize remediating known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Enable and enforce phishing-resistant multifactor authentication.
87 views
CTT Report Hub
#ParsedReport
06-12-2022

Technical Analysis of the Winbox Payload in WindiGo

https://www.nozominetworks.com/blog/technical-analysis-of-the-winbox-payload-in-windigo

Threats:
Windigo
Plaguebot
Meris_botnet
Revil
Glupteba
Mirai

Industry:
Telco, Iot

Geo:
Brazil, China, Vietnam

CVEs:
CVE-2018-14847 [Vulners]
Vulners: Score: 6.4, CVSS: 5.7,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- mikrotik routeros (le6.42)


TTPs:
Tactics: 1
Technics: 0

IOCs:
Hash: 4
File: 1
Domain: 17
Registry: 3
Nozominetworks
Technical Analysis of the Winbox Payload in WindiGo
This blog provides a technical analysis of WindiGo as well as Indicators of Compromise (IoCs) you can use to detect WindiGo in your network.
78 views
CTT Report Hub
#ParsedReport
06-12-2022

Danger Lurking in GitHub Repositories

https://socradar.io/danger-lurking-in-github-repositories

Threats:
Repojacking_technique
Bluekeep_vuln
Houdini_rat

CVEs:
CVE-2019-0708 [Vulners]
Vulners: Score: 10.0, CVSS: 5.4,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows vista (-)
- microsoft windows server 2008 (r2, r2, -)
- microsoft windows xp (-, -)
- microsoft windows server 2003 (-, -, r2)
- microsoft windows 7 (-)
have more...

IOCs:
IP: 1
Hash: 27
File: 2

Algorithms:
base64

Languages:
python

Links:
https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository
SOCRadar® Cyber Intelligence Inc.
Danger Lurking in GitHub Repositories - SOCRadar® Cyber Intelligence Inc.
As a threat actor claims, up to 14 million GitHub users and repository credentials have been stolen recently and offered for sale.
44 views
CTT Report Hub
#ParsedReport
06-12-2022

- TgRat. The TGRAT virus was detected

https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/vyyavlen-virus-shpion-tgrat

Threats:
Tgrat
Impacket_tool
Mimikatz_tool

IOCs:
File: 5

Softs:
telegram

Algorithms:
aes

Links:
https://github.com/wrwrabbit/telegram-bot-api-go)
ptsecurity.com
Блог PT ESC Threat Intelligence
В этом блоге вы можете найти информацию об актуальных атаках хакерских группировок по всему миру, разбор их инструментов, информацию об инцидентах, TTP группировок, индикаторы компрометации и названия детектов в наших продуктах
47 viewsedited  
CTT Report Hub
#ParsedReport
06-12-2022

The Story of a Ransomware Turning into an Accidental Wiper

https://www.fortinet.com/blog/threat-research/The-story-of-a-ransomware-turning-into-an-accidental-wiper

Threats:
Cryptonite
Cyberdevilz_actor
Amsi_bypass_technique
W32/filecoder.ky!tr
W32/filecoder.ky!tr.ransom

Industry:
Financial

IOCs:
Hash: 1
File: 2
Url: 1
Domain: 1

Softs:
pyinstaller

Functions:
findFiles, warningScreen

Languages:
python
Fortinet Blog
The Story of a Ransomware Turning into an Accidental Wiper | FortiGuard Labs
FortiGuard Labs provides a deeper analysis of an open-source Cryptonite ransomware sample that never offers a decryption window, but instead acts as wiper malware. Read to find out more.…
38 views
CTT Report Hub
#ParsedReport
06-12-2022

Calisto show interests into entities involved in Ukraine war support

https://blog.sekoia.io/calisto-show-interests-into-entities-involved-in-ukraine-war-support

Actors/Campaigns:
Calisto
Coldriver
Gamaredon
Apt31

Threats:
Typosquatting_technique
Evilginx_tool
Velar

Industry:
Logistic, Ngo

Geo:
Ukraine, Russian, Indian, African, Syrian, Polish, Ukrainian

IOCs:
Domain: 5

SIGMA: Found
Sekoia.io Blog
Calisto show interests into entities involved in Ukraine war support
Calisto (aka Callisto, COLDRIVER) is suspected to be a Russian-nexus intrusion set active since at least April 2017. Although it was not publicly attributed to any Russian intelligence service, past Calisto operations showed objectives and victimology that…
37 viewsedited  
CTT Report Hub
#ParsedReport
06-12-2022

