#ParsedReport
05-05-2022

Mustang Panda deploys a new wave of malware targeting Europe

http://blog.talosintelligence.com/2022/05/mustang-panda-targets-europe.html

Actors/Campaigns:
Red_delta (tags: trojan, rat, phishing, malware)

Threats:
Meterpreter_tool (tags: rat, malware)
Plugx_rat (tags: rat, malware)
Cobalt_strike
Bespoke (tags: rat, malware)
Lolbas_technique

Industry:
Telco, Government, Ngo

Geo:
Russia, Mongolia, Afghan, Japanese, Ukraine, Asia, Tibet, Japan, Taiwan, Ukrainian, Belarus, Myanmar, Greece, Indian, American, Asian

IOCs:
File: 14
IP: 28
Path: 5
Registry: 1
Hash: 114
Domain: 1
Url: 44

#ParsedReport
05-05-2022

"Excuse me, how will the conflict between Russia and Ukraine affect the situation on the peninsula?" Analysis of the recent targeted attack activities of APT organization Kimsuky

https://blog-nsfocus-net.translate.goog/apt-kimsuky-3/?_x_tr_sch=http&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp

Actors/Campaigns:
Kimsuky (tags: trojan, phishing, malware)

Geo:
Ukraine, Korea, Russia

IOCs:
File: 27
Url: 7
Path: 1

#ParsedReport
05-05-2022

North Koreas Lazarus: their initial access trade-craft using social media and social engineering. tl;dr

https://research.nccgroup.com/2022/05/05/north-koreas-lazarus-and-their-initial-access-trade-craft-using-social-media-and-social-engineering

Actors/Campaigns:
Lazarus (tags: malware, vpn, phishing)

Threats:
Lcpdot (tags: vpn, malware)

Industry:
Government

Geo:
Koreas

TTPs:
Tactics: 1
Technics: 4

IOCs:
Domain: 6
Path: 2
File: 3
IP: 1
Hash: 6

#ParsedReport
05-05-2022

Nigerian Tesla: 419 scammer gone malware distributor unmasked

https://blog.malwarebytes.com/threat-intelligence/2022/05/nigerian-tesla-419-scammer-gone-malware-distributor-unmasked

Threats:
Agent_tesla (tags: phishing, ransomware, malware, spam, stealer, scam, dns, vpn)
Avemaria_rat
Netwire_rat
4shared
Cassandraprotector_tool

Geo:
Nigeria, Nigerian, Ukraine, Ukrainian

IOCs:
File: 2
Email: 25
Domain: 1

#ParsedReport
05-05-2022

Cybercrime loves company: Conti cooperated with other ransomware gangs

https://intel471.com/blog/conti-ransomware-cooperation-maze-lockbit-ragnar-locker

Threats:
Conti (tags: ransomware, malware)
Ryuk (tags: ransomware)
Maze (tags: ransomware)
Lockbit (tags: ransomware)
Ragnarlocker (tags: ransomware)
Emotet (tags: ransomware)
Trickbot

Geo:
Russian

#ParsedReport
05-05-2022

Shells blooming in Spring

https://labs.k7computing.com/index.php/shells-blooming-in-spring

Threats:
Spring4shell (tags: rat)
Log4shell_vuln (tags: rat)
Mirai
Emotet

CVEs:
CVE-2022-22965 [Vulners]
Vulners: Score: 7.5, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- vmware spring framework (<5.2.20, <5.3.18)
- cisco cx cloud agent (<2.1.0)
- oracle communications cloud native core automated test suite (1.9.0, 22.1.0)
- oracle communications cloud native core console (1.9.0, 22.1.0)
- oracle communications cloud native core network exposure function (22.1.0)
have more...
CVE-2022-22695 [Vulners]
CVE-2022-22963 [Vulners]
Vulners: Score: 7.5, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- vmware spring cloud function (le3.1.6, le3.2.2)


IOCs:
File: 8
Hash: 1

Links:
https://github.com/dinosn/CVE-2022-22963
https://github.com/lunasec-io/Spring4Shell-POC
https://github.com/reznok/Spring4Shell-POC

#ParsedReport
06-05-2022

Mobile subscription Trojans and their little tricks

https://securelist.com/mobile-subscription-trojans-and-their-tricks/106412

Threats:
Vesub (tags: trojan, malware)
Triada
Joker (tags: trojan)

