#ParsedReport
07-12-2022
Top 10 macOS Malware Discoveries in 2022
https://www.sentinelone.com/blog/top-10-macos-malware-discoveries-in-2022
Actors/Campaigns:
Lazarus
Earth_berberoka
Emissary_panda
Threats:
Alchimist_tool
Chromeloader
Cloudmensis
Cratedepression
Dazzlespy
Gimmick
Pymafka
Pkexec_tool
Poseidon
Macma
Typosquatting_technique
Cobalt_strike
Upx_tool
Sliver_tool
Xcsset
Pirrit
Bundlore
Adload_loader
Geo:
Chinese, Asia, Korean
CVEs:
CVE-2021-4034 [Vulners]
Vulners: Score: 7.2, CVSS: 4.4,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- polkit project polkit (*)
- redhat enterprise linux desktop (7.0)
- redhat enterprise linux workstation (7.0)
- redhat enterprise linux for scientific computing (7.0)
- redhat enterprise linux server (7.0, 6.0)
have more...
CVE-2020-9934 [Vulners]
Vulners: Score: 2.1, CVSS: 2.3,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- apple ipad os (<13.6)
- apple iphone os (<13.6)
- apple mac os x (<10.15.6)
IOCs:
Hash: 29
File: 12
Url: 3
Domain: 4
IP: 1
Softs:
macos, unix, chrome, keychain, coinbase
Algorithms:
zip
Languages:
rust, objective_c, python
Platforms:
intel, apple, x86
07-12-2022
Top 10 macOS Malware Discoveries in 2022
https://www.sentinelone.com/blog/top-10-macos-malware-discoveries-in-2022
Actors/Campaigns:
Lazarus
Earth_berberoka
Emissary_panda
Threats:
Alchimist_tool
Chromeloader
Cloudmensis
Cratedepression
Dazzlespy
Gimmick
Pymafka
Pkexec_tool
Poseidon
Macma
Typosquatting_technique
Cobalt_strike
Upx_tool
Sliver_tool
Xcsset
Pirrit
Bundlore
Adload_loader
Geo:
Chinese, Asia, Korean
CVEs:
CVE-2021-4034 [Vulners]
Vulners: Score: 7.2, CVSS: 4.4,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- polkit project polkit (*)
- redhat enterprise linux desktop (7.0)
- redhat enterprise linux workstation (7.0)
- redhat enterprise linux for scientific computing (7.0)
- redhat enterprise linux server (7.0, 6.0)
have more...
CVE-2020-9934 [Vulners]
Vulners: Score: 2.1, CVSS: 2.3,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- apple ipad os (<13.6)
- apple iphone os (<13.6)
- apple mac os x (<10.15.6)
IOCs:
Hash: 29
File: 12
Url: 3
Domain: 4
IP: 1
Softs:
macos, unix, chrome, keychain, coinbase
Algorithms:
zip
Languages:
rust, objective_c, python
Platforms:
intel, apple, x86
SentinelOne
Top 10 macOS Malware Discoveries in 2022
Learn about all the new malware targeting macOS users in 2022 and how to stay safe from the latest Mac-focused campaigns.
