#ParsedReport
08-12-2022

Breach Prevention Blog. New Babuk Ransomware Found in Major Attack

https://blog.morphisec.com/babuk-ransomware-variant-major-attack

Actors/Campaigns:
Blackmatter

Threats:
Babuk
Wannaren
Dll_sideloading_technique
Uac_bypass_technique
Reflectiveloader
Conti

TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 33
Path: 2

Softs:
dbsnmp, onenote, powerpnt, encsvc, thebat, wordpad, event tracing for windows

#ParsedReport
08-12-2022

Mallox Ransomware showing signs of Increased Activity. IoCs

https://blog.cyble.com/2022/12/08/mallox-ransomware-showing-signs-of-increased-activity

Threats:
Mallox
Snake_keylogger
Agent_tesla
Remcos_rat
Intellilock_tool
Gozi

Industry:
Financial

Geo:
Georgia, Australia, Singapore, India, Dubai

TTPs:
Tactics: 6
Technics: 8

IOCs:
Url: 2
File: 4
Hash: 12

Softs:
microsoft sql, mssql, postgresql, microsoft exchange server, wamp, nginx, jenkins, redis, kingdee, virtualbox, have more...

Algorithms:
aes

Functions:
InvokeMember

#ParsedReport
08-12-2022

(Operation EvilPlane) : APT by 4 2022. 12. 7. 13:41. Text title Operation Evilplane: APT attack using files containing personal information of domestic usersMalware Analysis Report

https://blog.alyac.co.kr/5009

Actors/Campaigns:
Evilplane

Threats:
Uac_bypass_technique
Konni
Vidar_stealer

Geo:
Korean

IOCs:
File: 6

Algorithms:
zip

#ParsedReport
08-12-2022

Internet Explorer 0-day exploited by North Korean actor APT37

https://blog.google/threat-analysis-group/internet-explorer-0-day-exploited-by-north-korean-actor-apt37

Actors/Campaigns:
Apt37 (motivation: government_sponsored)

Threats:
Rtf_template_inject_technique
Rokrat_rat
Bluelight
Dolphin

Geo:
Korea, Korean

CVEs:
CVE-2017-0199 [Vulners]
Vulners: Score: 9.3, CVSS: 7.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows server 2008 (r2, *)
- microsoft windows server 2012 (-)
- microsoft windows vista (*)
- microsoft office (2010, 2013, 2016, 2007)
- microsoft windows 7 (*)
have more...
CVE-2021-34480 [Vulners]
Vulners: Score: 6.8, CVSS: 2.4,
Vulners: Exploitation: Unknown
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows 10 (-, 20h2, 21h1, 1607, 1809, 1909, 2004)
- microsoft windows 7 (-)
- microsoft windows 8.1 (-)
- microsoft windows rt 8.1 (-)
- microsoft windows server 2008 (r2)
have more...
CVE-2022-41128 [Vulners]
Vulners: Score: Unknown, CVSS: 2.5,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft windows server 2008 (r2)
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 21h1, 21h2, 22h2, 1809)
- microsoft windows 8.1 (-, -)
- microsoft windows server 2016 (-)
have more...

IOCs:
File: 1
Hash: 6
Domain: 5

Softs:
internet explorer, microsoft office

Languages:
javascript, jscript

#ParsedReport
08-12-2022

Fantasy a new Agrius wiper deployed through a supplychain attack

https://www.welivesecurity.com/2022/12/07/fantasy-new-agrius-wiper-supply-chain-attack

Actor/Campaign:
Agrius

Threats:
Fantasywiper
Apostle
Credential_harvesting_technique
Minidump_tool
Mimikatz_tool
Secretsdump_tool
Killdisk
Lsass_dumper_tool
Impacket_tool
Timestomp_technique
Stop_ransomware

