CTT Report Hub
@aptreports
3.22K subscribers
7.99K photos
6 videos
67 files
11.7K links
Threat Intelligence Report Hub
https://cyberthreat.tech
ООО Технологии киберугроз
Contact: @nikolaiav
Download Telegram
About
Blog
Apps
Platform
Join
CTT Report Hub
3.22K subscribers
CTT Report Hub
#ParsedReport
23-12-2022

New STEPPY#KAVACH Attack Campaign Likely Targeting Indian Government: Technical Insights and Detection Using Securonix

https://www.securonix.com/blog/new-steppykavach-attack-campaign

Actors/Campaigns:
Steppy_kavach
Sidecopy
Transparenttribe

Threats:
Lotl_technique
Lolbin_technique
Lolbas_technique

Industry:
Government

Geo:
Germany, Indian, Pakistan, India, Indias

TTPs:
Tactics: 6
Technics: 12

IOCs:
File: 23
Path: 10
Url: 6
Registry: 2
IP: 6
Domain: 2
Hash: 16

Softs:
net framework

Algorithms:
base64

Functions:
prparingsiej, bndkrknwakro

Win API:
WmiCreateProcess

Languages:
jscript, visual_basic, csharp, javascript
Securonix
New STEPPY#KAVACH Attack Campaign Likely Targeting Indian Government: Technical Insights and Detection Using Securonix
37 viewsedited  
CTT Report Hub
#ParsedReport
23-12-2022

IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

https://www.trendmicro.com/en_us/research/22/l/icedid-botnet-distributors-abuse-google-ppc-to-distribute-malware.html

Threats:
Icedid
Anydesk_tool
Teamviewer_tool
Cobalt_strike

Industry:
Government, Financial

TTPs:
Tactics: 1
Technics: 3

IOCs:
File: 7
Hash: 4
Domain: 68
IP: 1

Softs:
discord, microsoft office, slack, windows installer, curl

Algorithms:
zip

Links:
https://github.com/struppigel/PortEx
Trend Micro
IcedID Botnet Distributors Abuse Google PPC to Distribute Malware
We analyze the latest changes in IcedID botnet from a campaign that abuses Google pay per click (PPC) ads to distribute IcedID via malvertising attacks.
64 views
CTT Report Hub
#ParsedReport
23-12-2022

Threat Brief: OWASSRF Vulnerability Exploitation

https://unit42.paloaltonetworks.com/threat-brief-owassrf

Threats:
Owassrf
Proxynotshell_vuln
Silverarrow
Anydesk_tool
Putty_tool

Industry:
E-commerce

Geo:
Apac, Japan, Emea, America, Japanese

CVEs:
CVE-2022-41080 [Vulners]
Vulners: Score: Unknown, CVSS: 3.4,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2019, 2019, 2016)

CVE-2022-41082 [Vulners]
Vulners: Score: Unknown, CVSS: 2.8,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2019, 2019, 2016)

CVE-2022-41040 [Vulners]
Vulners: Score: Unknown, CVSS: 3.2,
Vulners: Exploitation: True
X-Force: Risk: 6.5
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2019, 2019, 2016)


IOCs:
File: 7
Email: 2
IP: 7
Coin: 1

Softs:
microsoft exchange server, windows remote desktop protocol, microsoft exchange, windows remote desktop

Algorithms:
base64

Languages:
python
Unit 42
Threat Brief: OWASSRF Vulnerability Exploitation
We analyze the new exploit method for Microsoft Exchange Server, OWASSRF, noting that all exploit attempts we've observed use the same PowerShell backdoor, which we track as SilverArrow. Read the details and learn how to mitigate.
105 views
CTT Report Hub
#technique

Elastic IP Hijacking — A New Attack Vector in AWS

https://www.mitiga.io/blog/elastic-ip-hijacking-a-new-attack-vector-in-aws
www.mitiga.io
Elastic IP Hijacking — A New Attack Vector in AWS
Read Mitiga research about a new post-exploitation attack method, a new way that enables adversaries to hijack public IP addresses for malicious purposes.
80 views
CTT Report Hub
#technique

