CTT Report Hub
@aptreports
3.22K subscribers
8K photos
6 videos
67 files
11.7K links
Threat Intelligence Report Hub
https://cyberthreat.tech
ООО Технологии киберугроз
Contact: @nikolaiav
Download Telegram
About
Blog
Apps
Platform
Join
CTT Report Hub
3.22K subscribers
CTT Report Hub
#ParsedReport
07-01-2023

. Web page disguised as a Kakao login screen

https://asec.ahnlab.com/ko/45204

Industry:
Education

Geo:
Korea

IOCs:
File: 1
Url: 2
ASEC
카카오 로그인화면으로 위장한 웹페이지 - ASEC
ASEC 분석팀은 최근 카카오의 로그인 페이지를 위장하여 특정인의 계정정보를 취하려는 정황을 확인하였다. 사용자가 해당 페이지에 최초 접속하게 되는 정확한 유입경로는 확인되지 않았으나, 피싱메일을 통해 접속하게 되는 페이지에서 웹 로그인을 유도하였을 것으로 추정된다. 웹페이지에 접속하면 아래의 그림 1)과 같이 카카오 계정의 ID가 자동완성 되어있다. 카카오메일이 있을 경우 메일 아이디만 입력하면 로그인이 가능한 카카오 로그인페이지의 정상포맷(그림 2)과…
35 views
CTT Report Hub
#ParsedReport
07-01-2023

Orcus RAT. ORCUS RAT is being distributed by disguised as a Korean word processor crack

https://asec.ahnlab.com/ko/45153

Threats:
Orcus_rat
Sbit_rat
Xmrig_miner
Nircmd_tool
Process_hacker_tool
Cobalt_strike
Androm
Trojan/win.injection.c5347028

Geo:
Korea, Korean

IOCs:
File: 47
Coin: 1
Hash: 8
Domain: 3
Url: 13

Softs:
microsoft office, windows defender, telegram, exe,v_ser, process explorer, visual studio

Algorithms:
zip
ASEC
한글 워드 프로세서 크랙으로 위장하여 유포 중인 Orcus RAT - ASEC
ASEC 분석팀은 최근 Orcus RAT이 웹하드에서 한글 워드 프로세서의 크랙 버전으로 유포 중인 것을 확인하였다. 이를 유포한 공격자는 과거 웹하드에서 윈도우 정품 인증 툴을 위장해 BitRAT과 XMRig 코인 마이너를 유포하였던 공격자와 동일하다.[1] 공격자가 유포 중인 악성코드들은 과거와 유사한 형태이지만, BitRAT 대신 Orcus RAT을 사용한 것이 특징이다. 이외에도 안티바이러스의 행위 탐지를 우회하기 위해 복잡한 과정을 거친다거나…
40 views
CTT Report Hub
#ParsedReport
07-01-2023

PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Executive Summary

https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources

Actors/Campaigns:
Purpleurchin

Geo:
Japanese, Japan, African

IOCs:
Domain: 1

Softs:
imagemagick

Languages:
php, python

Links:
https://github.com/
Unit 42
PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources
We take a deep dive into Automated Libra, the cloud threat actor group behind the freejacking campaign PurpleUrchin.
52 viewsedited  
CTT Report Hub
#ParsedReport
07-01-2023

Dridex Returns, Targets MacOS Using New Entry Method. Introduction

https://www.trendmicro.com/en_us/research/23/a/-dridex-targets-macos-using-new-entry-method.html

Threats:
Dridex

Industry:
Financial

TTPs:
Tactics: 4
Technics: 6

IOCs:
File: 4
Hash: 2
Url: 1

Softs:
macos, microsoft word

Functions:
CreatePicture, CreateColor, RuBik

Languages:
python, visual_basic

Links:
https://github.com/decalage2/oletools
Trend Micro
Dridex Targets MacOS Using New Entry Method
89 views
CTT Report Hub
#technique

