Коллеги, прошу прощения, что не все TI-отчеты попадают на канал.
Пока работает старая версия робота для определения TI-отчета в потоке новостей. Раньше, то что не смог определить робот я докидывал в канал руками.
Сейчас все силы бросил на дописывание новой версии робота.
Надеюсь, что через неделю запущу его в продакшен.
Пока работает старая версия робота для определения TI-отчета в потоке новостей. Раньше, то что не смог определить робот я докидывал в канал руками.
Сейчас все силы бросил на дописывание новой версии робота.
Надеюсь, что через неделю запущу его в продакшен.
👍1
Tue, 01 Mar 2022 14:18:27 +0000
Daxin: Stealthy Backdoor Designed for Attacks Against Hardened Networks
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage
Security
Daxin: Stealthy Backdoor Designed for Attacks Against Hardened Networks
Espionage tool is the most advanced piece of malware Symantec researchers have seen from China-linked actors.
Tue, 01 Mar 2022 14:19:05 +0000
Conti and Karma actors attack healthcare provider at same time through ProxyShell exploits
https://news.sophos.com/en-us/2022/02/28/conti-and-karma-actors-attack-healthcare-provider-at-same-time-through-proxyshell-exploits/
Sophos News
Conti and Karma actors attack healthcare provider at same time through ProxyShell exploits
An unpatched Microsoft Exchange Server let both ransomware actors in; Karma just stole data, while Conti encrypted.
Tue, 01 Mar 2022 14:20:28 +0000
Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot
https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/
Unit 42
Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot
An attack in early February targeted an energy organization in Ukraine with OutSteel and SaintBot. The attack is part of a larger campaign.
Tue, 01 Mar 2022 14:20:39 +0000
SockDetour – a Silent, Fileless, Socketless Backdoor – Targets U.S. Defense Contractors
https://unit42.paloaltonetworks.com/sockdetour/
Unit 42
SockDetour – a Silent, Fileless, Socketless Backdoor – Targets U.S. Defense Contractors
SockDetour is a custom backdoor being used to maintain persistence, designed to serve as a backup backdoor in case the primary one is removed.
Tue, 01 Mar 2022 14:29:27 +0000
Elections GoRansom – a smoke screen for the HermeticWiper attack
https://securelist.com/elections-goransom-and-hermeticwiper-attack/105960/
Securelist
Elections GoRansom – a smoke screen for the HermeticWiper attack
We present our analysis of HermeticRansom (aka Elections GoRansom) ransomware that was likely used as a smokescreen for the HermeticWiper attack.
Tue, 01 Mar 2022 16:34:17 +0000
The InQuest Insider Issue #42 - Glowspark
https://inquest.net/newsletter/2022/03/inquest-insider-issue-42-glowspark
inquest.net
InQuest - Join the Hunt.
InQuest provides Deep File Inspection (DFI) for real-time protection and RetroHunting to leverage hindsight and apply today's intelligence to yesterday's data.
Tue, 01 Mar 2022 21:18:36 +0000
Decryptable PartyTicket Ransomware Reportedly Targeting Ukrainian Entities
https://www.crowdstrike.com/blog/how-to-decrypt-the-partyticket-ransomware-targeting-ukraine/
crowdstrike.com
How to Decrypt the PartyTicket Ransomware Targeting Ukraine | CrowdStrike
We explain how PartyTicket ransomware used in Ukraine attacks only superficially encrypts files, and outline how it's possible to recover the encrypted files.
Tue, 01 Mar 2022 22:51:28 +0000
Asylum Ambuscade: State Actor Uses Compromised Private Ukrainian Military Emails to Target European Governments and Refugee Movement
https://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails
Proofpoint
SunSeed Malware Targets Refugees & EU Government | Proofpoint US
Proofpoint has identified a campaign using a Lua-based malware dubbed SunSeed. Learn more about the attack with Proofpoint's in-depth report.
#technique
Rogue RDP – Revisiting Initial Access Methods
https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
Rogue RDP – Revisiting Initial Access Methods
https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
Black Hills Information Security, Inc.
Rogue RDP – Revisiting Initial Access Methods - Black Hills Information Security, Inc.
Mike Felch // The Hunt for Initial Access With the default disablement of VBA macros originating from the internet, Microsoft may be pitching a curveball to threat actors and red […]
Tue, 01 Mar 2022 22:55:01 +0000
IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine
https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/
WeLiveSecurity
IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine
ESET researchers uncover IsaacWiper, a new wiper that attacks Ukrainian organizations and HermeticWizard, a worm spreading HermeticWiper in local networks.