#ParsedReport
08-12-2022
Phishing Email Impersonating Quasi-governmental Organization Being Distributed
https://asec.ahnlab.com/en/43596
Geo:
Korea
IOCs:
Url: 2
08-12-2022
Phishing Email Impersonating Quasi-governmental Organization Being Distributed
https://asec.ahnlab.com/en/43596
Geo:
Korea
IOCs:
Url: 2
ASEC BLOG
Phishing Email Impersonating Quasi-governmental Organization Being Distributed - ASEC BLOG
The ASEC analysis team has recently detected the distribution of a phishing email impersonating a non-profit quasi-governmental organization. Since the email is using a webpage disguised as a login page of GobizKOREA serviced by Korea SMEs and Startups Agency…
#ParsedReport
08-12-2022
ASEC Weekly Malware Statistics (November 28th, 2022 December 4th, 2022)
https://asec.ahnlab.com/en/43544
Threats:
Smokeloader
Agent_tesla
Vidar_stealer
Clipbanker
Redline_stealer
Beamwinhttp_loader
Industry:
Financial
Geo:
Korea
IOCs:
File: 9
Email: 5
Url: 9
IP: 6
Softs:
telegram
Languages:
php
08-12-2022
ASEC Weekly Malware Statistics (November 28th, 2022 December 4th, 2022)
https://asec.ahnlab.com/en/43544
Threats:
Smokeloader
Agent_tesla
Vidar_stealer
Clipbanker
Redline_stealer
Beamwinhttp_loader
Industry:
Financial
Geo:
Korea
IOCs:
File: 9
Email: 5
Url: 9
IP: 6
Softs:
telegram
Languages:
php
ASEC BLOG
ASEC Weekly Malware Statistics (November 28th, 2022 – December 4th, 2022) - ASEC BLOG
The ASEC analysis team uses the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from November 28th, 2022 (Monday) to December 4th, 2022 (Sunday). For the main category, Infostealer…
#ParsedReport
08-12-2022
ASEC Weekly Phishing Email Threat Trend (November 20th, 2022 November 26th, 2022)
https://asec.ahnlab.com/en/43570
Threats:
Agent_tesla
Formbook
Purecrypter
Industry:
Financial, Transport
Geo:
Mongolian, Korean
TTPs:
IOCs:
File: 43
Url: 9
Algorithms:
zip
08-12-2022
ASEC Weekly Phishing Email Threat Trend (November 20th, 2022 November 26th, 2022)
https://asec.ahnlab.com/en/43570
Threats:
Agent_tesla
Formbook
Purecrypter
Industry:
Financial, Transport
Geo:
Mongolian, Korean
TTPs:
IOCs:
File: 43
Url: 9
Algorithms:
zip
ASEC BLOG
ASEC Weekly Phishing Email Threat Trend (November 20th, 2022 – November 26th, 2022) - ASEC BLOG
The ASEC analysis team monitors phishing email threats with the ASEC automatic sample analysis system (RAPIT) and Honeypot. This post will cover the cases of distribution of phishing emails during the week from November 20th, 2022 to November 26th, 2022 and…
#ParsedReport
08-12-2022
DeathStalker targets legal entities with new Janicab variant
https://securelist.com/deathstalker-targets-legal-entities-with-new-janicab-variant/108131
Actors/Campaigns:
Evilnum
Threats:
Janicab
Dead_drop_technique
Powersing
Powerpepper
Plink
Beacon
Icmpshell_tool
Procdump_tool
Industry:
Financial
Geo:
Egypt, Emirates, Georgia, Bulgaria
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 26
Registry: 1
IP: 4
Hash: 19
Url: 3
Softs:
macos, virtualbox, internet explorer, sysinternals
Algorithms:
base64, zip
Functions:
isVmDrivers, isVmMAC, isVmProduct, InternetExplorer, checkRunningProcess, delFFcookies, delGCcookies, delIEcookies, isMalwb, HandleCCleaner, have more...
Languages:
php, python
Platforms:
apple, intel
Links:
08-12-2022
DeathStalker targets legal entities with new Janicab variant
https://securelist.com/deathstalker-targets-legal-entities-with-new-janicab-variant/108131
Actors/Campaigns:
Evilnum
Threats:
Janicab
Dead_drop_technique
Powersing
Powerpepper
Plink
Beacon
Icmpshell_tool
Procdump_tool
Industry:
Financial
Geo:
Egypt, Emirates, Georgia, Bulgaria
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 26
Registry: 1
IP: 4
Hash: 19
Url: 3
Softs:
macos, virtualbox, internet explorer, sysinternals
Algorithms:
base64, zip
Functions:
isVmDrivers, isVmMAC, isVmProduct, InternetExplorer, checkRunningProcess, delFFcookies, delGCcookies, delIEcookies, isMalwb, HandleCCleaner, have more...
Languages:
php, python
Platforms:
apple, intel
Links:
https://github.com/bdamele/icmpshSecurelist
DeathStalker targets legal entities with new Janicab variant
While hunting for less common Deathstalker intrusions, we identified a new Janicab variant used in targeting legal entities in the Middle East throughout 2020.