Unpack Brute Ratel (BRC4) stager and extract config
also tries to find the rc4 key in case of encrypted config

https://github.com/matthw/malware_analysis/tree/main/brc4
GitHub
malware_analysis/brc4 at main · matthw/malware_analysis
Contribute to matthw/malware_analysis development by creating an account on GitHub.
87 views
CTT Report Hub
#ParsedReport
09-01-2023

Unwrapping Ursnifs Gifts. Exfiltration

https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts

Threats:
Gozi
Cobalt_strike
Beacon
Icedid
Atera_tool
Splashtop_tool
Quantum_locker
Bumblebee
Diavol
Process_injection_technique
Mimikatz_tool
Impacket_tool
Hostile
Meterpreter_tool

Industry:
Financial

Geo:
Rus

TTPs:
Tactics: 9
Technics: 24

IOCs:
Domain: 2
IP: 72
File: 26
Registry: 1
Path: 10
Command: 16
Hash: 17
Coin: 1
Email: 1

Softs:
internet explorer, windows security

Algorithms:
base64

Functions:
eval

Win API:
DllRegisterServer, QueueUserAPC, GetCurrentThreadId, OpenThread, VirtualAlloc, CreateThread, SetThreadContext, CreateRemoteThread, RtlCreateUserThread, VirtualAllocEx, have more...

Win Services:
BITS, NtLmSsp

Languages:
visual_basic, php, javascript

Platforms:
x64

YARA: Found
SIGMA: Found

Links:
https://github.com/The-DFIR-Report/Suricata-Rules/blob/main/potential-impacket-wmiexec.py-activity.rules
https://github.com/fortra/impacket/blob/master/examples/wmiexec.py
The DFIR Report
Unwrapping Ursnifs Gifts
In late August 2022, we investigated an incident involving Ursnif malware, which resulted in Cobalt Strike being deployed. This was followed by the threat actors moving laterally throughout the env…
72 views
CTT Report Hub
#ParsedReport
09-01-2023

CIAHive. Be wary: the CIA attack kit after the magic reform into the field of black and gray

https://blog.netlab.360.com/warning-hive-variant-xdr33-is-coming_cn

Threats:
Beacon

IOCs:
File: 9
IP: 4
Hash: 1

Algorithms:
crc-16, aes, bzip, xor

Languages:
python

Platforms:
x86
360 Netlab Blog - Network Security Research Lab at 360
警惕：魔改后的CIA攻击套件Hive进入黑灰产领域
概述


2022年10月21日，360Netlab的蜜罐系统捕获了一个通过F5漏洞传播，VT 0检测的可疑ELF文件ee07a74d12c0bb3594965b51d0e45b6f，流量监控系统提示它和IP45.9.150.144产生了SSL流量，而且双方都使用了伪造的Kaspersky证书，这引起了我们的关注。经过分析，我们确认它由CIA被泄露的Hive项目server源码改编而来。这是我们首次捕获到在野的CIA HIVE攻击套件变种，基于其内嵌Bot端证书的CN=xdr33， 我们内部将其命名为x…
52 views
CTT Report Hub
#ParsedReport
09-01-2023

Dark Web Profile: Royal Ransomware

https://socradar.io/dark-web-profile-royal-ransomware

Actors/Campaigns:
Dev-0569

Threats:
Royal_ransomware
Conti
Bazaar
Blackcat
Zeon
Process_injection_technique

Industry:
Petroleum, Healthcare, Telco

Geo:
American

TTPs:
Tactics: 1
Technics: 17

IOCs:
File: 1
Hash: 3
IP: 5
Url: 1

Softs:
zoom, microsoft teams, component object model

Algorithms:
aes
SOCRadar® Cyber Intelligence Inc.
Dark Web Profile: Royal Ransomware - SOCRadar® Cyber Intelligence Inc.
Royal Ransomware strain was first detected on DEV-0569’s (threat actor) operations in September 2022. The actors behind the Royal are...
44 views
CTT Report Hub
#ParsedReport
09-01-2023

