#ParsedReport
11-01-2023

StrongPity espionage campaign targeting Android users

https://www.welivesecurity.com/2023/01/10/strongpity-espionage-campaign-targeting-android-users

Threats:
Strongpity
Httrack_tool
Bahamut

Geo:
Syrian, Ukraine

TTPs:
Tactics: 7
Technics: 15

IOCs:
Hash: 13
File: 3
Domain: 2
IP: 2

Softs:
android, android telegram, telegram, tinder, wechat, instagram, instagram.android

Algorithms:
aes, cbc

YARA: Found

#ParsedReport
11-01-2023

Gootkit Loader Actively Targets Australian Healthcare Industry

https://www.trendmicro.com/en_us/research/23/a/gootkit-loader-actively-targets-the-australian-healthcare-indust.html

Actors/Campaigns:
Stone_panda

Threats:
Gootkit
Gootloader
Cobalt_strike
Dll_sideloading_technique
Beacon
Process_injection_technique
Bloodhound_tool
Trojan.win32.frs.vsnw0ek22
Follina_vuln
Trojan.js.downloader.ac
Trojan.ps1.powload.tiaoeno

Industry:
Healthcare, Media

Geo:
Australia, Australian

TTPs:
Tactics: 3
Technics: 0

IOCs:
File: 7
Path: 1
IP: 1
Hash: 4
Url: 2

Softs:
wordpress

Algorithms:
zip

Languages:
javascript, php

#ParsedReport
11-01-2023

Dark Pink

https://blog.group-ib.com/dark-pink-apt

Actors/Campaigns:
Darkpink (motivation: financially_motivated, cyber_espionage)
Axiom
Saaiwc

Threats:
Telepowerbot
Kamikakabot
Cucky_stealer
Ctealer_stealer
Dll_sideloading_technique
Powersploit
Uac_bypass_technique

Industry:
Government

Geo:
Indonesian, Cambodia, Iran, China, Pakistan, Vietnamese, Korea, Philippines, Vietnam, Malaysia, Apac, Chinese, Indonesia

TTPs:
Tactics: 2
Technics: 0

IOCs:
Registry: 33
File: 23
Email: 6
Path: 4
Hash: 12

Softs:
telegram, windows defender, chrome, coccoc, chromium, amigo, kometa, nichrome, comodo dragon, vivaldi, have more...

Algorithms:
xor, base64, zip

Win API:
DriveType

#ParsedReport
11-01-2023

Malicious JARs and Polyglot files: Who do you think you JAR?

https://www.deepinstinct.com/blog/malicious-jars-and-polyglot-files-who-do-you-think-you-jar

Threats:
Polyglot
Strrat
Ratty_rat

Geo:
Bulgarian

CVEs:
CVE-2020-1464 [Vulners]
Vulners: Score: 2.1, CVSS: 2.5,
Vulners: Exploitation: True
X-Force: Risk: 5.3
X-Force: Patch: Official fix
Soft:
- microsoft windows 10 (-, 1607, 1709, 1803, 1809, 1903, 1909, 2004)
- microsoft windows 7 (-)
- microsoft windows 8.1 (-)
- microsoft windows rt 8.1 (-)
- microsoft windows server 2008 (-, r2)
have more...

TTPs:
Tactics: 3
Technics: 4

IOCs:
Hash: 40
Domain: 1
Url: 1

Softs:
discord

Algorithms:
zip

Languages:
java

Links:
https://github.com/deepinstinct/RattyConfigExtractor
https://github.com/deepinstinct/JAR-Polyglot-POC
https://github.com/Polydet/polyglot-database

#ParsedReport
12-01-2023

NoName057(16) The Pro-Russian Hacktivist Group Targeting NATO

https://www.sentinelone.com/labs/noname05716-the-pro-russian-hacktivist-group-targeting-nato

Actors/Campaigns:
Noname057 (motivation: hacktivism)
Killnet (motivation: hacktivism)

Threats:
Bobiks
Ddosia_botnet

Industry:
Government, Telco, Financial, Transport

Geo:
Lithuania, Czech, Poland, Ukraine, Russian, Denmark, Polish, Danish, Bulgarian, Dutch, Russia, Ukrainian

IOCs:
Domain: 3
IP: 5
Url: 5
Hash: 12
Email: 1

Softs:
telegram, pyinstaller, macos, android

Languages:
python, golang

#ParsedReport
12-01-2023

Lockbit 3.0 AKA Lockbit Black is here, with a new icon, new ransom note, new wallpaper, but less evasiveness?

https://minerva-labs.com/blog/lockbit-3-0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness

Threats:
Lockbit
Blackcat
Uac_bypass_technique

Geo:
Romanian, Russian, Syria, Belarusian, Moldova, Azerbaijani, Ukrainian

TTPs:
Tactics: 1
Technics: 0

IOCs:
Hash: 1
Registry: 1

Softs:
msexchange, onenote, thebat, wordpad, windows defender

Algorithms:
xor

Functions:
Windows

Win API:
GetSystemDefaultUILanguage, GetUserDefaultUILanguage, NtSetInformationThread

Win Services:
GxVss, GxBlr, GxFWD, GxCVD, GxCIMgr, ocssd, dbsnmp, synctime, agntsvc, isqlplussvc, have more...

