#ParsedReport
14-04-2022

Old Gremlins, new methods

https://blog.group-ib.com/oldgremlin_comeback

Actors/Campaigns:
Oldgremlin
Molerats

Industry:
Healthcare, Financial, Petroleum

Geo:
Belarus, Russia

IOCs:
Domain: 12
File: 12
Url: 8
Path: 2
IP: 4
Hash: 5

#ParsedReport
14-04-2022

Zloader 2: The Silent Night

https://decoded.avast.io/vladimirmartyanov/zloader-the-silent-night/?utm_source=rss&utm_medium=rss&utm_campaign=zloader-the-silent-night

Threats:
Z_loader
Zeus
Exodus
Raccoon_stealer
Gozi

Industry:
Financial

IOCs:
Hash: 5
File: 6
Registry: 1
Domain: 6

#ParsedReport
18-04-2022

Orion Threat Alert: Flight of the BumbleBee. A new campaign in the wild: BumbleBee

https://www.cynet.com/orion-threat-alert-flight-of-the-bumblebee

Actors/Campaigns:
Exotic_lily
Wizard_spider
Molerats

Threats:
Bumblebee (tags: spam, malware, phishing, ransomware, rat)
Cobalt_strike
Lolbin
Fake-trusteer
Bazarbackdoor
Icedid
Conti
Lockbit
Avoslocker
Emotet

Industry:
Financial

TTPs:
Tactics: 6
Technics: 0

IOCs:
File: 15
Path: 1
IP: 9
Hash: 9
Domain: 3

#ParsedReport
18-04-2022

An Investigation of the BlackCat Ransomware via Trend Micro Vision One. Finding the threats

https://www.trendmicro.com/en_us/research/22/d/an-investigation-of-the-blackcat-ransomware.html

Threats:
Blackcat (tags: backdoor, scan, dns, ransomware, malware, rat)
Cobalt_strike (tags: ransomware)
Proxyshell_vuln
Proxylogon_exploit
Netscan_tool
Bloodhound_tool
Crackmapexec_tool
Mimikatz
Lolbin

CVEs:
CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: 6.6
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)

CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)

CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9.1
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)


TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 13
IP: 2
Path: 1
Hash: 25
Domain: 1

Links:
https://github.com/Kevin-Robertson/Inveigh

#ParsedReport
18-04-2022

From the Front Lines \| Peering into A PYSA Ransomware Attack

https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack

Actors/Campaigns:
Quickbooks

Threats:
Mespinoza (tags: malware, phishing, ransomware, backdoor)
Lolbin
Cobalt_strike
Empire_loader
Chisel_tool
Powershell_ransomware
Psexec_tool
Koadic_tool
Mimikatz
Anydesk_tool
Magicsocks

Industry:
Government, Education, Healthcare

TTPs:
Tactics: 3
Technics: 19

IOCs:
File: 12
Path: 3
Hash: 40

Links:
https://github.com/winscp/winscp
https://github.com/jpillora/chisel

#ParsedReport
18-04-2022

How to recover files encrypted by Yanlouwang

https://securelist.com/how-to-recover-files-encrypted-by-yanlouwang/106332

Threats:
Yanluowang (tags: vpn, trojan, malware, ransomware, rat)

Industry:
Financial

Geo:
Brazil, Turkey, Chinese

IOCs:
File: 1
Hash: 2

#ParsedReport
18-04-2022

Threat Spotlight: Conti Ransomware Group Behind theKarakurt Hacking Team. Threat Spotlight: Conti Ransomware Group Behind the Karakurt Hacking Team

https://www.infinitumit.com.tr/conti-ransomware-group-behind-the-karakurt-hacking-team

Threats:
Conti (tags: phishing, ransomware, malware, rat, dns, vpn, proxy)
Cobalt_strike
Anydesk_tool
Mimikatz
Metasploit_tool
Ligolo
Log4shell_vuln

Industry:
Government

Geo:
Germany, Canada, Russian

CVEs:
CVE-2021-44228 [Vulners]
Vulners: Score: 9.3, CVSS: 4.0,
Vulners: Exploitation: True
X-Force: Risk: 10
X-Force: Patch: Official fix
Soft:
- apache log4j (2.0, 2.0, 2.0, 2.0, <2.3.1, <2.12.2, <2.15.0)
- siemens sppa-t3000 ses3000 firmware (*)
- siemens captial (<2019.1, 2019.1, 2019.1)
- siemens comos (*)
- siemens desigo cc advanced reports (4.0, 4.1, 4.2, 5.0, 5.1)
have more...