Ransomware Gangs Leak Large Amounts of Data in Recent Attacks: Hive and Vice Society

https://socradar.io/ransomware-gangs-leak-large-amounts-of-data-in-recent-attacks-hive-and-vice-society

Actors/Campaigns:
Vice_society

Threats:
Hive
Stop_ransomware

Industry:
Healthcare, Education

IOCs:
File: 1
Domain: 4
IP: 10
Hash: 4
SOCRadar® Cyber Intelligence Inc.
Ransomware Gangs Leak Large Amounts of Data in Recent Attacks: Hive and Vice Society
Recent ransomware data leaks in this blog are a good reminder of how important it is to take proper security measures to defend against...
52 views
CTT Report Hub
#ParsedReport
09-01-2023

0day in {REA_TEAM}

https://kienmanowar.wordpress.com/2023/01/09/quicknote-another-nice-plugx-sample

Actors/Campaigns:
Red_delta

Threats:
Plugx_rat
Dll_sideloading_technique

IOCs:
File: 28
Hash: 1
IP: 1

Softs:
wordpress

Functions:
plx_read_Mc_cp_content_and_exec, plx_patching_func, GetProcAdderss, GetProcAddress_rva

Win API:
VirtualAlloc, GetModuleFileNameW, lstrcpyW, CreateFileW, ReadFile, LoadLibraryW, GetLastError, GetSystemTime, VirtualProtect, GetProcAddress, have more...

Links:
https://github.com/m4now4r/PlugX\_Mustang-Panda/blob/main/390f166753608a29b350c43f91b3b252\_vhd.zip
0day in {REA_TEAM}
[QuickNote] Another nice PlugX sample
Sample information shared by Johann Aydinbas(@jaydinbas): Sample hash: 2025427bba36b48e827a61116321bbe6b00d77d3fd35d552f72e052eb88948e0 Download here!
64 views
CTT Report Hub
#ParsedReport
09-01-2023

APTSaaiwc Group. New forces in Southeast Asia: New APT Organization Saaiwc Group analyzes the attack activities of Southeast Asia's military, finance and other departments

https://mp.weixin.qq.com/s/G3gUjg9WC96NW4cRPww6gw

Actors/Campaigns:
Saaiwc

Threats:
Lockbit

Industry:
Government, Financial

Geo:
Philippine, Cambodia, Asian, Vietnam, Asia, Philippines

CVEs:
CVE-2017-0199 [Vulners]
Vulners: Score: 9.3, CVSS: 7.8,
Vulners: Exploitation: True
X-Force: Risk: 9.3
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, *)
- microsoft windows server 2012 (-)
- microsoft windows vista (*)
- microsoft office (2010, 2013, 2016, 2007)
- microsoft windows 7 (*)
have more...

TTPs:
Tactics: 1
Technics: 0

IOCs:
Registry: 2
File: 11
Url: 1
Hash: 4

Softs:
telegram
90 views
CTT Report Hub
#ParsedReport
10-01-2023

Crypto-inspired Magecart skimmer surfaces via digital crime haven

https://www.malwarebytes.com/blog/threat-intelligence/2023/01/crypto-inspired-magecart-skimmer-surfaces-via-digital-crime-haven

Threats:
Magentocore
Agent_tesla
Teamviewer_tool
Anydesk_tool
Vidar_stealer
Gozi
Aurora
Robin_banks_tool

Industry:
Financial, E-commerce, Retail

Geo:
American, Ukraine, Russian

TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 1
Domain: 11
IP: 15
Url: 3

