#ParsedReport
07-01-2023
SpyNote: Spyware with RAT capabilities targeting Financial Institutions
https://www.threatfabric.com/blogs/spynote-rat-targeting-financial-institutions.html
Threats:
Spynote_rat
Spymax
Craxsrat
Industry:
Entertainment, Financial
Geo:
Deutsche, America
IOCs:
Hash: 9
IP: 2
Softs:
android, telegram
Algorithms:
base64
07-01-2023
SpyNote: Spyware with RAT capabilities targeting Financial Institutions
https://www.threatfabric.com/blogs/spynote-rat-targeting-financial-institutions.html
Threats:
Spynote_rat
Spymax
Craxsrat
Industry:
Entertainment, Financial
Geo:
Deutsche, America
IOCs:
Hash: 9
IP: 2
Softs:
android, telegram
Algorithms:
base64
ThreatFabric
SpyNote: Spyware with RAT capabilities targeting Financial Institutions
SpyNote, also known as SpyMax and CypherRat, is a unique and effective Spyware which developed unique interest in banking users
#ParsedReport
07-01-2023
Infostealer Malware: Targeting Italian Region - Uptycs. Infostealer Malware: Targeting Italian Region
https://www.uptycs.com/blog/infostealer-malware-attacks-targeting-italian-region
Industry:
Financial
Geo:
Italian, Italy
IOCs:
File: 2
Path: 3
Hash: 8
IP: 1
Softs:
zcash, coinbase, jaxx, bitclip
Algorithms:
base64, zip, gzip
YARA: Found
07-01-2023
Infostealer Malware: Targeting Italian Region - Uptycs. Infostealer Malware: Targeting Italian Region
https://www.uptycs.com/blog/infostealer-malware-attacks-targeting-italian-region
Industry:
Financial
Geo:
Italian, Italy
IOCs:
File: 2
Path: 3
Hash: 8
IP: 1
Softs:
zcash, coinbase, jaxx, bitclip
Algorithms:
base64, zip, gzip
YARA: Found
Uptycs
Infostealer Malware: Targeting the Italian Region
The Uptycs Threat research team became aware of a new infostealer malware attack campaign, employing phishing, that has appeared in the Italian region.
#ParsedReport
07-01-2023
Turla: A Galaxy of Opportunity
https://www.mandiant.com/resources/blog/turla-galaxy-opportunity
Actors/Campaigns:
Turla (motivation: financially_motivated, cyber_espionage, information_theft)
Threats:
Kopiluwak
Quietcanary
Andromeda
Beacon
Netstat_tool
Process_injection_technique
Geo:
Russian, Ukrainian, Ukraine, Asia
TTPs:
Tactics: 8
Technics: 21
IOCs:
Path: 4
Hash: 6
Domain: 4
File: 7
IP: 2
Registry: 1
Algorithms:
rc4, base64
Languages:
php, javascript
YARA: Found
07-01-2023
Turla: A Galaxy of Opportunity
https://www.mandiant.com/resources/blog/turla-galaxy-opportunity
Actors/Campaigns:
Turla (motivation: financially_motivated, cyber_espionage, information_theft)
Threats:
Kopiluwak
Quietcanary
Andromeda
Beacon
Netstat_tool
Process_injection_technique
Geo:
Russian, Ukrainian, Ukraine, Asia
TTPs:
Tactics: 8
Technics: 21
IOCs:
Path: 4
Hash: 6
Domain: 4
File: 7
IP: 2
Registry: 1
Algorithms:
rc4, base64
Languages:
php, javascript
YARA: Found
Google Cloud Blog
Turla: A Galaxy of Opportunity | Mandiant | Google Cloud Blog
A suspected Turla Team operation distributing a reconnaissance utility and backdoor to malware victims in Ukraine.