Vice Society: Profiling a Persistent Threat to the Education Sector

https://unit42.paloaltonetworks.com/vice-society-targets-education-sector

Actors/Campaigns:
Vice_society (motivation: cyber_criminal)
Unc2447

Threats:
Hellokitty
Printnightmare_vuln
Lockbit
Fivehands
Zeppelin
Lotl_technique
Blackcat
Bloodhound_tool
Systembc
Avoslocker
Sombrat_rat

Industry:
Education, Financial, Healthcare, Government, E-commerce, Ngo

Geo:
Emea, Germany, America, Japan, California, Spain, France, Italy, Apac, Brazil

CVEs:
CVE-2021-34527 [Vulners]
Vulners: Score: 9.0, CVSS: 3.7,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows server 2008 (r2, -)
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 21h1, 1809, 1909, 2004)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-, 20h2, 2004)
have more...
CVE-2021-1675 [Vulners]
Vulners: Score: 9.3, CVSS: 3.5,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows server 2008 (r2, -)
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 21h1, 1809, 1909, 2004)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
have more...

TTPs:
Tactics: 11
Technics: 0

IOCs:
Domain: 5
File: 4
Email: 14
Registry: 1
Hash: 15
Path: 1

Softs:
esxi, psexec, windows defender, microsoft defender, local security authority, ive directory data, windows print spooler

Algorithms:
aes
Unit 42
Vice Society: Profiling a Persistent Threat to the Education Sector
Vice Society, a ransomware gang, has been involved in high-profile activity against schools this year.
30 views
CTT Report Hub
#ParsedReport
06-12-2022

Iran: State-Backed Hacking of Activists, Journalists, Politicians

https://www.hrw.org/news/2022/12/05/iran-state-backed-hacking-activists-journalists-politicians

Actors/Campaigns:
Cleaver
Phosphorus
Irgc

Threats:
Credential_harvesting_technique
Hostile
Hyperscrape_tool

Industry:
Government, Financial

Geo:
Usa, Qatar, Iranian, Morocco, Iran, Africa, Tehran, Indian, Beirut, American, Israeli, Libya, Lebanon, Irans

IOCs:
Domain: 7
Url: 7

Softs:
telegram, google takeout

Languages:
javascript, php
Human Rights Watch
Iran: State-Backed Hacking of Activists, Journalists, Politicians
Hackers backed by the Iranian government have targeted Human Rights Watch and at least 18 other high-profile journalists, researchers, and politicians working on Middle East issues in an ongoing social engineering and credential phishing campaign.
26 views
CTT Report Hub
#ParsedReport
06-12-2022

Blue Callisto orbits around US Laboratories in 2022

https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/blue-callisto-orbits-around-us.html

Actors/Campaigns:
Coldriver (motivation: cyber_espionage)
Tick

Threats:
Seaborgium
Evilginx_tool

Industry:
Financial, Aerospace, Education, Government, Healthcare, Telco, Transport, Logistic, Energy

Geo:
Ukraine, Australia, Russia, Ukrainian

TTPs:

IOCs:
Domain: 5
File: 3
Url: 6
IP: 7

Functions:
OpenSSL

Languages:
javascript
PwC
Blue Callisto orbits around US Laboratories in 2022
In this blog post we detail 2022 phishing activity the PwC threat intelligence team attributes to Blue Callisto and list indicators for defenders to query.
26 views
CTT Report Hub
#ParsedReport
06-12-2022

Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies

https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies

Threats:
Credential_harvesting_technique
Anydesk_tool
Dwservice_tool
Logmein_tool
Screenconnect_tool
Teamviewer_tool
Sorillus_rat
Rustscan_tool
Impacket_tool
Dcsync_technique

Industry:
Bp_outsourcing, Telco

CVEs:
CVE-2021-35464 [Vulners]
Vulners: Score: 10.0, CVSS: 5.4,
Vulners: Exploitation: True
X-Force: Risk: Unknown
 X-Force: Patch: Unknown
Soft:
- forgerock am (<6.5.3)
- forgerock openam (<14.6.3)


IOCs:
Domain: 3
IP: 86
Hash: 8
File: 1

Softs:
telegram, curl, beanywhere, domotz, pulseway, rport, rsocx, trendmicro basecamp, zerotier, esxi, have more...