#ParsedReport
12-01-2023

New updated IceXLoader claims thousands of victims around the world

https://minerva-labs.com/blog/new-updated-icexloader-claims-thousands-of-victims-around-the-world

Threats:
Icexloader
Process_hollowing_technique
Nimbda_loader
Bazarnimrod
Process_injection_technique

Geo:
Chinese

TTPs:

IOCs:
Path: 8
Registry: 2
File: 4
Command: 2
Hash: 4
Url: 1

Softs:
net framework, windows defender

Win API:
AmsiScanBuffer

Languages:
javascript

#ParsedReport
12-01-2023

Rhadamanthys: New Stealer Spreading Through Google Ads

https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads

Threats:
Rhadamanthys
Anydesk_tool
Antivm
Beacon
Process_injection_technique

Industry:
Financial

TTPs:
Tactics: 8
Technics: 19

IOCs:
Url: 1
File: 5
Domain: 12
Hash: 6

Softs:
zoom, pyinstaller, virtualbox, chrome, opera, pale moon, coccoc, zcash, winscp), (foxmail, have more...

Algorithms:
base64

Win API:
CreateThread, BitBlt

Languages:
python

#ParsedReport
12-01-2023

STOP/DJVU Ransomware

https://minerva-labs.com/blog/stop-djvu-ransomware

Threats:
Stop_ransomware
Process_hollowing_technique
Vidar_stealer
Gozi

Industry:
Financial

Geo:
Tajikistan, Ukraine, Kazakhstan, Uzbekistan, Azerbaijan, Kyrgyzstan, Belarus, Russia, Armenia, Syria

IOCs:
Registry: 1
Path: 2
Url: 2
File: 3

Win API:
InternetReadFile, ShellExecuteA

Platforms:
x86, intel

#ParsedReport
12-01-2023

Trojan Puzzle attack trains AI assistants into suggesting malicious code

https://www.bleepingcomputer.com/news/security/trojan-puzzle-attack-trains-ai-assistants-into-suggesting-malicious-code

Threats:
Trojanpuzzle_technique

Industry:
Education

Geo:
California

Languages:
python

#ParsedReport
12-01-2023

SCATTERED SPIDER Exploits Windows Security Deficiencies with Bring-Your-Own-Vulnerable-Driver Tactic in Attempt to Bypass Endpoint Security

https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic

Actors/Campaigns:
0ktapus

Threats:
Byovd_technique
Kdmapper_tool

Industry:
Bp_outsourcing, Telco

CVEs:
CVE-2015-2291 [Vulners]
Vulners: Score: 7.2, CVSS: 6.7,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.5
X-Force: Patch: Unavailable
Soft:
- intel ethernet diagnostics driver iqvw32.sys (1.03.0.7)
- intel ethernet diagnostics driver iqvw64.sys (1.03.0.7)


IOCs:
File: 2
Hash: 2

Softs:
windows security, windows kernel, microsoft defender for endpoint, windows registry, microsoft windows defender application control

Algorithms:
xor

Functions:
DbgPrintEx

Platforms:
intel

#ParsedReport
13-01-2023

Orcus RAT Being Distributed Disguised as a Hangul Word Processor Crack

https://asec.ahnlab.com/en/45462

Threats:
Orcus_rat
Sbit_rat
Xmrig_miner
Nircmd_tool
Process_hacker_tool
Cobalt_strike
Androm
Trojan/win.injection.c5347028
Orcusrat

Industry:
Media

Geo:
Korean

IOCs:
File: 38
Path: 1
Coin: 1
Hash: 8
Domain: 3
Url: 13

Softs:
task scheduler, microsoft office word, windows defender, telegram, exe,v_ser, process explorer, visual studio

#ParsedReport
13-01-2023

ASEC Weekly Malware Statistics (January 2nd, 2023 January 8th, 2023)

https://asec.ahnlab.com/en/45636

Threats:
Beamwinhttp_loader
Garbage_cleaner
Smokeloader
Agent_tesla
Formbook
Mallox
Clipboard_grabbing_technique

Industry:
Financial

Geo:
Korea

IOCs:
IP: 3
Domain: 9
File: 9
Email: 2
Url: 12

Softs:
telegram, ms-sql

#ParsedReport
15-01-2023

Supply Chain Attack Using Identical PyPI Packages, colorslib, httpslib, and libhttps

https://www.fortinet.com/blog/threat-research/supply-chain-attack-using-identical-pypi-packages-colorslib-httpslib-libhttps