#ParsedReport
07-01-2023
Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa
https://symantec-enterprise-blogs.security.com/threat-intelligence/bluebottle-banks-targeted-africa
Actors/Campaigns:
Bluebottle (motivation: financially_motivated)
Opera1er
Blackcat
Threats:
Lotl_technique
Revealer_keylogger
Cobalt_strike
Rdpwrap_tool
Beacon
Cloudeye
Bumblebee
Quasar_rat
Netwire_rat
Api_hammering_technique
Lockbit
Cuba
Eamfo
Poortry
Stonestop
Burntcigar_tool
Mimikatz_tool
Bloodhound_tool
Industry:
Financial
Geo:
African, Canada, Africa
TTPs:
Tactics: 1
Technics: 0
IOCs:
Domain: 3
File: 8
Url: 10
Command: 1
Hash: 34
IP: 1
Softs:
psexec, internet explorer, asp.net, windows service, sysinternals
Algorithms:
zip
Links:
07-01-2023
Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa
https://symantec-enterprise-blogs.security.com/threat-intelligence/bluebottle-banks-targeted-africa
Actors/Campaigns:
Bluebottle (motivation: financially_motivated)
Opera1er
Blackcat
Threats:
Lotl_technique
Revealer_keylogger
Cobalt_strike
Rdpwrap_tool
Beacon
Cloudeye
Bumblebee
Quasar_rat
Netwire_rat
Api_hammering_technique
Lockbit
Cuba
Eamfo
Poortry
Stonestop
Burntcigar_tool
Mimikatz_tool
Bloodhound_tool
Industry:
Financial
Geo:
African, Canada, Africa
TTPs:
Tactics: 1
Technics: 0
IOCs:
Domain: 3
File: 8
Url: 10
Command: 1
Hash: 34
IP: 1
Softs:
psexec, internet explorer, asp.net, windows service, sysinternals
Algorithms:
zip
Links:
https://github.com/asmtron/rdpwrapSecurity
Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa
Continuation of previously documented activity leverages new TTPs.
#ParsedReport
07-01-2023
ASEC (20221225 \~ 20221231). ASEC Weekly phishing email threat trend (20221225 \~ 20221231)
https://asec.ahnlab.com/ko/45373
Threats:
Agent_tesla
Formbook
Motw_bypass_technique
Industry:
Financial, Transport
Geo:
Korean
TTPs:
IOCs:
File: 31
Url: 3
Softs:
chrome
Algorithms:
zip
07-01-2023
ASEC (20221225 \~ 20221231). ASEC Weekly phishing email threat trend (20221225 \~ 20221231)
https://asec.ahnlab.com/ko/45373
Threats:
Agent_tesla
Formbook
Motw_bypass_technique
Industry:
Financial, Transport
Geo:
Korean
TTPs:
IOCs:
File: 31
Url: 3
Softs:
chrome
Algorithms:
zip
ASEC BLOG
ASEC 주간 피싱 이메일 위협 트렌드 (20221225 ~ 20221231) - ASEC BLOG
Contents피싱 이메일 위협 유형첨부파일 확장자유포 사례사례: 가짜 로그인 페이지 (FakePage)사례: 악성코드 (Infostealer, Downloader 등)주의 키워드: ‘IMG, ISO’ 가짜 페이지 (FakePage) C2 주소피싱 이메일 공격 예방 ASEC 분석팀에서는 샘플 자동 분석 시스템(RAPIT)과 허니팟을 활용하여 피싱 이메일 위협을 모니터링하고 있다. 본 포스팅에서는 2022년 12월 25일부터 12월 31일까지 한 주간 확인된…
#ParsedReport
07-01-2023
LABScon Replay \| InkySquid: The Missing Arsenal. InkySquid: The Missing Arsenal: Audio automatically transcribed by Sonix
https://www.sentinelone.com/labs/labscon-replay-inkysquid-the-missing-arsenal
Actors/Campaigns:
Apt37 (motivation: cyber_espionage)
Threats:
Rokrat
Keybase
Cloudmensis_rat
Applescript
Fireball
Geo:
Korean, Korea, French
IOCs:
File: 1
Softs:
macos, android, microsoft word, zoom
Algorithms:
zip, xor
Platforms:
arm, x86
07-01-2023
LABScon Replay \| InkySquid: The Missing Arsenal. InkySquid: The Missing Arsenal: Audio automatically transcribed by Sonix
https://www.sentinelone.com/labs/labscon-replay-inkysquid-the-missing-arsenal
Actors/Campaigns:
Apt37 (motivation: cyber_espionage)
Threats:
Rokrat
Keybase
Cloudmensis_rat
Applescript
Fireball
Geo:
Korean, Korea, French
IOCs:
File: 1
Softs:
macos, android, microsoft word, zoom
Algorithms:
zip, xor
Platforms:
arm, x86
SentinelOne
LABScon Replay | InkySquid: The Missing Arsenal
Paul Rascagneres explores a macOS port of the Windows RoKRAT malware and how it bypasses Apple security protections.