Languages:
python

Links:
https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
https://github.com/NetSPI/aws\_consoler
https://github.com/RustScan/RustScan
https://github.com/b23r0/rsocx
CrowdStrike.com
Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies
CrowdStrike Services analyzes a recent intrusion campaign targeting telecom and business process outsourcing companies and shares how to defend against this attack.
32 viewsedited  
CTT Report Hub
#ParsedReport
06-12-2022

Microsoft ?. How much similar to the Microsoft account stealing phishing page is real?

https://asec.ahnlab.com/ko/43416

Geo:
Korean

IOCs:
File: 2
Hash: 2

Algorithms:
base64, aes
ASEC BLOG
Microsoft 계정 탈취 피싱 페이지는 진짜와 얼마나 비슷할까? - ASEC BLOG
국내외 많은 기업과 개인 사용자가 Microsoft 계정을 이용하여 Outlook, Office, OneDrive, Windows를 비롯한 Microsoft의 주요 서비스를 이용하고 있다. 사용자는 통합 로그인을 이용하여 계정과 연결된 모든 Microsoft 서비스에 편리하게 접속할 수 있다. 공격자 입장에서는 어떨까? 단 한 개의 계정을 이용하여 취할 수 있는 정보가 많기 때문에 더없이 좋은 공격 타깃이다. 특히 기업 내에서 민감 정보를 취급하는 사용자인…
23 views
CTT Report Hub
#ParsedReport
06-12-2022

Exposing TAG-53s Credential Harvesting Infrastructure Used for Russia-Aligned Espionage Operations

https://www.recordedfuture.com/exposing-tag-53-credential-harvesting-infrastructure-for-russia-aligned-espionage-operations

Actors/Campaigns:
Tag-53 (motivation: cyber_espionage, information_theft)
Coldriver (motivation: cyber_espionage, information_theft)
Seaborgium (motivation: cyber_espionage, information_theft)

Threats:
Credential_harvesting_technique
Typosquatting_technique

Industry:
Ngo, Logistic, Government, Telco, Aerospace

Geo:
Russian, Ukraine, Poland, Russia

TTPs:

IOCs:
Domain: 38
IP: 38

Softs:
microsoft onedrive
Recordedfuture
Exposing TAG-53’s Credential Harvesting Infrastructure Used for Russia-Aligned Espionage Operations
A recent spear phishing attempt uncovers a Russia-aligned cyber espionage campaign targeting government, intelligence, and military industries.
31 views
CTT Report Hub
#ParsedReport
06-12-2022

ASEC (20221128 \~ 20221204). ASEC Weekly Malware Statistics (20221128 \~ 20221204)

https://asec.ahnlab.com/ko/43356

Threats:
Smokeloader
Smokerloader
Agent_tesla
Azorult
Vidar_stealer
Antefrigus
Revil
Ransomware.later
Postealer
Clipbanker
Redline_stealer
Beamwinhttp_loader

Industry:
Transport, Financial

Geo:
Korea

IOCs:
File: 17
Email: 5
Url: 9
IP: 6

Softs:
telegram

Languages:
php
ASEC BLOG
ASEC 주간 악성코드 통계 (20221128 ~ 20221204) - ASEC BLOG
ASEC 분석팀에서는 ASEC 자동 분석 시스템 RAPIT 을 활용하여 알려진 악성코드들에 대한 분류 및 대응을 진행하고 있다. 본 포스팅에서는 2022년 11월 28일 월요일부터 12월 4일 일요일까지 한 주간 수집된 악성코드의 통계를 정리한다. 대분류 상으로는 인포스틸러가 34.8%로 1위를 차지하였으며, 그 다음으로는 다운로더가 28.2%, 백도어 21.1%, 랜섬웨어 14.6%, 코인마이너가 0.3%로 집계되었다. Top 1 – SmokeLoader…
23 views
CTT Report Hub
#ParsedReport
06-12-2022