IOCs:
Url: 1
Hash: 3
File: 4
Path: 2

Languages:
python

#ParsedReport
15-01-2023

Cisco Talos Intelligence Blog. Threat Round up for January 6 to January 13

https://blog.talosintelligence.com/threat-roundup-0106-0113

Threats:
Lokibot_stealer
Upatre
Vobfus
Remcos_rat
Adwind_rat
Hawkeye_keylogger
Trickbot
Darkcomet_rat
Shiz

Industry:
Financial

IOCs:
File: 2
Domain: 58
Path: 36
Hash: 199
IP: 56
Email: 23

Softs:
microsoft office, directx

#ParsedReport
15-01-2023

QakBot Malware Used Unpatched Vulnerability to Bypass Windows OS Security Feature

https://blog.eclecticiq.com/qakbot-malware-used-unpatched-vulnerability-to-bypass-windows-os-security-feature

Threats:
Qakbot
Motw_bypass_technique
Lotl_technique
Lolbin_technique
Lolbas_technique
Blackbasta
Process_injection_technique
Process_hollowing_technique
Emotet

Industry:
Government, Financial

Geo:
Russia, Ukraine

CVEs:
CVE-2022-41049 [Vulners]
Vulners: Score: Unknown, CVSS: 2.4,
Vulners: Exploitation: True
X-Force: Risk: 5.4
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2008 (r2, -)
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 21h1, 21h2, 22h2, 1809)
- microsoft windows 8.1 (-, -)
- microsoft windows server 2016 (-)
have more...
CVE-2022-44698 [Vulners]
Vulners: Score: Unknown, CVSS: 2.1,
Vulners: Exploitation: True
X-Force: Risk: 5.4
X-Force: Patch: Official fix
Soft:
- microsoft windows 10 (1607, 1809, 20h2, 21h1, 21h2, 22h2)
- microsoft windows server 2016 (-)
- microsoft windows server 2019 (-)
- microsoft windows server 2022 (-)
- microsoft windows 11 (-, -)
have more...
CVE-2022-41091 [Vulners]
Vulners: Score: Unknown, CVSS: 2.4,
Vulners: Exploitation: True
X-Force: Risk: 5.4
X-Force: Patch: Official fix
Soft:
- microsoft windows 10 (1607, -, 1809, 20h2, 21h1, 21h2, 22h2)
- microsoft windows server 2016 (-)
- microsoft windows server 2019 (-)
- microsoft windows server 2022 (-, -)
- microsoft windows 11 (-, -, 22h2, 22h2)
have more...

TTPs:

IOCs:
File: 6
Hash: 4

Softs:
windows defender smartscreen, windows security, microsoft office, windows error reporting

Algorithms:
xor, crc-32, rc4, zip, base64

Languages:
javascript

YARA: Found

#ParsedReport
15-01-2023

ASEC (20230101 \~ 20230107). ASEC Weekly phishing email threat trend (20230101 \~ 20230107)

https://asec.ahnlab.com/ko/45597

Threats:
Agent_tesla
Formbook
Remcos_rat
Motw_bypass_technique

Industry:
Financial

Geo:
Korean

TTPs:

IOCs:
File: 21
Url: 4

Algorithms:
zip

Links:
https://github.com/nmantani/archiver-MOTW-support-comparison

#technique

Explorer Persistence technique : Hijacking cscapi.dll order loading path and writing our malicious dll into C:\Windows\cscapi.dll , when it's get loaded into the explorer process , our malicoius code get executed. The persistence is triggered each time the explorer process is runned.

https://github.com/D1rkMtr/ExplorerPersist

#ParsedReport
16-01-2023

Decrypted: BianLian Ransomware

https://decoded.avast.io/threatresearch/decrypted-bianlian-ransomware/?utm_source=rss&utm_medium=rss&utm_campaign=decrypted-bianlian-ransomware

Threats:
Hydra

Industry:
Healthcare, Entertainment

IOCs:
File: 2
Command: 1
Path: 3
Hash: 7

Softs:
windows explorer

Algorithms:
cbc, aes, aes-256

#ParsedReport
16-01-2023

Attackers Infected a CircleCI Employee with Malware to Steal Customer Session Tokens

https://socradar.io/attackers-infected-a-circleci-employee-with-malware-to-steal-customer-session-tokens

Geo:
Quebec

IOCs:
IP: 8
File: 1
Domain: 1

#ParsedReport
16-01-2023

Gotta Catch Em All \| Understanding the NetSupport RAT Campaigns Hiding Behind Pokemon Lures

https://www.sentinelone.com/blog/gotta-catch-em-all-understanding-the-netsupport-rat-campaigns-hiding-behind-pokemon-lures

Threats:
Netsupportmanager_rat
Teamviewer_tool
Andromeda
Nanocore_rat
Cirenegrat
Meteor_wiper
Ragnarlocker
Maze
Babadeda

Industry:
E-commerce, Financial

TTPs:
Tactics: 1
Technics: 13

IOCs:
File: 6
Hash: 16
Domain: 1

Softs:
google chrome

Algorithms:
base64

Win API:
GetAdaptersAddresses, IsDebuggerPresent, EnumProcesses

Platforms:
x86