#ParsedReport
08-12-2022
STOP. Stop ransomware domestic distribution
https://asec.ahnlab.com/ko/43680
Threats:
Smokeloader
Trojan/win.generic.r533564
Raccoon_stealer
Ransomware/win.extensions.c5314354
Beamwinhttp_loader
Industry:
Financial
Geo:
Uzbekistan, Russia, Azerbaijan, Belarus, Tajikistan, Armenia, Ukraine, Kazakhstan, Syria, Kyrgyzstan
IOCs:
File: 7
Path: 6
Registry: 1
Hash: 7
Url: 3
Softs:
task scheduler
Languages:
php
Platforms:
intel, x86
08-12-2022
STOP. Stop ransomware domestic distribution
https://asec.ahnlab.com/ko/43680
Threats:
Smokeloader
Trojan/win.generic.r533564
Raccoon_stealer
Ransomware/win.extensions.c5314354
Beamwinhttp_loader
Industry:
Financial
Geo:
Uzbekistan, Russia, Azerbaijan, Belarus, Tajikistan, Armenia, Ukraine, Kazakhstan, Syria, Kyrgyzstan
IOCs:
File: 7
Path: 6
Registry: 1
Hash: 7
Url: 3
Softs:
task scheduler
Languages:
php
Platforms:
intel, x86
ASEC BLOG
STOP 랜섬웨어 국내 유포 중 - ASEC BLOG
ASEC 분석팀은 STOP 랜섬웨어가 국내에 유포되고 있음을 확인하였다. 해당 랜섬웨어는 ASEC 주간 악성코드 통계 (20221128 ~ 20221204)에서 Top3를 차지하고 있을 정도로 다수 유포되고 있다. 최근 유포되는 파일은 SmokeLoader, Vidar와 같이 MalPe 외형을 지니는 것이 특징이다. STOP 랜섬웨어는 실행 시 먼저 hxxps://api.2ip.ua/geo.json에 접속하여 country code를 확인한다. 아래에…
#ParsedReport
08-12-2022
Multiple Indian Entities Targeted by the Khalifah Cyber Crew Under the #OpsBantaiKaw2 Campaign
https://cloudsek.com/threatintelligence/multiple-indian-entities-targeted-by-the-khalifah-cyber-crew-under-the-opsbantaikaw2-campaign/
Actors/Campaigns:
Khalifah_cybercrew
Opsbantaikaw
Geo:
Indian
08-12-2022
Multiple Indian Entities Targeted by the Khalifah Cyber Crew Under the #OpsBantaiKaw2 Campaign
https://cloudsek.com/threatintelligence/multiple-indian-entities-targeted-by-the-khalifah-cyber-crew-under-the-opsbantaikaw2-campaign/
Actors/Campaigns:
Khalifah_cybercrew
Opsbantaikaw
Geo:
Indian
Cloudsek
Multiple Indian Entities Targeted by the Khalifah Cyber Crew Under the #OpsBantaiKaw2 Campaign | Threat Intelligence | CloudSEK
CloudSEK’s contextual AI digital risk platform XVigil discovered a tweet by the threat group “Khalifah Cyber Crew” announcing a new campaign “OpsBantaiKaw2” for targeting Indian websites.
#ParsedReport
08-12-2022
Lazarus group uses fake cryptocurrency apps to plant AppleJeus malware
https://www.malwarebytes.com/blog/news/2022/12/lazarus-group-uses-fake-cryptocurrency-apps-to-plant-applejeus-malware
Actors/Campaigns:
Lazarus
Threats:
Applejeus
Dll_sideloading_technique
Industry:
Government, Financial
Geo:
Korean
IOCs:
Domain: 6
File: 4
Path: 4
Softs:
microsoft office, qtbitcointrader
Functions:
OpenDrive
Links:
08-12-2022
Lazarus group uses fake cryptocurrency apps to plant AppleJeus malware
https://www.malwarebytes.com/blog/news/2022/12/lazarus-group-uses-fake-cryptocurrency-apps-to-plant-applejeus-malware
Actors/Campaigns:
Lazarus
Threats:
Applejeus
Dll_sideloading_technique
Industry:
Government, Financial
Geo:
Korean
IOCs:
Domain: 6
File: 4
Path: 4
Softs:
microsoft office, qtbitcointrader
Functions:
OpenDrive
Links:
https://github.com/JulyIGHOR/QtBitcoinTraderMalwarebytes
Lazarus group uses fake cryptocurrency apps to plant AppleJeus malware
Researchers have found a new Lazarus campaign, once again targeting cryptocurrency users and organizations by deploying a fake website and malicious documents.
