#ParsedReport
09-12-2022

Supply Chain Attack via New Malicious Python Package, shaderz (Part 1)

https://www.fortinet.com/blog/threat-research/supply-chain-attack-new-malicious-python-package-shaderz

IOCs:
Url: 1
Hash: 2
File: 2

Languages:
python

#ParsedReport
09-12-2022

Threat Actors Targeting Fans Amid FIFA World Cup Fever

https://blog.cyble.com/2022/12/09/threat-actors-targeting-fans-amid-fifa-world-cup-fever

Threats:
Redline_stealer
Beacon
Process_injection_technique
Process_hollowing_technique

Geo:
Australia, Qatar, Georgia, India, Dubai, Singapore

TTPs:
Tactics: 7
Technics: 20

IOCs:
Domain: 2
Url: 4
File: 2
Hash: 2

Softs:
android

#ParsedReport
09-12-2022

Ransomware Roundup New Vohuk, ScareCrow, and AERST Variants

https://www.fortinet.com/blog/threat-research/ransomware-roundup-new-vohuk-scarecrow-and-aerst-variants

Threats:
Vohuk
Scarecrow
Aerst
Conti
W32/ransom.fywdocb!tr
W32/filecoder.oke!tr.ransom
W32/filecoder.rth!tr.ransom
W32/filecoder.ace!tr.ransom

Industry:
Financial

Geo:
Philippines, Germany, India, Italy, Russia

IOCs:
File: 1
Hash: 8

Softs:
telegram

Algorithms:
chacha20

Интеграция с IBM Exchange для получения инфы о CVE пока отъехала. Буду чинить :(

#ParsedReport
09-12-2022

: MaaS- BlueFox. Fear the blue foxes: analysis of the new Bluefox Maas Styler

https://habr.com/ru/company/pt/blog/704174

Threats:
Bluefox_stealer
Redline_stealer
Raccoon_stealer
Vidar_stealer

IOCs:
File: 8
Command: 1
Hash: 5
IP: 9

Softs:
telegram

Algorithms:
aes

Links:
https://github.com/glmcdona/Process-Dump/blob/main/README.md
https://github.com/SychicBoy/NETReactorSlayer

#technique

Precious Gemstones: The New Generation of Kerberos Attacks

https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks/

#technique

Vulpes: Obfuscating Memory Regions with Timers

https://mez0.cc/posts/vulpes-obfuscating-memory-regions/

#technique

StealthHook - A method for hooking a function without modifying memory protection

https://www.x86matthew.com/view_post?id=stealth_hook

#technique

{JS-ON: Security-OFF}: Abusing JSON-Based SQL to Bypass WAF

https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf

#technique

A BOF to determine Windows Defender exclusions.

https://github.com/EspressoCake/Defender_Exclusions-BOF

#ParsedReport
12-12-2022

Pulling the Curtains on Azov Ransomware: Not a Skidsware but Polymorphic Wiper. Highlights:

https://research.checkpoint.com/2022/pulling-the-curtains-on-azov-ransomware-not-a-skidsware-but-polymorphic-wiper

Threats:
Azov
Smokeloader
Junk_code_technique

Geo:
Ukraine

IOCs:
File: 4
Hash: 2

Algorithms:
xor

Functions:
FindGetProcAddress, start_0, AllocAndDecryptShellcode, TryToBackdoorExeFile, BackdoorExeFile

Languages:
python

YARA: Found

#ParsedReport
12-12-2022

Dark Web Profile: APT42 Iranian Cyber Espionage Group

https://socradar.io/dark-web-profile-apt42-iranian-cyber-espionage-group

Actors/Campaigns:
Cleaver (motivation: cyber_espionage, cyber_criminal)
Phosphorus (motivation: cyber_espionage)
Tag-56 (motivation: cyber_espionage)
Remix_kitten (motivation: cyber_espionage)
Irgc (motivation: cyber_espionage)