Industry:
Petroleum, Financial

Geo:
Iran, Emirates, Ukraine, African, Israel, Israeli, Africa

TTPs:
Tactics: 9
Technics: 15

IOCs:
Path: 5
File: 4
Registry: 3
Hash: 7

Softs:
psexec

Algorithms:
base64, zip, des

Functions:
SetLastAccessTimeUtc, GetSubDirectoryFileListRecursive

Win API:
SeShutdownPrivilege

Languages:
php, java, lua, python

Links:
https://github.com/cube0x0/MiniDump
https://github.com/bb00/zer0dump/blob/master/secretsdump.py

#ParsedReport
08-12-2022

CISA and the FBI issue alert about Cuba ransomware

https://www.malwarebytes.com/blog/news/2022/12/cisa-and-fbi-issue-alert-about-cuba-ransomware

Threats:
Cuba
Stop_ransomware
Romcom_rat
Hancitor

Industry:
Financial, Government, Healthcare

Geo:
Ukraine, California, Russian

Softs:
psexec

#ParsedReport
08-12-2022

SMS scams trick Indian banking customers into installing malicious apps. Indicators of Compromise (IOC)

https://www.zscaler.com/blogs/security-research/sms-scams-trick-indian-banking-customers-installing-malicious-apps

Industry:
Financial

Geo:
Indian

IOCs:
Url: 20
Hash: 10

#ParsedReport
09-12-2022

New MuddyWater Threat: Old Kitten; New Tricks

https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks

Actors/Campaigns:
Muddywater (motivation: cyber_espionage)
Luna_moth

Threats:
Remoteutilities_tool
Screenconnect_tool
Atera_tool
Syncro_tool
Batloader
Luna

Industry:
Telco, Healthcare, Government, Aerospace, Petroleum

Geo:
America, Jordan, Emirates, Israeli, Asia, Israel, Africa, Syrian, Armenia, Oman, Azerbaijan, Tajikistan, Iran, Egypt, Qatar, Iraq

TTPs:
Tactics: 3
Technics: 5

IOCs:
File: 2
Hash: 36

Algorithms:
zip, exhibit

#ParsedReport
09-12-2022

Cloud Atlas targets entities in Russia and Belarus amid the ongoing war in Ukraine. Introduction

https://research.checkpoint.com/2022/cloud-atlas-targets-entities-in-russia-and-belarus-amid-the-ongoing-war-in-ukraine

Actors/Campaigns:
Cloudatlas (motivation: cyber_espionage)

Threats:
Powershower
Rtcpproxy_tool
Lockbit
Ntdsutil_tool
Anydesk_tool
Putty_tool

Industry:
Education, Energy, Financial, Transport, Government

Geo:
Russia, Russian, Belarus, Belarusian, Moldova, Asia, Ukraine

CVEs:
CVE-2018-0802 [Vulners]
Vulners: Score: 9.3, CVSS: 3.5,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft office (2007, 2013, 2016, 2010, 2016)
- microsoft word (2013, 2007, 2010, 2013, 2016)
- microsoft office compatibility pack (-)

CVE-2017-11882 [Vulners]
Vulners: Score: 9.3, CVSS: 4.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft office (2013, 2010, 2016, 2007)


IOCs:
IP: 1
Registry: 1
File: 2

Softs:
microsoft office, squid, telegram

Algorithms:
aes-256, base64, xor, zip

Functions:
WriteAllBytes, ReadAllText, ReadBytes, OpenDrive

Win API:
Decompress

Languages:
python

#ParsedReport
09-12-2022

APT Cloud Atlas: Unbroken Threat

https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/apt-cloud-atlas-unbroken-threat

Actors/Campaigns:
Cloudatlas (motivation: cyber_espionage)
Gamaredon
Bitter

Threats:
Powershower
Trojan.win32.generic.a
Trojan.win32.reglolbins.a

Industry:
Government, Financial

Geo:
Belarus, Slovenia, Russia, Azerbaijan, Russian, Turkey, Iranian, Tajikistan

CVEs:
CVE-2017-11882 [Vulners]
Vulners: Score: 9.3, CVSS: 4.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft office (2013, 2010, 2016, 2007)