#ParsedReport
08-12-2022
SpiderLabs Blog. Trojanized OneNote Document Leads to Formbook Malware
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware
Threats:
Formbook
IOCs:
File: 2
Domain: 1
Hash: 3
Softs:
onenote
08-12-2022
SpiderLabs Blog. Trojanized OneNote Document Leads to Formbook Malware
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware
Threats:
Formbook
IOCs:
File: 2
Domain: 1
Hash: 3
Softs:
onenote
Trustwave
Trojanized OneNote Document Leads to Formbook Malware | Trustwave
Cybercriminals have long used Microsoft documents to pass along malware and they are always experimenting with new ways to deliver malicious packages. As defenders, Trustwave SpiderLabs’ researchers are always looking out for new or unusual file types, and…
#ParsedReport
08-12-2022
APT-C-56. 1. Analysis of attack activities
https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w
Actors/Campaigns:
Transparenttribe
Comment_crew
Manling_flower
Threats:
Spynote_rat
Sonicspy
Ahmyth_rat
Metasploit_tool
Asyncrat_rat
Beacon
Industry:
Government
Geo:
Syrian, Pakistan, Pakistani, Asia
IOCs:
File: 6
Hash: 23
Softs:
android
08-12-2022
APT-C-56. 1. Analysis of attack activities
https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w
Actors/Campaigns:
Transparenttribe
Comment_crew
Manling_flower
Threats:
Spynote_rat
Sonicspy
Ahmyth_rat
Metasploit_tool
Asyncrat_rat
Beacon
Industry:
Government
Geo:
Syrian, Pakistan, Pakistani, Asia
IOCs:
File: 6
Hash: 23
Softs:
android
Weixin Official Accounts Platform
疑似APT-C-56（透明部落）针对恐怖主义的攻击活动分析
360烽火实验发现了一批疑似APT-C-56（透明部落）针对恐怖主义发起攻击的恶意样本，通过溯源关联分析发现，攻击活动至少开始于2018年6月，至今仍处于活跃状态
#ParsedReport
08-12-2022
Breach Prevention Blog. New Babuk Ransomware Found in Major Attack
https://blog.morphisec.com/babuk-ransomware-variant-major-attack
Actors/Campaigns:
Blackmatter
Threats:
Babuk
Wannaren
Dll_sideloading_technique
Uac_bypass_technique
Reflectiveloader
Conti
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 33
Path: 2
Softs:
dbsnmp, onenote, powerpnt, encsvc, thebat, wordpad, event tracing for windows
08-12-2022
Breach Prevention Blog. New Babuk Ransomware Found in Major Attack
https://blog.morphisec.com/babuk-ransomware-variant-major-attack
Actors/Campaigns:
Blackmatter
Threats:
Babuk
Wannaren
Dll_sideloading_technique
Uac_bypass_technique
Reflectiveloader
Conti
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 33
Path: 2
Softs:
dbsnmp, onenote, powerpnt, encsvc, thebat, wordpad, event tracing for windows
Morphisec
Babuk Ransomware Variant in Major New Attack
Previously unseen variant of Babuk ransomware strikes multibillion-dollar manufacturing company.
#ParsedReport
08-12-2022
Mallox Ransomware showing signs of Increased Activity. IoCs
https://blog.cyble.com/2022/12/08/mallox-ransomware-showing-signs-of-increased-activity
Threats:
Mallox
Snake_keylogger
Agent_tesla
Remcos_rat
Intellilock_tool
Gozi
Industry:
Financial
Geo:
Georgia, Australia, Singapore, India, Dubai
TTPs:
Tactics: 6
Technics: 8
IOCs:
Url: 2
File: 4
Hash: 12
Softs:
microsoft sql, mssql, postgresql, microsoft exchange server, wamp, nginx, jenkins, redis, kingdee, virtualbox, have more...
Algorithms:
aes
Functions:
InvokeMember
08-12-2022
Mallox Ransomware showing signs of Increased Activity. IoCs
https://blog.cyble.com/2022/12/08/mallox-ransomware-showing-signs-of-increased-activity
Threats:
Mallox
Snake_keylogger
Agent_tesla
Remcos_rat
Intellilock_tool
Gozi
Industry:
Financial
Geo:
Georgia, Australia, Singapore, India, Dubai
TTPs:
Tactics: 6
Technics: 8
IOCs:
Url: 2
File: 4
Hash: 12
Softs:
microsoft sql, mssql, postgresql, microsoft exchange server, wamp, nginx, jenkins, redis, kingdee, virtualbox, have more...