#ParsedReport
07-01-2023
. Web page disguised as a Kakao login screen
https://asec.ahnlab.com/ko/45204
Industry:
Education
Geo:
Korea
IOCs:
File: 1
Url: 2
07-01-2023
. Web page disguised as a Kakao login screen
https://asec.ahnlab.com/ko/45204
Industry:
Education
Geo:
Korea
IOCs:
File: 1
Url: 2
ASEC
카카오 로그인화면으로 위장한 웹페이지 - ASEC
ASEC 분석팀은 최근 카카오의 로그인 페이지를 위장하여 특정인의 계정정보를 취하려는 정황을 확인하였다. 사용자가 해당 페이지에 최초 접속하게 되는 정확한 유입경로는 확인되지 않았으나, 피싱메일을 통해 접속하게 되는 페이지에서 웹 로그인을 유도하였을 것으로 추정된다. 웹페이지에 접속하면 아래의 그림 1)과 같이 카카오 계정의 ID가 자동완성 되어있다. 카카오메일이 있을 경우 메일 아이디만 입력하면 로그인이 가능한 카카오 로그인페이지의 정상포맷(그림 2)과…
#ParsedReport
07-01-2023
Orcus RAT. ORCUS RAT is being distributed by disguised as a Korean word processor crack
https://asec.ahnlab.com/ko/45153
Threats:
Orcus_rat
Sbit_rat
Xmrig_miner
Nircmd_tool
Process_hacker_tool
Cobalt_strike
Androm
Trojan/win.injection.c5347028
Geo:
Korea, Korean
IOCs:
File: 47
Coin: 1
Hash: 8
Domain: 3
Url: 13
Softs:
microsoft office, windows defender, telegram, exe,v_ser, process explorer, visual studio
Algorithms:
zip
07-01-2023
Orcus RAT. ORCUS RAT is being distributed by disguised as a Korean word processor crack
https://asec.ahnlab.com/ko/45153
Threats:
Orcus_rat
Sbit_rat
Xmrig_miner
Nircmd_tool
Process_hacker_tool
Cobalt_strike
Androm
Trojan/win.injection.c5347028
Geo:
Korea, Korean
IOCs:
File: 47
Coin: 1
Hash: 8
Domain: 3
Url: 13
Softs:
microsoft office, windows defender, telegram, exe,v_ser, process explorer, visual studio
Algorithms:
zip
ASEC
한글 워드 프로세서 크랙으로 위장하여 유포 중인 Orcus RAT - ASEC
ASEC 분석팀은 최근 Orcus RAT이 웹하드에서 한글 워드 프로세서의 크랙 버전으로 유포 중인 것을 확인하였다. 이를 유포한 공격자는 과거 웹하드에서 윈도우 정품 인증 툴을 위장해 BitRAT과 XMRig 코인 마이너를 유포하였던 공격자와 동일하다.[1] 공격자가 유포 중인 악성코드들은 과거와 유사한 형태이지만, BitRAT 대신 Orcus RAT을 사용한 것이 특징이다. 이외에도 안티바이러스의 행위 탐지를 우회하기 위해 복잡한 과정을 거친다거나…
#ParsedReport
07-01-2023
PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Executive Summary
https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources
Actors/Campaigns:
Purpleurchin
Geo:
Japanese, Japan, African
IOCs:
Domain: 1
Softs:
imagemagick
Languages:
php, python
Links:
07-01-2023
PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Executive Summary
https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources
Actors/Campaigns:
Purpleurchin
Geo:
Japanese, Japan, African
IOCs:
Domain: 1
Softs:
imagemagick
Languages:
php, python
Links:
https://github.com/Unit 42
PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources
We take a deep dive into Automated Libra, the cloud threat actor group behind the freejacking campaign PurpleUrchin.