Threats:
Nemesis
Brokeyolk
Pineflower
Stuxnet
Credential_harvesting_technique
Powerpost_tool
Chairsmack
Magicdrop
Silentuploader
Dostealer
Tabbycat
Vinethorn
Vbrevshell
Tamecat

Industry:
Education, Healthcare, Government, Telco

Geo:
Irans, Germany, Iranian, Israeli, Albanian, Australia, Iran

CVEs:
CVE-2018-13379 [Vulners]
Vulners: Score: 5.0, CVSS: 3.2,
Vulners: Exploitation: True
X-Force: Risk: 7.5
X-Force: Patch: Official fix
Soft:
- fortinet fortios (le6.0.4, le5.6.7)


IOCs:
Domain: 5
File: 10
Hash: 9
Url: 28

Softs:
android, telegram

#ParsedReport
12-12-2022

Iranian hacking group uses compromised email accounts to distribute MSP remote access tool

https://www.malwarebytes.com/blog/news/2022/12/iranian-hacking-group-uses-compromised-email-accounts-to-distribute-msp-remote-access-tool

Actors/Campaigns:
Muddywater

Threats:
Msp_remote_tool
Log4shell_vuln
Syncro_tool
Atera_tool
Screenconnect_tool
Remoteutilities_tool

Industry:
Government, Petroleum, Telco

Geo:
Tajikistan, Iraq, Azerbaijan, Egypt, Oman, Qatar, Emirates, Jordan, Iran, Israel, Armenia, Iranian

IOCs:
File: 1

#ParsedReport
12-12-2022

Linux Cryptocurrency Mining Attacks Enhanced via CHAOS RAT. Conclusion

https://www.trendmicro.com/en_us/research/22/l/linux-cryptomining-enhanced-via-chaos-rat-.html

Actors/Campaigns:
Teamtnt

Threats:
Chaos
Kinsing_miner
Xmrig_miner
Malxmr_miner

Geo:
Russia

TTPs:
Tactics: 7
Technics: 0

IOCs:
File: 5
Hash: 6

Softs:
unix task scheduler

Languages:
golang

Links:
https://github.com/tiagorlampert/CHAOS

#ParsedReport
12-12-2022

Amadey Bot Nitol DDoS

https://asec.ahnlab.com/ko/43766

Threats:
Amadey
Nitol
Lockbit
Njrat_rat
Smokeloader
Trojan/win.generic.r539958
Malware/mdp.behavior.m3108

IOCs:
File: 13
Path: 1
Hash: 6
Url: 9
IP: 3
Domain: 1

Softs:
microsoft office, internet explorer

Languages:
csharp

#ParsedReport
12-12-2022

Drokbk Malware Uses GitHub as Dead Drop Resolver

https://www.secureworks.com/blog/drokbk-malware-uses-github-as-dead-drop-resolver

Actors/Campaigns:
Cobalt_mirage (motivation: government_sponsored)
Comment_crew

Threats:
Dead_drop_technique
Mirage
Frpc_tool
Tunnelfish_tool
Log4shell_vuln
Beacon

Industry:
Government

Geo:
Iranian

CVEs:
CVE-2021-44228 [Vulners]
Vulners: Score: 9.3, CVSS: 4.5,
Vulners: Exploitation: True
X-Force: Risk: 10
X-Force: Patch: Official fix
Soft:
- apache log4j (2.0, 2.0, 2.0, 2.0, <2.15.0, <2.3.1, <2.12.2)
- siemens sppa-t3000 ses3000 firmware (*)
- siemens logo\! soft comfort (*)
- siemens spectrum power 4 (4.70, 4.70, <4.70, 4.70)
- siemens siveillance control pro (*)
have more...
CVE-2021-45046 [Vulners]
Vulners: Score: 5.1, CVSS: 1.8,
Vulners: Exploitation: True
X-Force: Risk: 9
X-Force: Patch: Official fix
Soft:
- apache log4j (2.0, 2.0, 2.0, 2.0, <2.12.2, <2.16.0)
- intel oneapi (-)
- intel audio development kit (-)
- intel datacenter manager (-)
- intel system debugger (-)
have more...