Algorithms:
aes
Functions:
InvokeMember
Cyble
Mallox Ransomware showing signs of Increased Activity
Cyble Research & Intelligence Labs analyzes a surge in activity from the Mallox Ransomware group and details how it operates in this analysis.
#ParsedReport
08-12-2022
(Operation EvilPlane) : APT by 4 2022. 12. 7. 13:41. Text title Operation Evilplane: APT attack using files containing personal information of domestic usersMalware Analysis Report
https://blog.alyac.co.kr/5009
Actors/Campaigns:
Evilplane
Threats:
Uac_bypass_technique
Konni
Vidar_stealer
Geo:
Korean
IOCs:
File: 6
Algorithms:
zip
08-12-2022
(Operation EvilPlane) : APT by 4 2022. 12. 7. 13:41. Text title Operation Evilplane: APT attack using files containing personal information of domestic usersMalware Analysis Report
https://blog.alyac.co.kr/5009
Actors/Campaigns:
Evilplane
Threats:
Uac_bypass_technique
Konni
Vidar_stealer
Geo:
Korean
IOCs:
File: 6
Algorithms:
zip
이스트시큐리티 알약 블로그
오퍼레이션 이블플레인(Operation EvilPlane) : 국내 이용자의 개인정보가 담긴 파일을 이용한 APT 공격
안녕하세요? 이스트시큐리티 시큐리티대응센터(이하 ESRC)입니다. 국내 이용자의 개인정보가 담긴 파일을 이용한 APT 공격이 발견되어 사용자들의 각별하나 주의가 필요합니다. 이번에 발견된 공격 파일은 문서(docx) 파일로, 최근 공격자들이 자주 사용하는 원격 템플릿 주입(Remote Template Injection) 기술을 사용하였습니다. 해당 문서 파일은 ‘Paypal’ 이름의 계정에서 22년 12월 6일 19시 26분경 수정된 것으로 확인되며,…
#ParsedReport
08-12-2022
Internet Explorer 0-day exploited by North Korean actor APT37
https://blog.google/threat-analysis-group/internet-explorer-0-day-exploited-by-north-korean-actor-apt37
Actors/Campaigns:
Apt37 (motivation: government_sponsored)
Threats:
Rtf_template_inject_technique
Rokrat_rat
Bluelight
Dolphin
Geo:
Korea, Korean
CVEs:
CVE-2017-0199 [Vulners]
Vulners: Score: 9.3, CVSS: 7.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows server 2008 (r2, *)
- microsoft windows server 2012 (-)
- microsoft windows vista (*)
- microsoft office (2010, 2013, 2016, 2007)
- microsoft windows 7 (*)
have more...
CVE-2021-34480 [Vulners]
Vulners: Score: 6.8, CVSS: 2.4,
Vulners: Exploitation: Unknown
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows 10 (-, 20h2, 21h1, 1607, 1809, 1909, 2004)
- microsoft windows 7 (-)
- microsoft windows 8.1 (-)
- microsoft windows rt 8.1 (-)
- microsoft windows server 2008 (r2)
have more...
CVE-2022-41128 [Vulners]
Vulners: Score: Unknown, CVSS: 2.5,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows server 2008 (r2)
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 21h1, 21h2, 22h2, 1809)
- microsoft windows 8.1 (-, -)
- microsoft windows server 2016 (-)
have more...
IOCs:
File: 1
Hash: 6
Domain: 5
Softs:
internet explorer, microsoft office
Languages:
javascript, jscript
08-12-2022
Internet Explorer 0-day exploited by North Korean actor APT37
https://blog.google/threat-analysis-group/internet-explorer-0-day-exploited-by-north-korean-actor-apt37
Actors/Campaigns:
Apt37 (motivation: government_sponsored)
Threats:
Rtf_template_inject_technique
Rokrat_rat
Bluelight
Dolphin
Geo:
Korea, Korean
CVEs:
CVE-2017-0199 [Vulners]
Vulners: Score: 9.3, CVSS: 7.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows server 2008 (r2, *)
- microsoft windows server 2012 (-)
- microsoft windows vista (*)
- microsoft office (2010, 2013, 2016, 2007)
- microsoft windows 7 (*)
have more...