#ParsedReport
07-01-2023
Dridex Returns, Targets MacOS Using New Entry Method. Introduction
https://www.trendmicro.com/en_us/research/23/a/-dridex-targets-macos-using-new-entry-method.html
Threats:
Dridex
Industry:
Financial
TTPs:
Tactics: 4
Technics: 6
IOCs:
File: 4
Hash: 2
Url: 1
Softs:
macos, microsoft word
Functions:
CreatePicture, CreateColor, RuBik
Languages:
python, visual_basic
Links:
07-01-2023
Dridex Returns, Targets MacOS Using New Entry Method. Introduction
https://www.trendmicro.com/en_us/research/23/a/-dridex-targets-macos-using-new-entry-method.html
Threats:
Dridex
Industry:
Financial
TTPs:
Tactics: 4
Technics: 6
IOCs:
File: 4
Hash: 2
Url: 1
Softs:
macos, microsoft word
Functions:
CreatePicture, CreateColor, RuBik
Languages:
python, visual_basic
Links:
https://github.com/decalage2/oletoolsTrend Micro
Dridex Targets MacOS Using New Entry Method
#technique
Unpack Brute Ratel (BRC4) stager and extract config
also tries to find the rc4 key in case of encrypted config
https://github.com/matthw/malware_analysis/tree/main/brc4
Unpack Brute Ratel (BRC4) stager and extract config
also tries to find the rc4 key in case of encrypted config
https://github.com/matthw/malware_analysis/tree/main/brc4
GitHub
malware_analysis/brc4 at main · matthw/malware_analysis
Contribute to matthw/malware_analysis development by creating an account on GitHub.
#ParsedReport
09-01-2023
Unwrapping Ursnifs Gifts. Exfiltration
https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts
Threats:
Gozi
Cobalt_strike
Beacon
Icedid
Atera_tool
Splashtop_tool
Quantum_locker
Bumblebee
Diavol
Process_injection_technique
Mimikatz_tool
Impacket_tool
Hostile
Meterpreter_tool
Industry:
Financial
Geo:
Rus
TTPs:
Tactics: 9
Technics: 24
IOCs:
Domain: 2
IP: 72
File: 26
Registry: 1
Path: 10
Command: 16
Hash: 17
Coin: 1
Email: 1
Softs:
internet explorer, windows security
Algorithms:
base64
Functions:
eval
Win API:
DllRegisterServer, QueueUserAPC, GetCurrentThreadId, OpenThread, VirtualAlloc, CreateThread, SetThreadContext, CreateRemoteThread, RtlCreateUserThread, VirtualAllocEx, have more...
Win Services:
BITS, NtLmSsp
Languages:
visual_basic, php, javascript
Platforms:
x64
YARA: Found
SIGMA: Found
Links:
09-01-2023
Unwrapping Ursnifs Gifts. Exfiltration
https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts
Threats:
Gozi
Cobalt_strike
Beacon
Icedid
Atera_tool
Splashtop_tool
Quantum_locker
Bumblebee
Diavol
Process_injection_technique
Mimikatz_tool
Impacket_tool
Hostile
Meterpreter_tool
Industry:
Financial
Geo:
Rus
TTPs:
Tactics: 9
Technics: 24
IOCs:
Domain: 2
IP: 72
File: 26
Registry: 1
Path: 10
Command: 16
Hash: 17
Coin: 1
Email: 1
Softs:
internet explorer, windows security
Algorithms:
base64
Functions:
eval
Win API:
DllRegisterServer, QueueUserAPC, GetCurrentThreadId, OpenThread, VirtualAlloc, CreateThread, SetThreadContext, CreateRemoteThread, RtlCreateUserThread, VirtualAllocEx, have more...