TTPs:
Tactics: 7
Technics: 20

IOCs:
File: 12
Hash: 16

Softs:
microsoft office, component object model

Algorithms:
aes-cbc, aes, base64, lzma, xor, cbc

Win API:
GetLocalTime, GetUserDefaultLCID, GetSystemDefaultLCID

Languages:
visual_basic

YARA: Found

#ParsedReport
09-12-2022

Supply Chain Attack via New Malicious Python Package, shaderz (Part 1)

https://www.fortinet.com/blog/threat-research/supply-chain-attack-new-malicious-python-package-shaderz

IOCs:
Url: 1
Hash: 2
File: 2

Languages:
python

#ParsedReport
09-12-2022

Threat Actors Targeting Fans Amid FIFA World Cup Fever

https://blog.cyble.com/2022/12/09/threat-actors-targeting-fans-amid-fifa-world-cup-fever

Threats:
Redline_stealer
Beacon
Process_injection_technique
Process_hollowing_technique

Geo:
Australia, Qatar, Georgia, India, Dubai, Singapore

TTPs:
Tactics: 7
Technics: 20

IOCs:
Domain: 2
Url: 4
File: 2
Hash: 2

Softs:
android

#ParsedReport
09-12-2022

Ransomware Roundup New Vohuk, ScareCrow, and AERST Variants

https://www.fortinet.com/blog/threat-research/ransomware-roundup-new-vohuk-scarecrow-and-aerst-variants

Threats:
Vohuk
Scarecrow
Aerst
Conti
W32/ransom.fywdocb!tr
W32/filecoder.oke!tr.ransom
W32/filecoder.rth!tr.ransom
W32/filecoder.ace!tr.ransom

Industry:
Financial

Geo:
Philippines, Germany, India, Italy, Russia

IOCs:
File: 1
Hash: 8

Softs:
telegram

Algorithms:
chacha20

Интеграция с IBM Exchange для получения инфы о CVE пока отъехала. Буду чинить :(

#ParsedReport
09-12-2022

: MaaS- BlueFox. Fear the blue foxes: analysis of the new Bluefox Maas Styler

https://habr.com/ru/company/pt/blog/704174

Threats:
Bluefox_stealer
Redline_stealer
Raccoon_stealer
Vidar_stealer

IOCs:
File: 8
Command: 1
Hash: 5
IP: 9

Softs:
telegram

Algorithms:
aes

Links:
https://github.com/glmcdona/Process-Dump/blob/main/README.md
https://github.com/SychicBoy/NETReactorSlayer

#technique

Precious Gemstones: The New Generation of Kerberos Attacks

https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks/

#technique

Vulpes: Obfuscating Memory Regions with Timers

https://mez0.cc/posts/vulpes-obfuscating-memory-regions/

#technique

StealthHook - A method for hooking a function without modifying memory protection

https://www.x86matthew.com/view_post?id=stealth_hook

#technique

{JS-ON: Security-OFF}: Abusing JSON-Based SQL to Bypass WAF

https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf

#technique

A BOF to determine Windows Defender exclusions.

https://github.com/EspressoCake/Defender_Exclusions-BOF

#ParsedReport
12-12-2022

Pulling the Curtains on Azov Ransomware: Not a Skidsware but Polymorphic Wiper. Highlights:

https://research.checkpoint.com/2022/pulling-the-curtains-on-azov-ransomware-not-a-skidsware-but-polymorphic-wiper

Threats:
Azov
Smokeloader
Junk_code_technique

Geo:
Ukraine

IOCs:
File: 4
Hash: 2

Algorithms:
xor

Functions:
FindGetProcAddress, start_0, AllocAndDecryptShellcode, TryToBackdoorExeFile, BackdoorExeFile

Languages:
python

YARA: Found