CVE-2021-34480 [Vulners]
Vulners: Score: 6.8, CVSS: 2.4,
Vulners: Exploitation: Unknown
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows 10 (-, 20h2, 21h1, 1607, 1809, 1909, 2004)
- microsoft windows 7 (-)
- microsoft windows 8.1 (-)
- microsoft windows rt 8.1 (-)
- microsoft windows server 2008 (r2)
have more...
CVE-2022-41128 [Vulners]
Vulners: Score: Unknown, CVSS: 2.5,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows server 2008 (r2)
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 21h1, 21h2, 22h2, 1809)
- microsoft windows 8.1 (-, -)
- microsoft windows server 2016 (-)
have more...
IOCs:
File: 1
Hash: 6
Domain: 5
Softs:
internet explorer, microsoft office
Languages:
javascript, jscript
Google
Internet Explorer 0-day exploited by North Korean actor APT37
Google’s Threat Analysis Group describes a new 0-day vulnerability attributed to North Korean government-backed actors known as APT37.
#ParsedReport
08-12-2022
Fantasy a new Agrius wiper deployed through a supplychain attack
https://www.welivesecurity.com/2022/12/07/fantasy-new-agrius-wiper-supply-chain-attack
Actor/Campaign:
Agrius
Threats:
Fantasywiper
Apostle
Credential_harvesting_technique
Minidump_tool
Mimikatz_tool
Secretsdump_tool
Killdisk
Lsass_dumper_tool
Impacket_tool
Timestomp_technique
Stop_ransomware
Industry:
Petroleum, Financial
Geo:
Iran, Emirates, Ukraine, African, Israel, Israeli, Africa
TTPs:
Tactics: 9
Technics: 15
IOCs:
Path: 5
File: 4
Registry: 3
Hash: 7
Softs:
psexec
Algorithms:
base64, zip, des
Functions:
SetLastAccessTimeUtc, GetSubDirectoryFileListRecursive
Win API:
SeShutdownPrivilege
Languages:
php, java, lua, python
Links:
08-12-2022
Fantasy a new Agrius wiper deployed through a supplychain attack
https://www.welivesecurity.com/2022/12/07/fantasy-new-agrius-wiper-supply-chain-attack
Actor/Campaign:
Agrius
Threats:
Fantasywiper
Apostle
Credential_harvesting_technique
Minidump_tool
Mimikatz_tool
Secretsdump_tool
Killdisk
Lsass_dumper_tool
Impacket_tool
Timestomp_technique
Stop_ransomware
Industry:
Petroleum, Financial
Geo:
Iran, Emirates, Ukraine, African, Israel, Israeli, Africa
TTPs:
Tactics: 9
Technics: 15
IOCs:
Path: 5
File: 4
Registry: 3
Hash: 7
Softs:
psexec
Algorithms:
base64, zip, des
Functions:
SetLastAccessTimeUtc, GetSubDirectoryFileListRecursive
Win API:
SeShutdownPrivilege
Languages:
php, java, lua, python
Links:
https://github.com/cube0x0/MiniDump
https://github.com/bb00/zer0dump/blob/master/secretsdump.pyWeLiveSecurity
Fantasy – a new Agrius wiper deployed through a supply‑chain attack
ESET researchers analyzed a supply-chain attack abusing an Israeli software developer to deploy Fantasy, Agrius’s new wiper.
#ParsedReport
08-12-2022
CISA and the FBI issue alert about Cuba ransomware
https://www.malwarebytes.com/blog/news/2022/12/cisa-and-fbi-issue-alert-about-cuba-ransomware
Threats:
Cuba
Stop_ransomware
Romcom_rat
Hancitor
Industry:
Financial, Government, Healthcare
Geo:
Ukraine, California, Russian
Softs:
psexec
08-12-2022
CISA and the FBI issue alert about Cuba ransomware
https://www.malwarebytes.com/blog/news/2022/12/cisa-and-fbi-issue-alert-about-cuba-ransomware
Threats:
Cuba
Stop_ransomware
Romcom_rat
Hancitor
Industry:
Financial, Government, Healthcare
Geo:
Ukraine, California, Russian
Softs:
psexec
Malwarebytes
CISA and the FBI issue alert about Cuba ransomware
Cuba ransomware is spotlighted in a recent cybersecurity advisory (CSA) in the ongoing #StopRansomware campaign spearheaded by CISA and the FBI.