Win Services:
BITS, NtLmSsp
Languages:
visual_basic, php, javascript
Platforms:
x64
YARA: Found
SIGMA: Found
Links:
https://github.com/The-DFIR-Report/Suricata-Rules/blob/main/potential-impacket-wmiexec.py-activity.ruleshttps://github.com/fortra/impacket/blob/master/examples/wmiexec.pyThe DFIR Report
Unwrapping Ursnifs Gifts
In late August 2022, we investigated an incident involving Ursnif malware, which resulted in Cobalt Strike being deployed. This was followed by the threat actors moving laterally throughout the env…
#ParsedReport
09-01-2023
CIAHive. Be wary: the CIA attack kit after the magic reform into the field of black and gray
https://blog.netlab.360.com/warning-hive-variant-xdr33-is-coming_cn
Threats:
Beacon
IOCs:
File: 9
IP: 4
Hash: 1
Algorithms:
crc-16, aes, bzip, xor
Languages:
python
Platforms:
x86
09-01-2023
CIAHive. Be wary: the CIA attack kit after the magic reform into the field of black and gray
https://blog.netlab.360.com/warning-hive-variant-xdr33-is-coming_cn
Threats:
Beacon
IOCs:
File: 9
IP: 4
Hash: 1
Algorithms:
crc-16, aes, bzip, xor
Languages:
python
Platforms:
x86
360 Netlab Blog - Network Security Research Lab at 360
警惕：魔改后的CIA攻击套件Hive进入黑灰产领域
概述
2022年10月21日，360Netlab的蜜罐系统捕获了一个通过F5漏洞传播，VT 0检测的可疑ELF文件ee07a74d12c0bb3594965b51d0e45b6f，流量监控系统提示它和IP45.9.150.144产生了SSL流量，而且双方都使用了伪造的Kaspersky证书，这引起了我们的关注。经过分析，我们确认它由CIA被泄露的Hive项目server源码改编而来。这是我们首次捕获到在野的CIA HIVE攻击套件变种，基于其内嵌Bot端证书的CN=xdr33， 我们内部将其命名为x…
2022年10月21日，360Netlab的蜜罐系统捕获了一个通过F5漏洞传播，VT 0检测的可疑ELF文件ee07a74d12c0bb3594965b51d0e45b6f，流量监控系统提示它和IP45.9.150.144产生了SSL流量，而且双方都使用了伪造的Kaspersky证书，这引起了我们的关注。经过分析，我们确认它由CIA被泄露的Hive项目server源码改编而来。这是我们首次捕获到在野的CIA HIVE攻击套件变种，基于其内嵌Bot端证书的CN=xdr33， 我们内部将其命名为x…
#ParsedReport
09-01-2023
Dark Web Profile: Royal Ransomware
https://socradar.io/dark-web-profile-royal-ransomware
Actors/Campaigns:
Dev-0569
Threats:
Royal_ransomware
Conti
Bazaar
Blackcat
Zeon
Process_injection_technique
Industry:
Petroleum, Healthcare, Telco
Geo:
American
TTPs:
Tactics: 1
Technics: 17
IOCs:
File: 1
Hash: 3
IP: 5
Url: 1
Softs:
zoom, microsoft teams, component object model
Algorithms:
aes
09-01-2023
Dark Web Profile: Royal Ransomware
https://socradar.io/dark-web-profile-royal-ransomware
Actors/Campaigns:
Dev-0569
Threats:
Royal_ransomware
Conti
Bazaar
Blackcat
Zeon
Process_injection_technique
Industry:
Petroleum, Healthcare, Telco
Geo:
American
TTPs:
Tactics: 1
Technics: 17
IOCs:
File: 1
Hash: 3
IP: 5
Url: 1
Softs:
zoom, microsoft teams, component object model
Algorithms:
aes
SOCRadar® Cyber Intelligence Inc.
Dark Web Profile: Royal Ransomware - SOCRadar® Cyber Intelligence Inc.
Royal Ransomware strain was first detected on DEV-0569’s (threat actor) operations in September 2022. The actors behind the Royal are...
#ParsedReport
09-01-2023
Ransomware Gangs Leak Large Amounts of Data in Recent Attacks: Hive and Vice Society
https://socradar.io/ransomware-gangs-leak-large-amounts-of-data-in-recent-attacks-hive-and-vice-society
Actors/Campaigns:
Vice_society
Threats:
Hive
Stop_ransomware
Industry:
Healthcare, Education
IOCs:
File: 1
Domain: 4
IP: 10
Hash: 4
09-01-2023
Ransomware Gangs Leak Large Amounts of Data in Recent Attacks: Hive and Vice Society
https://socradar.io/ransomware-gangs-leak-large-amounts-of-data-in-recent-attacks-hive-and-vice-society
Actors/Campaigns:
Vice_society
Threats:
Hive
Stop_ransomware
Industry:
Healthcare, Education
IOCs:
File: 1
Domain: 4
IP: 10
Hash: 4
SOCRadar® Cyber Intelligence Inc.
Ransomware Gangs Leak Large Amounts of Data in Recent Attacks: Hive and Vice Society
Recent ransomware data leaks in this blog are a good reminder of how important it is to take proper security measures to defend against...