IOCs:
File: 1
Path: 8
Hash: 17
IP: 3

Softs:
vmware horizon

Algorithms:
exhibit

Links:
https://github.com/fatedier/frp
https://github.com/dnSpyEx/dnSpy

#ParsedReport
12-12-2022

Magniber Ransomware 12/9 !. Magniber Ransomware 12/9 Distribution Starting Corona related files related to distribution attention!

https://asec.ahnlab.com/ko/42439

Threats:
Magniber
Lockbit
Gandcrab
Revil
Motw_bypass_technique
Uac_bypass_technique

TTPs:
Tactics: 1
Technics: 0

IOCs:
Path: 1
File: 5

Softs:
internet explorer, chrome

#ParsedReport
12-12-2022

Phylum Detects Ongoing Typosquat/Ransomware Campaign in PyPI and NPM

https://blog.phylum.io/phylum-detects-active-typosquatting-campaign-in-pypi

Threats:
Typosquatting_technique

Industry:
Aerospace

IOCs:
File: 1

Languages:
javascript, golang, python

Platforms:
apple

#ParsedReport
12-12-2022

Cisco Talos Intelligence Blog. Breaking the silence - Recent Truebot activity

https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity

Actors/Campaigns:
Ta505
Whisper_spider
Evil_corp

Threats:
Truebot
Flawedgrace_rat
Raspberry_robin
Clop
Teleport_tool
Winrm_tool
Cobalt_strike
Socgholish_loader
Icedid
Bumblebee
Flawedammyy

Industry:
Telco, Education, Financial

Geo:
Mexico, Brazil, Deutsche, Pakistan

CVEs:
CVE-2022-31199 [Vulners]
Vulners: Score: Unknown, CVSS: 4.8,
Vulners: Exploitation: Unknown
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- netwrix auditor (<10.5)


TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 3

Softs:
active directory

Algorithms:
crc-32, aes, cbc

#ParsedReport
12-12-2022

A Custom Python Backdoor for VMWare ESXi Servers

https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers

Threats:
Netcat_tool
Asbit_rat
Tsunami_botnet

CVEs:
CVE-2020-3992 [Vulners]
Vulners: Score: 10.0, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- vmware esxi (6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 7.0.0, 6.5, 6.5, 6.5, 6.7, 6.7, 7.0.0)
- vmware cloud foundation (<4.1, <3.10.1.1)

CVE-2022-30190 [Vulners]
Vulners: Score: 9.3, CVSS: 3.4,
Vulners: Exploitation: True
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 1809, 20h2, 21h1, 21h2)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
- microsoft windows server 2008 (-, r2)
have more...
CVE-2019-5544 [Vulners]
Vulners: Score: 7.5, CVSS: 1.7,
Vulners: Exploitation: True
X-Force: Risk: 9.8
X-Force: Patch: Unavailable
Soft:
- vmware horizon daas (<9.0.0.0)
- vmware esxi (6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.0, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.5, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7, 6.7)
- redhat enterprise linux desktop (7.0)
- redhat enterprise linux server (7.0)
- redhat enterprise linux server aus (7.7)
have more...

TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 6
IP: 1

Softs:
esxi, redis

Algorithms:
base64

Languages:
python

Запилили новый API по данным, что генерит движок парсинга TI-отчетов (разбираем где-то 200-250 отчетов в мес. от 98 источников).

Очень много данных еще остается лежать на диске и не входит ни в одну из наших API (email, registry, coin wallets, commands, код yara|sigma, winapi). Думаю, добавим уже в новую версию API, где данные будут уже в STIX-формате.

Текущая версия API скорее про бюллетени по TI-отчету. Через API можно получить сразу все бюллетени по всем отчетам за выбранные сутки.

Выгляди это вот так.