DEV-0139 launches targeted attacks against the cryptocurrency industry

https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry

Threats:
Dll_sideloading_technique

Industry:
Financial

TTPs:
Tactics: 6
Technics: 13

IOCs:
File: 27
Path: 7
Url: 1
Hash: 10
Domain: 1
IP: 1

Softs:
microsoft defender, microsoft defender for endpoint, telegram, microsoft excel, windows media player, "powerpnt", microsoft 365 defender

Algorithms:
base64, xor

Functions:
CreateDate, CreateFile, OpenDrive, Win32

Win API:
CreateProcess

Languages:
visual_basic

Platforms:
x64

Links:
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows%20Security%20Events/Hunting%20Queries/Least\_Common\_Parent\_Child\_Process.yaml
https://github.com/Azure/Azure-Sentinel/blob/46906229919827bffa14211341f52dd68e27ad81/Hunting%20Queries/Microsoft%20365%20Defender/Execution/detect-anomalous-process-trees.yaml
Microsoft News
DEV-0139 launches targeted attacks against the cryptocurrency industry
Microsoft security researchers investigate an attack where the threat actor, tracked DEV-0139, used chat groups to target specific cryptocurrency investment companies and run a backdoor within their network.
34 views
CTT Report Hub
#ParsedReport
06-12-2022

Technical Analysis of DanaBot Obfuscation Techniques

https://www.zscaler.com/blogs/security-research/technical-analysis-danabot-obfuscation-techniques

Threats:
Danabot
Junk_code_technique
Beacon

Industry:
Financial

IOCs:
File: 1
Hash: 1

Languages:
delphi, prolog, python

Links:
https://github.com/threatlabz/tools/blob/main/danabot/10\_math\_loops.py
https://github.com/threatlabz/tools/blob/main/danabot/11\_rename\_junk\_variables.py
https://github.com/threatlabz/tools/blob/main/danabot/idr\_map\_to\_idapy.py
https://github.com/threatlabz/tools/blob/main/danabot/02\_dynamic\_return.py
https://github.com/OALabs/hashdb-ida
https://github.com/OALabs/hashdb/pull/35
https://github.com/threatlabz/tools/blob/main/danabot/06\_fake\_UStrLAsg\_and\_UStrCopy.py
https://github.com/threatlabz/tools/tree/main/danabot
https://github.com/threatlabz/tools/blob/main/danabot/01\_junk\_byte\_jump.py
https://github.com/threatlabz/tools/blob/main/danabot/03\_uppercase\_jumps.py
https://github.com/threatlabz/tools/blob/main/danabot/09\_empty\_loops.py
https://github.com/threatlabz/tools/blob/main/danabot/idr\_idc\_to\_idapy.py
https://github.com/threatlabz/tools/blob/main/danabot/04\_letter\_mapping.py
https://github.com/threatlabz/tools/blob/main/danabot/12\_rename\_junk\_random\_variables.py
https://github.com/crypto2011/IDR
https://github.com/threatlabz/tools/blob/main/danabot/08\_set\_stack\_string\_letters\_comments.py
https://github.com/threatlabz/tools/blob/main/danabot/07\_stack\_string\_letters\_to\_last\_StrCatN\_call.py
https://github.com/threatlabz/tools/blob/main/danabot/05\_reset\_code.py
Zscaler
DanaBot | ThreatLabz
A technical analysis of the DanaBot malware's obfuscation techniques.
80 views
CTT Report Hub
#ParsedReport
07-12-2022

Phishing Email Disguised as a Well-Known Korean Airline

https://asec.ahnlab.com/en/43510

Industry:
Aerospace, Financial

Geo:
Koreas, Korean

IOCs:
Url: 1
ASEC BLOG
Phishing Email Disguised as a Well-Known Korean Airline - ASEC BLOG
The ASEC analysis team has recently discovered a phishing email that impersonates a well-known Korean airline to collect user credentials. The phishing email contains a notice on airline ticket payment, inducing the reader to connect to the disguised phishing…
👍1
61 views
CTT Report Hub
#ParsedReport
07-12-2022