#ParsedReport
09-01-2023
0day in {REA_TEAM}
https://kienmanowar.wordpress.com/2023/01/09/quicknote-another-nice-plugx-sample
Actors/Campaigns:
Red_delta
Threats:
Plugx_rat
Dll_sideloading_technique
IOCs:
File: 28
Hash: 1
IP: 1
Softs:
wordpress
Functions:
plx_read_Mc_cp_content_and_exec, plx_patching_func, GetProcAdderss, GetProcAddress_rva
Win API:
VirtualAlloc, GetModuleFileNameW, lstrcpyW, CreateFileW, ReadFile, LoadLibraryW, GetLastError, GetSystemTime, VirtualProtect, GetProcAddress, have more...
Links:
09-01-2023
0day in {REA_TEAM}
https://kienmanowar.wordpress.com/2023/01/09/quicknote-another-nice-plugx-sample
Actors/Campaigns:
Red_delta
Threats:
Plugx_rat
Dll_sideloading_technique
IOCs:
File: 28
Hash: 1
IP: 1
Softs:
wordpress
Functions:
plx_read_Mc_cp_content_and_exec, plx_patching_func, GetProcAdderss, GetProcAddress_rva
Win API:
VirtualAlloc, GetModuleFileNameW, lstrcpyW, CreateFileW, ReadFile, LoadLibraryW, GetLastError, GetSystemTime, VirtualProtect, GetProcAddress, have more...
Links:
https://github.com/m4now4r/PlugX\_Mustang-Panda/blob/main/390f166753608a29b350c43f91b3b252\_vhd.zip0day in {REA_TEAM}
[QuickNote] Another nice PlugX sample
Sample information shared by Johann Aydinbas(@jaydinbas): Sample hash: 2025427bba36b48e827a61116321bbe6b00d77d3fd35d552f72e052eb88948e0 Download here!
#ParsedReport
09-01-2023
APTSaaiwc Group. New forces in Southeast Asia: New APT Organization Saaiwc Group analyzes the attack activities of Southeast Asia's military, finance and other departments
https://mp.weixin.qq.com/s/G3gUjg9WC96NW4cRPww6gw
Actors/Campaigns:
Saaiwc
Threats:
Lockbit
Industry:
Government, Financial
Geo:
Philippine, Cambodia, Asian, Vietnam, Asia, Philippines
CVEs:
CVE-2017-0199 [Vulners]
Vulners: Score: 9.3, CVSS: 7.8,
Vulners: Exploitation: True
X-Force: Risk: 9.3
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, *)
- microsoft windows server 2012 (-)
- microsoft windows vista (*)
- microsoft office (2010, 2013, 2016, 2007)
- microsoft windows 7 (*)
have more...
TTPs:
Tactics: 1
Technics: 0
IOCs:
Registry: 2
File: 11
Url: 1
Hash: 4
Softs:
telegram
09-01-2023
APTSaaiwc Group. New forces in Southeast Asia: New APT Organization Saaiwc Group analyzes the attack activities of Southeast Asia's military, finance and other departments
https://mp.weixin.qq.com/s/G3gUjg9WC96NW4cRPww6gw
Actors/Campaigns:
Saaiwc
Threats:
Lockbit
Industry:
Government, Financial
Geo:
Philippine, Cambodia, Asian, Vietnam, Asia, Philippines
CVEs:
CVE-2017-0199 [Vulners]
Vulners: Score: 9.3, CVSS: 7.8,
Vulners: Exploitation: True
X-Force: Risk: 9.3
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, *)
- microsoft windows server 2012 (-)
- microsoft windows vista (*)
- microsoft office (2010, 2013, 2016, 2007)
- microsoft windows 7 (*)
have more...
TTPs:
Tactics: 1
Technics: 0
IOCs:
Registry: 2
File: 11
Url: 1
Hash: 4
Softs:
telegram
#ParsedReport
10-01-2023
Crypto-inspired Magecart skimmer surfaces via digital crime haven
https://www.malwarebytes.com/blog/threat-intelligence/2023/01/crypto-inspired-magecart-skimmer-surfaces-via-digital-crime-haven
Threats:
Magentocore
Agent_tesla
Teamviewer_tool
Anydesk_tool
Vidar_stealer
Gozi
Aurora
Robin_banks_tool
Industry:
Financial, E-commerce, Retail
Geo:
American, Ukraine, Russian
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 1
Domain: 11
IP: 15
Url: 3
Softs:
cpanel
Languages:
javascript
Links:
10-01-2023
Crypto-inspired Magecart skimmer surfaces via digital crime haven
https://www.malwarebytes.com/blog/threat-intelligence/2023/01/crypto-inspired-magecart-skimmer-surfaces-via-digital-crime-haven
Threats:
Magentocore
Agent_tesla
Teamviewer_tool
Anydesk_tool
Vidar_stealer
Gozi
Aurora
Robin_banks_tool
Industry:
Financial, E-commerce, Retail
Geo:
American, Ukraine, Russian
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 1
Domain: 11
IP: 15
Url: 3
Softs:
cpanel
Languages:
javascript
Links:
https://gist.github.com/krautface/e5444c1bb9880518db0f128416c911e6Malwarebytes
Crypto-inspired Magecart skimmer surfaces via digital crime haven
This blog post was authored by Jérôme Segura Online criminals rarely reinvent the wheel, especially when they don’t have to. From...