Tue, 01 Mar 2022 22:55:43 +0000
The Hunt for the Lost Soul: Unraveling the Evolution of the SoulSearcher Malware
https://www.fortinet.com/blog/threat-research/unraveling-the-evolution-of-the-soul-searcher-malware
Fortinet Blog
The Hunt for the Lost Soul: Unraveling the Evolution of the SoulSearcher Malware
FortiGuard Labs provides a deep analysis of the evolution of SoulSearcher malware focusing on a malicious DLL payload module. With reverse engineering the team analyzes the different components and…
Tue, 01 Mar 2022 22:56:01 +0000
Nobelium Returns to the Political World Stage
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Fortinet Blog
Nobelium Returns to the Political World Stage | FortiGuard Labs
FortiGuard Labs has discovered evidence that the Nobelium Group is impersonating someone associated with the Turkish embassy as a lure to introduce a Cobalt Strike beacon payload and gain access. R…
Tue, 01 Mar 2022 22:56:50 +0000
The Conti ransomware leaks
https://blog.malwarebytes.com/threat-intelligence/2022/03/the-conti-ransomware-leaks/
Malwarebytes Labs
The Conti ransomware leaks
Perhaps one of the most interesting leaks for the threat intelligence community, the Conti data dumps will provide invaluable data for a long time to come.
Tue, 01 Mar 2022 23:17:18 +0000
Malware Analysis Report – Rewterz | LokiBOT
https://www.rewterz.com/articles/malware-analysis-report-rewterz-lokibot
Rewterz
Malware Analysis Report - Rewterz | LokiBOT | Rewterz
Malware Analysis Report - Rewterz | LokiBOT
Wed, 02 Mar 2022 04:01:50 +0000
Magniber Disguised as Normal Windows Installer (MSI) Being Redistributed (February 22nd)
https://asec.ahnlab.com/en/32226/
ASEC BLOG
Magniber Disguised as Normal Windows Installer (MSI) Being Redistributed (February 22nd) - ASEC BLOG
In the morning of February 22nd, the ASEC analysis team has discovered the redistribution of Magniber that disguised itself as normal Windows Installers (MSI) instead of the previous Windows app (APPX) The distributed Magniber files have MSI as their extension…
Wed, 02 Mar 2022 21:23:15 +0000
DanaBot Launches DDoS Attack Against the Ukrainian Ministry of Defense
https://www.zscaler.com/blogs/security-research/danabot-launches-ddos-attack-against-ukrainian-ministry-defense
Zscaler
DanaBot Launches DDoS Attack | ThreatLabz
Researchers at Zscaler discovered a DDoS attack launched by DanaBot against the Ukrainian Ministry of Defense.
Thu, 03 Mar 2022 02:15:23 +0000
ASEC Weekly Malware Statistics (February 21st, 2022 – February 27th, 2022)
https://asec.ahnlab.com/en/32293/
ASEC BLOG
ASEC Weekly Malware Statistics (February 21st, 2022 - February 27th, 2022) - ASEC BLOG
The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from February 21st, 2022 (Monday) to February 27th, 2022 (Sunday). For the main category,…
Thu, 03 Mar 2022 09:37:08 +0000
Help for Ukraine: Free decryptor for HermeticRansom ransomware
https://decoded.avast.io/threatresearch/help-for-ukraine-free-decryptor-for-hermeticransom-ransomware/?utm_source=rss&utm_medium=rss&utm_campaign=help-for-ukraine-free-decryptor-for-hermeticransom-ransomware
Avast Threat Labs
Help for Ukraine: Free decryptor for HermeticRansom ransomware - Avast Threat Labs
On February 24th, the Avast Threat Labs discovered a new ransomware strain accompanying the data wiper HermeticWiper malware, which our colleagues at ESET found circulating in the Ukraine. Following this naming convention, we opted to name the strain we…
Thu, 03 Mar 2022 14:17:27 +0000
Cyberattacks are Prominent in the Russia-Ukraine Conflict
https://www.trendmicro.com/en_us/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict.html
Trend Micro
Cyberattacks are Prominent in the Russia-Ukraine Conflict
Fri, 04 Mar 2022 03:35:07 +0000
Ongoing Cyberwarfare
https://blog.cyble.com/2022/02/25/ongoing-cyberwarfare/
Cyble
Ongoing Cyberwarfare
Cyble Research Labs analyzes significant acts of cyberwarfare that have occurred so far in the Russia-Ukraine Conflict.