Divide And Bypass: A new Simple Way to Bypass AMSI

https://x4sh3s.github.io/posts/Divide-and-bypass-amsi/
x4sh3s
Divide And Bypass: A new Simple Way to Bypass AMSI
This post is about a new simple way to bypass AMSI (Antimalware Scan Interface), that can be applied on small scripts, specially the popular AMSI bypasses.
76 views
CTT Report Hub
#ParsedReport
23-12-2022

Trade with caution - bad guys arestealing. Trade with caution - bad guys are stealing

https://www.zscaler.com/blog/security-research/trade-with-caution

Threats:
Redline_stealer
Record_breaker_stealer
Arkei_stealer
Vidar_stealer
Legionloader
Batloader
Smokeloader
Minebridge_rat
Dll_sideloading_technique

Industry:
Financial

Geo:
Usa

TTPs:
Tactics: 3
Technics: 14

IOCs:
IP: 2
Domain: 2
Url: 1
Hash: 8
File: 12

Softs:
windows installer, macos, nginx, mozilla firefox, visual studio, windows explorer

Algorithms:
zip

Platforms:
intel
Zscaler
Trade with caution - bad guys are stealing | Zscaler
Fake TradingView site distributing backdoored TradingView application dropping SmokeLoader malware
51 viewsedited  
CTT Report Hub
#ParsedReport
26-12-2022

Caution! Malware Signed With Microsoft Certificate

https://asec.ahnlab.com/en/44726

Threats:
Trojan/win32.agent.c114064
Trojan/win.rootkitdrv.c5311744
Trojan/win.rootkitdrv.c5311748
Trojan/win.rootkitdrv.c5311745
Trojan/win.rootkitdrv.c5313281
Trojan/win.rootkitdrv.c5313299
Trojan/win.rootkitdrv.c5313267
Trojan/win.rootkitdrv.c5313273
Trojan/win.rootkitdrv.c5313261
Trojan/win.rootkitdrv.c5313014
Trojan/win.rootkitdrv.c5313271
Trojan/win.rootkitdrv.c5313304
Trojan/win.rootkitdrv.c5313297
Trojan/win.rootkitdrv.c5313257
Trojan/win.rootkitdrv.c5311743
Trojan/win.rootkitdrv.c5313262
Trojan/win.rootkitdrv.c5311747
Trojan/win.rootkitdrv.c5313269
Trojan/win.rootkitdrv.c5313259
Trojan/win.rootkitdrv.c5313278
Trojan/win.rootkitdrv.c5313296
Trojan/win.rootkitdrv.c5311742
Trojan/win.rootkitdrv.c5311746
Trojan/win.rootkitdrv.c5313303
Trojan/win.rootkitdrv.c5313265
Trojan/win.rootkitdrv.c5311749
Trojan/win.rootkitdrv.c5313295
Trojan/win.rootkitdrv.c5313263
Trojan/win.rootkitdrv.c5313260
Trojan/win.rootkitdrv.c5313302
Burntcigar_tool
Poortry
Stonestop

Softs:
(microsoft defender, windows security
ASEC BLOG
Caution! Malware Signed With Microsoft Certificate - ASEC BLOG
Microsoft announced details on the distribution of malware signed with a Microsoft certificate.[1] According to the announcement, a driver authenticated with the Windows Hardware Developer Program had been abused due to the leakage of multiple Windows developer…
37 views
CTT Report Hub
#ParsedReport
26-12-2022

Distribution of Magniber Ransomware Stops (Since November 29th)

https://asec.ahnlab.com/en/43858

Threats:
Magniber
Typosquatting_technique
Ransomware/win.magniberxg20
Ransom/mdp.edit.m1947
ASEC BLOG
Distribution of Magniber Ransomware Stops (Since November 29th) - ASEC BLOG
Through a continuous monitoring process, the AhnLab ASEC analysis team is swiftly responding to Magniber, the main malware that is actively being distributed using the typosquatting method which exploits typos in domain address input. Through such continuous…
38 views
CTT Report Hub
#ParsedReport
26-12-2022