#ParsedReport
10-01-2023
Web Page Disguised as a Kakao Login Page
https://asec.ahnlab.com/en/45437
Industry:
Education
Geo:
Korean, Korea
IOCs:
Url: 2
10-01-2023
Web Page Disguised as a Kakao Login Page
https://asec.ahnlab.com/en/45437
Industry:
Education
Geo:
Korean, Korea
IOCs:
Url: 2
ASEC BLOG
Web Page Disguised as a Kakao Login Page - ASEC BLOG
The ASEC analysis team recently identified a fake Kakao login page attempting to gain access to the account credentials of specific individuals. The specific route through which users first arrive on these pages is unknown, but it is assumed that users were…
#ParsedReport
10-01-2023
THREAT ANALYSIS: From IcedID to Domain Compromise
https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise
Actors/Campaigns:
Shathak
Threats:
Icedid
Cobalt_strike
Conti
Lockbit
Fivehands
Beacon
Rubeus_tool
Kerberoasting_technique
Atera_tool
Dcsync_technique
Credential_stealing_technique
Nltest_tool
Industry:
Financial, Education
Geo:
French
TTPs:
Tactics: 4
Technics: 2
IOCs:
File: 28
Domain: 5
Softs:
active directory, curl, chrome, windows explorer
Algorithms:
base64, zip
Functions:
RPC, MSRPC
Languages:
python
Links:
10-01-2023
THREAT ANALYSIS: From IcedID to Domain Compromise
https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise
Actors/Campaigns:
Shathak
Threats:
Icedid
Cobalt_strike
Conti
Lockbit
Fivehands
Beacon
Rubeus_tool
Kerberoasting_technique
Atera_tool
Dcsync_technique
Credential_stealing_technique
Nltest_tool
Industry:
Financial, Education
Geo:
French
TTPs:
Tactics: 4
Technics: 2
IOCs:
File: 28
Domain: 5
Softs:
active directory, curl, chrome, windows explorer
Algorithms:
base64, zip
Functions:
RPC, MSRPC
Languages:
python
Links:
https://github.com/hashcat/hashcathttps://github.com/openwall/johnhttps://github.com/GhostPack/RubeusCybereason
THREAT ANALYSIS: From IcedID to Domain Compromise
Recently, IcedID, also known as BokBot, has been used more as a dropper for other malware families and as a tool for initial access brokers.
#ParsedReport
10-01-2023
ASEC Weekly Phishing Email Threat Trends (December 25th, 2022 December 31st, 2022)
https://asec.ahnlab.com/en/45442
Threats:
Agent_tesla
Formbook
Motw_bypass_technique
Industry:
Financial, Transport
Geo:
Korean
TTPs:
IOCs:
File: 23
Url: 3
Softs:
chrome
Algorithms:
zip
10-01-2023
ASEC Weekly Phishing Email Threat Trends (December 25th, 2022 December 31st, 2022)
https://asec.ahnlab.com/en/45442
Threats:
Agent_tesla
Formbook
Motw_bypass_technique
Industry:
Financial, Transport
Geo:
Korean
TTPs:
IOCs:
File: 23
Url: 3
Softs:
chrome
Algorithms:
zip
ASEC BLOG
ASEC Weekly Phishing Email Threat Trends (December 25th, 2022 – December 31st, 2022) - ASEC BLOG
The ASEC analysis team monitors phishing email threats with the ASEC automatic sample analysis system (RAPIT) and honeypot. This post will cover the cases of distribution of phishing emails during the week from December 25th, 2022 to December 31st, 2022 and…