TTPs:
Tactics: 9
Technics: 23

IOCs:
Domain: 1
IP: 21
File: 3
Url: 2

Links:
https://github.com/tnpitsecurity/ligolo-ng
https://github.com/infinitumitlabs
https://github.com/rapid7/metasploit-framework
https://github.com/Lozy/danted
https://github.com/SecureAuthCorp/impacket
https://github.com/infinitumitlabs/Karakurt-Hacking-Team-CTI

#ParsedReport
19-04-2022

VajraSpy An Android RAT

https://labs.k7computing.com/index.php/vajraspy-an-android-rat

Actors/Campaigns:
Vajraeleph (tags: rat)

Threats:
Vajraspy (tags: spyware, malware, rat)
Cryptoclip

Geo:
Pakistani

IOCs:
File: 6
Hash: 1

#ParsedReport
19-04-2022

BAZARLOADER: Unpacking an ISO File Infection. Step 1: Mounting ISO File & Extracting Stage 1 Executable

https://www.0ffset.net/reverse-engineering/bazarloader-iso-file-infection/?utm_source=rss&utm_medium=rss&utm_campaign=bazarloader-iso-file-infection

Threats:
Bazarbackdoor
Metasploit_tool
Cobalt_strike

IOCs:
File: 4
Hash: 1

Links:
https://github.com/OALabs/hashdb-ida
https://github.com/mandiant/flare-emu
https://github.com/OALabs/hashdb/blob/b3cc544fad41c749d04616663ac13f02bf1aaf37/algorithms/metasploit.py
https://github.com/OALabs/BlobRunner

#technique

Не отчет, но описание еще одного ИБ-камня в огород open source

https://checkmarx.com/blog/starjacking-making-your-new-open-source-package-popular-in-a-snap/

#ParsedReport
20-04-2022

Nobelium - Israeli Embassy Maldoc

https://inquest.net/blog/2022/04/18/nobelium-israeli-embassy-maldoc

Actors/Campaigns:
Darkhalo

Threats:
Comrade_circle

Geo:
Israeli, Spain

IOCs:
Hash: 5
File: 1
Path: 1
Url: 2

#ParsedReport
20-04-2022

Shuckworm: Espionage Group Continues Intense Campaign Against Ukraine

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-intense-campaign-ukraine

Actors/Campaigns:
Gamaredon (tags: malware, backdoor)

Threats:
Pterodo (tags: rat, dropper)

Geo:
Russian, Ukraine

IOCs:
File: 9
Path: 1
Domain: 1
Hash: 162
Url: 77

Links:
https://github.com/Symantec/threathunters/tree/main/Shuckworm

#ParsedReport
20-04-2022

Reversing a NSIS dropper using quick and dirty shellcode emulation. The Excel document

https://malcat.fr/blog/reversing-a-nsis-dropper-using-quick-and-dirty-shellcode-emulation

Threats:
Nsis_dropper (tags: malware, stealer, rat)
Dbat_loader
Lokibot_stealer (tags: malware, rat, stealer)

CVEs:
CVE-2018-0798 [Vulners]
Vulners: Score: 9.3, CVSS: 9.3,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft office (2010, 2016, 2016, 2007, 2013)
- microsoft word (2013, 2016, 2007, 2010, 2013)
- microsoft office compatibility pack (-)

IOCs:
Url: 1
File: 2
Hash: 4

Links:
https://github.com/mandiant/speakeasy

A Detailed Analysis of The SunCrypt Ransomware

https://securityscorecard.com/resources/analysis-of-the-suncrypt-ransomware

#ParsedReport
21-04-2022

LemonDuck Targets Docker for Cryptomining Operations

https://www.crowdstrike.com/blog/lemonduck-botnet-targets-docker-for-cryptomining-operations

Threats:
Lemonduck (tags: botnet, dropper, rat, cryptomining, malware)
Proxylogon_exploit
Eternalblue_vuln
Bluekeep_vuln
Cr8escape_vuln
Xmrig_miner

TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 2
Domain: 1

Links:
https://github.com/xmrig/xmrig-proxy

#ParsedReport
21-04-2022

Hackers Spearphish Corporate Hiring Managers with Poisoned Resumes, Infecting Them with the More_Eggs Malware, Warns eSentire

https://www.esentire.com/blog/hackers-spearphish-corporate-hiring-managers-with-poisoned-resumes-infecting-them-with-the-more-eggs-malware