ASEC Weekly Malware Statistics (December 12th, 2022 December 18th, 2022)

https://asec.ahnlab.com/en/44732

Threats:
Smokeloader
Beamwinhttp_loader
Garbage_cleaner
Agent_tesla
Amadey
Lockbit
Formbook
Clipboard_grabbing_technique

Geo:
Korea

IOCs:
File: 7
Domain: 8
Url: 20
Email: 4

Softs:
telegram
ASEC BLOG
ASEC Weekly Malware Statistics (December 12th, 2022 – December 18th, 2022) - ASEC BLOG
ContentsTop 1 – SmokeLoaderTop 2 – BeamWinHTTPTop 3 – AgentTeslaTop 4 – AmadeyTop 5 – Formbook The ASEC analysis team uses the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected…
32 views
CTT Report Hub
#ParsedReport
26-12-2022

RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

https://www.recordedfuture.com/reddelta-targets-european-government-organizations-continues-iterate-custom-plugx-variant

Actors/Campaigns:
Red_delta (motivation: cyber_espionage)

Threats:
Plugx_rat

Industry:
Government

Geo:
Tibetan, Vietnam, Asia, Ukraine, Myanmar, Russia, China, Chinese

IOCs:
IP: 57
Domain: 3
Hash: 24
File: 19
Recordedfuture
RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant | Recorded Future
Insikt Group® examines operations conducted by likely Chinese state-sponsored threat activity group RedDelta targeting organizations across Asia and Europe.
31 views
CTT Report Hub
#ParsedReport
26-12-2022

W4SP Stealer Discovered in Multiple PyPI Packages Under Various Names

https://thehackernews.com/2022/12/w4sp-stealer-discovered-in-multiple.html

Threats:
W4sp
Billythegoat_actor

IOCs:
Domain: 1

Softs:
discord

Languages:
python

Links:
https://github.com/billythegoat356/pystyle
32 views
CTT Report Hub
#ParsedReport
26-12-2022

APT41 The spy who failed to encrypt me. Timeline

https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1

Actors/Campaigns:
Axiom
Cuckoobees

Threats:
Proxylogon_exploit
Chinachopper
Bestcrypt
Natbypass_tool
Procdump_tool
Nltest_tool
Miping_tool
Cobalt_strike
Beacon
Bitlocker
Ransom:bat/bljammer.a

Industry:
Financial

Geo:
China, German

CVEs:
CVE-2021-27065 [Vulners]
Vulners: Score: 6.8, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2016, 2016, 2013, 2016, 2019, 2013, 2016, 2016, 2016, 2016, 2016, 2016, 2016, 2019, 2019, 2019, 2019, 2019, 2019, 2019)

CVE-2021-26855 [Vulners]
Vulners: Score: 7.5, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: 9.1
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2016, 2016, 2013, 2016, 2016, 2013, 2016, 2019, 2013, 2016, 2016, 2016, 2016, 2016, 2016, 2016, 2019, 2019, 2019, 2019, 2019, 2019, 2019, 2019)


TTPs:
Tactics: 9
Technics: 20

IOCs:
File: 29
Path: 10
IP: 3
Registry: 1
Command: 1
Hash: 10

Softs:
microsoft defender for endpoint, microsoft exchange server, bitlocker, msexchange, sysinternals, pyinstaller, active directory, component object model

SIGMA: Found

Links:
https://github.com/cw1997/NATBypass
Medium
APT41 — The spy who failed to encrypt me
This blog post is based on our recent investigation into one of APT41’s operations against an unnamed German company from the financial…
43 views
CTT Report Hub
#ParsedReport
26-12-2022

New info-stealer malware infects software pirates via fake cracks sites

https://www.bleepingcomputer.com/news/security/new-info-stealer-malware-infects-software-pirates-via-fake-cracks-sites

Actors/Campaigns:
Dev-0960

Threats:
Risepro
Privateloader
Vidar_stealer
Netdooka
Redline_stealer
Raccoon_stealer

Industry:
Financial

Geo:
Russian

Softs:
telegram, google chrome, maxthon3, nichrome, chromodo, netbox, torch, orbitum, coowon, have more...