#ParsedReport
08-12-2022
SMS scams trick Indian banking customers into installing malicious apps. Indicators of Compromise (IOC)
https://www.zscaler.com/blogs/security-research/sms-scams-trick-indian-banking-customers-installing-malicious-apps
Industry:
Financial
Geo:
Indian
IOCs:
Url: 20
Hash: 10
08-12-2022
SMS scams trick Indian banking customers into installing malicious apps. Indicators of Compromise (IOC)
https://www.zscaler.com/blogs/security-research/sms-scams-trick-indian-banking-customers-installing-malicious-apps
Industry:
Financial
Geo:
Indian
IOCs:
Url: 20
Hash: 10
Zscaler
Indian Banking Customers Fall for SMS Scams | Zscaler Blog
Indian banking customers are being targeted with fake complaint forms from phishing sites spreading info stealers with phony banking apps via SMS scams.
#ParsedReport
09-12-2022
New MuddyWater Threat: Old Kitten; New Tricks
https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks
Actors/Campaigns:
Muddywater (motivation: cyber_espionage)
Luna_moth
Threats:
Remoteutilities_tool
Screenconnect_tool
Atera_tool
Syncro_tool
Batloader
Luna
Industry:
Telco, Healthcare, Government, Aerospace, Petroleum
Geo:
America, Jordan, Emirates, Israeli, Asia, Israel, Africa, Syrian, Armenia, Oman, Azerbaijan, Tajikistan, Iran, Egypt, Qatar, Iraq
TTPs:
Tactics: 3
Technics: 5
IOCs:
File: 2
Hash: 36
Algorithms:
zip, exhibit
09-12-2022
New MuddyWater Threat: Old Kitten; New Tricks
https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks
Actors/Campaigns:
Muddywater (motivation: cyber_espionage)
Luna_moth
Threats:
Remoteutilities_tool
Screenconnect_tool
Atera_tool
Syncro_tool
Batloader
Luna
Industry:
Telco, Healthcare, Government, Aerospace, Petroleum
Geo:
America, Jordan, Emirates, Israeli, Asia, Israel, Africa, Syrian, Armenia, Oman, Azerbaijan, Tajikistan, Iran, Egypt, Qatar, Iraq
TTPs:
Tactics: 3
Technics: 5
IOCs:
File: 2
Hash: 36
Algorithms:
zip, exhibit
Deep Instinct
New MuddyWater Threat: Old Kitten; New Tricks | Deep Instinct
MuddyWater, also known as Static Kitten and Mercury, is a cyber espionage group that’s most likely a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).
#ParsedReport
09-12-2022
Cloud Atlas targets entities in Russia and Belarus amid the ongoing war in Ukraine. Introduction
https://research.checkpoint.com/2022/cloud-atlas-targets-entities-in-russia-and-belarus-amid-the-ongoing-war-in-ukraine
Actors/Campaigns:
Cloudatlas (motivation: cyber_espionage)
Threats:
Powershower
Rtcpproxy_tool
Lockbit
Ntdsutil_tool
Anydesk_tool
Putty_tool
Industry:
Education, Energy, Financial, Transport, Government
Geo:
Russia, Russian, Belarus, Belarusian, Moldova, Asia, Ukraine
CVEs:
CVE-2018-0802 [Vulners]
Vulners: Score: 9.3, CVSS: 3.5,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft office (2007, 2013, 2016, 2010, 2016)
- microsoft word (2013, 2007, 2010, 2013, 2016)
- microsoft office compatibility pack (-)
CVE-2017-11882 [Vulners]
Vulners: Score: 9.3, CVSS: 4.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft office (2013, 2010, 2016, 2007)
IOCs:
IP: 1
Registry: 1
File: 2
Softs:
microsoft office, squid, telegram
Algorithms:
aes-256, base64, xor, zip
Functions:
WriteAllBytes, ReadAllText, ReadBytes, OpenDrive
Win API:
Decompress
Languages:
python
09-12-2022
Cloud Atlas targets entities in Russia and Belarus amid the ongoing war in Ukraine. Introduction
https://research.checkpoint.com/2022/cloud-atlas-targets-entities-in-russia-and-belarus-amid-the-ongoing-war-in-ukraine
Actors/Campaigns:
Cloudatlas (motivation: cyber_espionage)
Threats:
Powershower
Rtcpproxy_tool
Lockbit
Ntdsutil_tool
Anydesk_tool
Putty_tool
Industry:
Education, Energy, Financial, Transport, Government