Softs:
cpanel

Languages:
javascript

Links:
https://gist.github.com/krautface/e5444c1bb9880518db0f128416c911e6
Malwarebytes
Crypto-inspired Magecart skimmer surfaces via digital crime haven
This blog post was authored by Jérôme Segura Online criminals rarely reinvent the wheel, especially when they don’t have to. From...
81 views
CTT Report Hub
#ParsedReport
10-01-2023

Web Page Disguised as a Kakao Login Page

https://asec.ahnlab.com/en/45437

Industry:
Education

Geo:
Korean, Korea

IOCs:
Url: 2
ASEC BLOG
Web Page Disguised as a Kakao Login Page - ASEC BLOG
The ASEC analysis team recently identified a fake Kakao login page attempting to gain access to the account credentials of specific individuals. The specific route through which users first arrive on these pages is unknown, but it is assumed that users were…
49 views
CTT Report Hub
#ParsedReport
10-01-2023

THREAT ANALYSIS: From IcedID to Domain Compromise

https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise

Actors/Campaigns:
Shathak

Threats:
Icedid
Cobalt_strike
Conti
Lockbit
Fivehands
Beacon
Rubeus_tool
Kerberoasting_technique
Atera_tool
Dcsync_technique
Credential_stealing_technique
Nltest_tool

Industry:
Financial, Education

Geo:
French

TTPs:
Tactics: 4
Technics: 2

IOCs:
File: 28
Domain: 5

Softs:
active directory, curl, chrome, windows explorer

Algorithms:
base64, zip

Functions:
RPC, MSRPC

Languages:
python

Links:
https://github.com/hashcat/hashcat
https://github.com/openwall/john
https://github.com/GhostPack/Rubeus
Cybereason
THREAT ANALYSIS: From IcedID to Domain Compromise
Recently, IcedID, also known as BokBot, has been used more as a dropper for other malware families and as a tool for initial access brokers.
47 views
CTT Report Hub
#ParsedReport
10-01-2023

ASEC Weekly Phishing Email Threat Trends (December 25th, 2022 December 31st, 2022)

https://asec.ahnlab.com/en/45442

Threats:
Agent_tesla
Formbook
Motw_bypass_technique

Industry:
Financial, Transport

Geo:
Korean

TTPs:

IOCs:
File: 23
Url: 3

Softs:
chrome

Algorithms:
zip
ASEC BLOG
ASEC Weekly Phishing Email Threat Trends (December 25th, 2022 – December 31st, 2022) - ASEC BLOG
The ASEC analysis team monitors phishing email threats with the ASEC automatic sample analysis system (RAPIT) and honeypot. This post will cover the cases of distribution of phishing emails during the week from December 25th, 2022 to December 31st, 2022 and…
40 views
CTT Report Hub
#ParsedReport
10-01-2023

( ). Malware disguised as a plaintiff (for security workers)

https://asec.ahnlab.com/ko/45537

Actors/Campaigns:
Kimsuky

Geo:
Chinese, Korean, Korea

IOCs:
IP: 1
Hash: 6
Url: 6
ASEC BLOG
원고 청탁서로 위장한 악성코드 (안보 분야 종사자 대상) - ASEC BLOG
ASEC 분석팀은 01월 08일 안보 분야 종사자를 대상으로 원고 청탁서로 위장한 문서형 악성코드 유포 정황을 확인하였다. 확보된 악성코드는 워드 문서 내 External 개체를 통해 추가 악성 매크로를 실행한다. 이러한 기법은 템플릿 인젝션(Template Injection) 기법으로 불리며 이전 블로그를 통해 유사한 공격 사례를 소개한 바 있다. 워드 문서를 실행하면 공격자 C&C 서버로부터 추가 악성 워드 매크로 문서를 다운로드 받아 실행한다. 추가로…
39 views
CTT Report Hub
#ParsedReport
10-01-2023