Algorithms:
zip
BleepingComputer
New info-stealer malware infects software pirates via fake cracks sites
A new information-stealing malware named 'RisePro' is being distributed through fake cracks sites operated by the PrivateLoader pay-per-install (PPI) malware distribution service.
64 viewsedited  
CTT Report Hub
#ParsedReport
23-12-2022

MCCrash Malware: A Cross-Platform Botnet Targeting SSH-Enabled Devices

https://www.secureblink.com/threat-research/mc-crash-malware-a-cross-platform-botnet-targeting-ssh-enabled-devices

Actors/Campaigns:
Dev-1028

Threats:
Mccrash_botnet

Industry:
Iot

Geo:
Russia

IOCs:
File: 3
Domain: 1

Softs:
debian, ubuntu, pyinstaller

Languages:
python

Platforms:
raspbian
Secureblink
MCCrash Malware: A Cross-Platform Botnet Targeting SSH-Enabled Devices | Secure Blink
Analysis of MCCrash cross-platform botnet that targets Windows & Linux devices, as well as IoT devices, via insecure SSH settings. It launches DDoS attacks against private Minecraft servers...
85 views
CTT Report Hub
#ParsedReport
27-12-2022

SentinelSneak: Malicious PyPI module poses as security software development kit

https://www.reversinglabs.com/blog/sentinelsneak-malicious-pypi-module-poses-as-security-sdk

Actors/Campaigns:
Iconburst

Threats:
Sentinelsneak
Typosquatting_technique
W4sp

Geo:
German

IOCs:
IP: 1
Hash: 48

Languages:
python, javascript, ruby

YARA: Found

Links:
https://github.com/javascript-obfuscator/javascript-obfuscator
ReversingLabs
SentinelSneak: Malicious PyPI module poses as security software development kit
A malicious Python file found on the PyPI repo adds backdoor and data exfiltration features to what appears to be a legitimate SDK client from SentinelOne.
70 views
CTT Report Hub
#ParsedReport
27-12-2022

BlueNoroff introduces new methods bypassing MoTW

https://securelist.com/bluenoroff-methods-bypass-motw/108383

Actors/Campaigns:
Lazarus (motivation: financially_motivated)

Threats:
Motw_bypass_technique
Lotl_technique
Lolbin_technique
Perseus
Process_injection_technique

Industry:
Financial

Geo:
Japan, Japanese, America, Taiwan, Usa

TTPs:
Tactics: 6
Technics: 16

IOCs:
File: 22
Path: 2
Url: 8
Hash: 13
Command: 1
IP: 3

Softs:
windows installer, microsoft office, microsoft powerpoint, windows defender, curl, windows scheduled task

Algorithms:
zip, rc4

Languages:
visual_basic

Platforms:
intel
Securelist
BlueNoroff introduces new methods bypassing MoTW
We continue to track the BlueNoroff group’s activities and this October we observed the adoption of new malware strains in its arsenal.
37 views
CTT Report Hub
#ParsedReport
27-12-2022

ZetaNile: Open source software trojans from North Korea

https://www.reversinglabs.com/blog/zetanile-open-source-software-trojans-from-north-korea

Actors/Campaigns:
Lazarus

Threats:
Zetanile
Putty_tool
Tightvnc_tool
Dll_hijacking_technique

Industry:
Energy

Geo:
Korea, Korean, Japanese

TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 4
Url: 2
Path: 2
Command: 3
IP: 1
Hash: 8

Softs:
sumatra pdf, wordpress

Algorithms:
aes, base64

Languages:
php

Platforms:
x64
ReversingLabs
ZetaNile: Open source software trojans from North Korea
ReversingLabs Malware Researcher Joseph Edwards takes a deep dive into ZetaNile, a set of open-source software trojans being used by Lazarus/ZINC.
34 views
CTT Report Hub
#ParsedReport
27-12-2022

W4SP continues to nest in PyPI: Same supply chain attack, different distribution method

https://www.reversinglabs.com/blog/w4sp-continues-to-nest-in-pypi-same-supply-chain-attack-different-distribution-method