Geo:
Russia, Russian, Belarus, Belarusian, Moldova, Asia, Ukraine
CVEs:
CVE-2018-0802 [Vulners]
Vulners: Score: 9.3, CVSS: 3.5,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft office (2007, 2013, 2016, 2010, 2016)
- microsoft word (2013, 2007, 2010, 2013, 2016)
- microsoft office compatibility pack (-)
CVE-2017-11882 [Vulners]
Vulners: Score: 9.3, CVSS: 4.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft office (2013, 2010, 2016, 2007)
IOCs:
IP: 1
Registry: 1
File: 2
Softs:
microsoft office, squid, telegram
Algorithms:
aes-256, base64, xor, zip
Functions:
WriteAllBytes, ReadAllText, ReadBytes, OpenDrive
Win API:
Decompress
Languages:
python
Check Point Research
Cloud Atlas targets entities in Russia and Belarus amid the ongoing war in Ukraine - Check Point Research
Introduction Cloud Atlas (or Inception) is a cyber-espionage group. Since its discovery in 2014, they have launched multiple, highly targeted attacks on critical infrastructure across geographical zones and political conflicts. The group’s tactics, techniques…
#ParsedReport
09-12-2022
APT Cloud Atlas: Unbroken Threat
https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/apt-cloud-atlas-unbroken-threat
Actors/Campaigns:
Cloudatlas (motivation: cyber_espionage)
Gamaredon
Bitter
Threats:
Powershower
Trojan.win32.generic.a
Trojan.win32.reglolbins.a
Industry:
Government, Financial
Geo:
Belarus, Slovenia, Russia, Azerbaijan, Russian, Turkey, Iranian, Tajikistan
CVEs:
CVE-2017-11882 [Vulners]
Vulners: Score: 9.3, CVSS: 4.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft office (2013, 2010, 2016, 2007)
TTPs:
Tactics: 7
Technics: 20
IOCs:
File: 12
Hash: 16
Softs:
microsoft office, component object model
Algorithms:
aes-cbc, aes, base64, lzma, xor, cbc
Win API:
GetLocalTime, GetUserDefaultLCID, GetSystemDefaultLCID
Languages:
visual_basic
YARA: Found
09-12-2022
APT Cloud Atlas: Unbroken Threat
https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/apt-cloud-atlas-unbroken-threat
Actors/Campaigns:
Cloudatlas (motivation: cyber_espionage)
Gamaredon
Bitter
Threats:
Powershower
Trojan.win32.generic.a
Trojan.win32.reglolbins.a
Industry:
Government, Financial
Geo:
Belarus, Slovenia, Russia, Azerbaijan, Russian, Turkey, Iranian, Tajikistan
CVEs:
CVE-2017-11882 [Vulners]
Vulners: Score: 9.3, CVSS: 4.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft office (2013, 2010, 2016, 2007)
TTPs:
Tactics: 7
Technics: 20
IOCs:
File: 12
Hash: 16
Softs:
microsoft office, component object model
Algorithms:
aes-cbc, aes, base64, lzma, xor, cbc
Win API:
GetLocalTime, GetUserDefaultLCID, GetSystemDefaultLCID
Languages:
visual_basic
YARA: Found
ptsecurity.com
Блог PT ESC Threat Intelligence
В этом блоге вы можете найти информацию об актуальных атаках хакерских группировок по всему миру, разбор их инструментов, информацию об инцидентах, TTP группировок, индикаторы компрометации и названия детектов в наших продуктах
#ParsedReport
09-12-2022
Supply Chain Attack via New Malicious Python Package, shaderz (Part 1)
https://www.fortinet.com/blog/threat-research/supply-chain-attack-new-malicious-python-package-shaderz
IOCs:
Url: 1
Hash: 2
File: 2
Languages:
python
09-12-2022
Supply Chain Attack via New Malicious Python Package, shaderz (Part 1)
https://www.fortinet.com/blog/threat-research/supply-chain-attack-new-malicious-python-package-shaderz
IOCs:
Url: 1
Hash: 2
File: 2
Languages:
python
Fortinet Blog
Supply Chain Attack via New Malicious Python Package, “shaderz” (Part 1)
FortiGuard Labs recently discovered a 0-day attack in a PyPI package called “shaderz.” Read our blog to learn about the executable file and how to protect against the attack.…