Heads up! Xdr33, A Variant Of CIAs HIVE Attack Kit Emerges. Overview

https://blog.netlab.360.com/headsup_xdr33_variant_of_ciahive_emeerges

Threats:
Cia_hive_tool
Xdr33
Beacon

TTPs:
Tactics: 1
Technics: 0

IOCs:
Hash: 3
IP: 4
File: 3

Softs:
openssl

Algorithms:
aes, xor, crc-16, bzip

Languages:
python

Platforms:
x86
360 Netlab Blog - Network Security Research Lab at 360
Heads up! Xdr33, A Variant Of CIA’s HIVE Attack Kit Emerges
Overview


On Oct 21, 2022, 360Netlab's honeypot system captured a suspicious ELF file ee07a74d12c0bb3594965b51d0e45b6f, which propagated via F5 vulnerability with zero VT detection, our system observces that it communicates with IP 45.9.150.144 using SSL…
49 views
CTT Report Hub
#ParsedReport
10-01-2023

. Fishing web server confirmed through the IRS camouflage email

https://asec.ahnlab.com/ko/45483

Industry:
Financial

Geo:
Korea

IOCs:
Url: 1
File: 5

Softs:
telegram

Languages:
php
ASEC BLOG
국세청 위장 메일을 통해 확인된 피싱 웹 서버 - ASEC BLOG
ASEC 분석팀에서는 최근 국세청을 사칭한 피싱메일이 유포되고 있는 정황을 확인하였다. 해당 피싱메일은 사내 메일의 비밀번호가 당일에 만료된다는 시급성을 강조하며, 계정이 잠기기 전에 암호를 유지하라는 내용으로 유포되고 있었다.   그림 1) 원문 메일 그림 2) 계정 입력 피싱 사이트 그림 3) 로그인 페이지의 소스코드 ‘같은 비밀번호를 유지’라는 URL을 클릭하면 사내 메일 로그인 페이지가 확인되는데, 해당 로그인 페이지의 HTML 스크립트 코드는…
52 views
CTT Report Hub
#ParsedReport
10-01-2023

A Deep Dive Into poweRAT: a Newly Discovered Stealer/RAT Combo Polluting PyPI

https://blog.phylum.io/a-deep-dive-into-powerat-a-newly-discovered-stealer/rat-combo-polluting-pypi

Threats:
Powerat
Xrat_rat

Industry:
Government

IOCs:
File: 7
Domain: 1

Softs:
flask, telegram, discord

Algorithms:
lzma, base64, zip

Functions:
run_with_cloudflared

Languages:
javascript, python

Links:
https://github.com/cloudflare/cloudflared
Phylum Research | Software Supply Chain Security
A Deep Dive Into poweRAT: a Newly Discovered Stealer/RAT Combo Polluting PyPI
Phylum uncovers new PyPI malware distributing remote access tools.
66 views
CTT Report Hub
#ParsedReport
10-01-2023

RomCom RAT Attack Analysis: Fake It to Make It

https://securityintelligence.com/articles/romcom-rat-attack-analysis

Threats:
Romcom_rat
Cuba

Geo:
Ukraine

IOCs:
File: 2

Softs:
keepass
Security Intelligence
RomCom RAT Attack Analysis: Fake It to Make It
Learn more about RomCom RAT attacks and the fake sites and emails used as a trojan horse to give threat actors access.
91 views
CTT Report Hub
#ParsedReport
11-01-2023

A View Into Web(View) Attacks in Android

https://securityintelligence.com/posts/view-into-webview-attacks-android

Threats:
Fake-trusteer
Zeus_sphinx
Zeus
Sphinx
Icedid
Trickbot
Rustock
Flubot
Sharkbot
Hydra

Industry:
Financial, E-commerce

IOCs:
Hash: 2

Softs:
android, google chrome, chrome

Algorithms:
base64

Functions:
val, loadUrl, getCookie

Languages:
javascript
Security Intelligence
A View Into Web(View) Attacks in Android
Unpack two effective attack techniques as it relates to financial malware in Android: the Web(View) injection attack and mobile cookie stealing.
81 views