Polonium APT Group: Uncovering New Elements

https://www.deepinstinct.com/blog/polonium-apt-group-uncovering-new-elements

Actors/Campaigns:
Polonium

Threats:
Megacreep
Vbcreep

Industry:
Chemical

Geo:
Israeli, Israel, Lebanon

IOCs:
Hash: 4
File: 6
Registry: 2

Softs:
sysinternals

Functions:
MainZero

Languages:
visual_basic

Links:
https://github.com/eset/malware-ioc/tree/master/polonium
Deep Instinct
Polonium APT Group: Uncovering New Elements | Deep Instinct
The Polonium APT group activity was first detected by Microsoft in June 2022. The group is based in Lebanon and exclusively attacks Israeli companies.
44 views
CTT Report Hub
#ParsedReport
07-12-2022

Malware Distributed with Disguised Filenames (RIGHT-TO-LEFT OVERRIDE)

https://asec.ahnlab.com/en/43518

Threats:
Laplas_clipper
Redline_stealer
Tron
Trojan/win.rtlo.x2172
Dropper/win.agent.c5317732
Trojan/win.injection.c5313120
Trojan/win.generic.c535472
Trojan/win.generic.c5310136
Raccoon_stealer

Industry:
Financial

IOCs:
File: 3
Hash: 6
IP: 1

Softs:
zcash

Languages:
php
ASEC BLOG
Malware Distributed with Disguised Filenames (RIGHT-TO-LEFT OVERRIDE) - ASEC BLOG
In August, the ASEC analysis team made a post on the malware being distributed with filenames that utilize RTLO (Right-To-Left Override). RTLO is a unicode that makes an override from right to left. This type of malware induces users to execute its files…
31 views
CTT Report Hub
#ParsedReport
07-12-2022

Resume.xll File Being Distributed in Korea (LockBit 2.0)

https://asec.ahnlab.com/en/43332

Threats:
Lockbit

Geo:
Korea

IOCs:
File: 3
Url: 1
Path: 1
Hash: 2

Softs:
microsoft excel
ASEC BLOG
'Resume.xll' File Being Distributed in Korea (LockBit 2.0) - ASEC BLOG
In mid-2022, the ASEC analysis team shared that malware with the XLL file format (file extension: .xll) was being distributed via email. The XLL file has a DLL form of a PE (Portable Executable) file but is executed with Microsoft Excel. Since then, this…
27 views
CTT Report Hub
#ParsedReport
07-12-2022

An upsurge of new Android Banking Trojan Zanubis

https://labs.k7computing.com/index.php/an-upsurge-of-new-android-banking-trojan-zanubis

Threats:
Zanubis
Cyberchef_tool

Industry:
Financial, Government

Geo:
Peru, Peruvian

TTPs:
Tactics: 4
Technics: 0

IOCs:
Url: 1
File: 22
IP: 1
Hash: 1

Softs:
android
K7 Labs
An upsurge of new Android Banking Trojan “Zanubis”
                                We came across the tweet of an Android malware sample, a banking trojan that mainly targets Peru banks by […]
31 views
CTT Report Hub
#ParsedReport
07-12-2022

A Closer look at BlackMagic ransomware

https://blog.cyble.com/2022/12/07/a-closer-look-at-blackmagic-ransomware

Threats:
Blackmagic
Anydesk_tool
Mosesstaff

Industry:
Logistic, Transport, Financial

Geo:
Israeli, Australia, India, Georgia, Israel, Israels, Singapore, Dubai, Iran

TTPs:
Tactics: 4
Technics: 8

IOCs:
Url: 2
File: 7
Path: 1
Registry: 1
IP: 2
Hash: 2

Softs:
nginx, docker, qemu, cpanel, virtualbox

Functions:
Sleep

Win API:
GetLogicalDriveStringsA

Win Services:
powerpnt

Languages:
java, python
29 views