Actors/Campaigns:
Venom_spider
Magecart (tags: ransomware, malware, backdoor)
Evilnum (tags: ransomware, malware, backdoor)

Threats:
More_eggs (tags: rat, ransomware, malware, phishing, backdoor)
Cobalt (tags: ransomware, malware, backdoor)
Terra_loader
Meterpreter_tool
Metasploit_tool
Terra_stealer
Lolbin

Industry:
Aerospace, Retail, Healthcare, E-commerce, Financial

Geo:
Canada

TTPs:
Tactics: 5
Technics: 28

IOCs:
File: 10
Hash: 5

#ParsedReport
21-04-2022

Warez users fell for Certishell. Sivpici\.php5\.sk

https://decoded.avast.io/danielbenes/warez-users-fell-for-certishell/?utm_source=rss&utm_medium=rss&utm_campaign=warez-users-fell-for-certishell

Threats:
Certishell (tags: fraud, ddos, ransomware, rat, malware, keylogger, cryptomining)
Xmrig_miner (tags: cryptomining)
Vmprotect (tags: cryptomining)
Filecoder
Themida_packer_tool (tags: cryptomining)

Geo:
Slovakia, Czech

IOCs:
Domain: 3
File: 33
Registry: 2
Url: 272
Hash: 554

Links:
https://github.com/monoxgas/sRDI
https://github.com/avast/ioc/blob/master/Certishell/samples.sha256
https://github.com/avast/ioc/blob/master/Certishell/network.txt
https://github.com/avast/ioc/tree/master/Certishell

#ParsedReport
21-04-2022

Android/Bianlian Botnet Trying to Bypass Photo TAN Used for Mobile Banking

https://www.fortinet.com/blog/threat-research/android-bianlian-botnet-mobile-banking

Threats:
Hydra (tags: botnet, malware)

Industry:
Financial

IOCs:
Hash: 1
Url: 2
File: 6

#ParsedReport
21-04-2022

New BotenaGo Variant Discovered by Nozomi Networks Labs

https://www.nozominetworks.com/blog/new-botenago-variant-discovered-by-nozomi-networks-labs

Threats:
Botenago (tags: botnet, scan, malware)
Alien
Lillin_scanner_tool (tags: malware)
Mirai (tags: botnet, scan, malware)
Log4shell_vuln

Industry:
Energy, Iot, Media

IOCs:
IP: 1
Hash: 3

#ParsedReport
21-04-2022

Analyzing Attempts to Exploit the Spring4Shell Vulnerability CVE-2022-22965 to Deploy Cryptocurrency Miners. A high number of exploitation attempts

https://www.trendmicro.com/en_us/research/22/d/spring4shell-exploited-to-deploy-cryptocurrency-miners.html

Threats:
Spring4shell (tags: cryptomining, malware, botnet, rat)
Mirai (tags: cryptomining)
Malxmr_miner

CVEs:
CVE-2022-22965 [Vulners]
Vulners: Score: 7.5, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- vmware spring framework (<5.2.20, <5.3.18)
- cisco cx cloud agent (<2.1.0)
- oracle communications cloud native core automated test suite (1.9.0, 22.1.0)
- oracle communications cloud native core console (1.9.0, 22.1.0)
- oracle communications cloud native core network exposure function (22.1.0)
have more...

IOCs:
File: 2
Path: 1
IP: 1
Hash: 4

#ParsedReport
21-04-2022

Threat Assessment: BlackByte Ransomware

https://unit42.paloaltonetworks.com/blackbyte-ransomware

Threats:
Blackbyte (tags: proxy, spyware, rat, malware, ransomware, dns)
Proxyshell_vuln (tags: ransomware)
Lockbit
Cobalt_strike (tags: ransomware)

Industry:
Energy, E-commerce, Financial, Ics

Geo:
America, Asia, Africa, Australia, Canada, Russian, Apac, Japan, Emea

CVEs:
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9.1
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)

CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 9
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)

CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: 6.6
X-Force: Patch: Official fix
Soft:
- microsoft exchange server (2013, 2016, 2016, 2019, 2019)


TTPs:
Tactics: 10
Technics: 17

IOCs:
IP: 7
Domain: 1
File: 9
Registry: 1
Coin: 1

Links:
https://github.com/SpiderLabs/BlackByteDecryptor