Actors/Campaigns:
Iconburst

Threats:
W4sp
Climax_loader
Typosquatting_technique

IOCs:
Url: 1
File: 3
IP: 2
Hash: 33

Softs:
discord, telegram, flask

Algorithms:
lzma, base64, zip

Languages:
rust, python

YARA: Found

Links:
https://github.com/liftoff/pyminifier
https://github.com/reversinglabs/reversinglabs-yara-rules
https://github.com/cloudflare/cloudflared/releases
ReversingLabs
W4SP continues to nest in PyPI: Same supply chain attack, different distribution method
Here's ReversingLabs' discoveries and indicators of compromise (IOCs) for W4SP, as well as links to our YARA rule that can be used to detect the malicious Python packages in your environment. 
36 views
CTT Report Hub
#ParsedReport
27-12-2022

Shc. SHC Linux malware installing coin minor

https://asec.ahnlab.com/ko/44885

Threats:
Xmrig_miner
Perlbot

Geo:
Korea

IOCs:
File: 7
Hash: 12
IP: 2
Url: 9

Softs:
ubuntu)

Algorithms:
rc4

Languages:
perl
ASEC BLOG
코인 마이너를 설치하는 Shc 리눅스 악성코드 - ASEC BLOG
ASEC 분석팀은 최근 Shc로 개발된 리눅스 악성코드가 코인 마이너 악성코드를 설치하고 있는 것을 확인하였다. 공격자는 부적절하게 관리되고 있는 리눅스 SSH 서버를 대상으로 사전 공격을 통해 인증에 성공한 뒤 다양한 악성코드들을 설치한 것으로 추정되며, Shc 다운로더 악성코드와 이를 통해 설치되는 XMRig 코인 마이너 그리고 Perl로 개발된 DDoS IRC Bot이 확인된다. 1. Shc (Shell Script Compiler) Shc는 Shell…
33 views
CTT Report Hub
#ParsedReport
27-12-2022

New wave of Financial Fraud: Scammers Monitoring Social Media Complaints

https://blog.cyble.com/2022/12/27/new-wave-of-finacial-fraud-scammers-monitoring-social-media-complaints

Industry:
Transport, Financial

Geo:
Indian, India

TTPs:
Tactics: 4
Technics: 5

IOCs:
File: 4
Url: 3
IP: 1
Hash: 1

Softs:
razorpay, truecaller, android
Cyble
New wave of Financial Fraud: Scammers Monitoring Social Media Complaints
CRIL analyzes the financial fraud campaign where scammers are monitoring complaint posts on social media to target users of IRCTC, and Indian Banks.
31 views
CTT Report Hub
#ParsedReport
27-12-2022

ASEC (20221219 \~ 20221225). ASEC Weekly Malware Statistics (20221219 \~ 20221225)

https://asec.ahnlab.com/ko/44946

Threats:
Beamwinhttp_loader
Garbage_cleaner
Agent_tesla
Azorult
Tofsee
Stop_ransomware
Smokeloader
Vidar_stealer
Nemty
Ryuk
Revil
Raccoon_stealer
Predator
Formbook
Clipboard_grabbing_technique
Snake_keylogger

Industry:
Transport, Financial

Geo:
Korea

IOCs:
File: 25
Email: 9
Domain: 2
Url: 11

Softs:
telegram, discord

Languages:
php
ASEC BLOG
ASEC 주간 악성코드 통계 (20221219 ~ 20221225) - ASEC BLOG
ContentsTop 1 – BeamWinHTTPTop 2 – AgentTeslaTop 3 – TofseeTop 4 – FormbookTop 5 – SnakeKeylogger ASEC 분석팀에서는 ASEC 자동 분석 시스템 RAPIT 을 활용하여 알려진 악성코드들에 대한 분류 및 대응을 진행하고 있다. 본 포스팅에서는 2022년 12월 19일 월요일부터 12월 25일 일요일까지 한 주간 수집된 악성코드의 통계를 정리한다. 대분류 상으로는 인포스틸러가 37.3%로…
27 views