Industry:
E-commerce, Financial

Geo:
Russia, Arabia, Russian, Indonesia, Austria, China, Brazil, Saudi, Switzerland, Mexico, Turkey, Egypt, Poland, India, Germany, Africa, Thailand, Belarus, Algeria, Ukraine, Arab, Malaysia, Oman

IOCs:
File: 4
Hash: 37

#ParsedReport
06-05-2022

macOS Malware Is More Reality Than Myth: Popular Threats and Challenges in Analysis

https://www.crowdstrike.com/blog/how-crowdstrike-analyzes-macos-malware-to-optimize-automated-detection-capabilities

Threats:
Applescript

TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 2
Hash: 9

#ParsedReport
06-05-2022

Raspberry Robin gets the worm early

https://redcanary.com/blog/raspberry-robin

Threats:
Raspberry_robin (tags: rat, malware)

TTPs:
Tactics: 5
Technics: 5

IOCs:
File: 11
Path: 6
Domain: 2
Hash: 2
Registry: 1
Url: 2

#ParsedReport
06-05-2022

Bad Rabbit Ransomware

https://www.varonis.com/blog/bad-rabbit-ransomware

Actors/Campaigns:
Sandworm

Threats:
Watering_hole_technique
Imminentmonitor_rat
Mimikatz
Mamba
Stop

Industry:
Financial

Geo:
Russia, Ukraines, Russian, Japan

CVEs:
CVE-2017-0145 [Vulners]
Vulners: Score: 9.3, CVSS: 8.9,
Vulners: Exploitation: True
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- microsoft server message block (1.0)


IOCs:
Domain: 1
IP: 1
Url: 26
Hash: 6

Links:
https://github.com/worawit/MS17-010/blob/master/zzz\_exploit.py

#ParsedReport
06-05-2022

Emotet: New Delivery Mechanism to Bypass VBA Protection

https://www.netskope.com/blog/emotet-new-delivery-mechanism-to-bypass-vba-protection

Threats:
Emotet (tags: botnet, rat, trojan, malware, phishing, fraud)
Trickbot
Spring4shell

Industry:
Financial

IOCs:
File: 9
Hash: 143
Url: 12
IP: 67

YARA: Found

Links:
https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Emotet/IOCs/2022-05-06
https://github.com/netskopeoss/NetskopeThreatLabsIOCs/blob/main/Emotet/IOCs/script/decrypt\_payload.py
https://github.com/netskopeoss/NetskopeThreatLabsIOCs/blob/main/Emotet/IOCs/script/decrypt\_c2.py
https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Emotet

Сегодня на PhDays рассказал про то как у нас в RST Cloud работает скоринг индикаторов.
Вот преза, кстати :)

#ParsedReport
19-05-2022

Space Pirates: Explore the tools and connections of a new hacker group

https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/space-pirates-tools-and-connections

Actors/Campaigns:
Spacepirates (tags: dropper, malware, dns, backdoor, rat, phishing, proxy)
Axiom
Emissary_panda
Ta428
Red_delta
Redfoxtrot
Stealthytrident
Nightscout

Threats:
Zupdax (tags: rat)
Former_first_rat
Climax_loader
Rtlshare
Plugx_rat (tags: backdoor, dropper)
9002 (tags: rat)
Deed_rat (tags: dns, rat)
Pcshare
Poison_ivy
Shadowpad
Revbshell
Tmanger
Albaniiutas_rat
Bluetraveller_rat
Hyperbro
Smokeloader_backdoor
Reactorbot
Gh0st_rat
Chromepass_tool

Industry:
Aerospace, Financial, Government, Energy

Geo:
Asian, Chinese, Russia, Mongolia, Georgia, Japanese

CVEs:
CVE-2017-0213 [Vulners]
Vulners: Score: 1.9, CVSS: 6.4,
Vulners: Exploitation: True
X-Force: Risk: 7
X-Force: Patch: Official fix
Soft:
- microsoft windows 10 (1607, -, 1511, 1703)
- microsoft windows rt 8.1 (*)
- microsoft windows server 2012 (-, r2)
- microsoft windows server 2008 (r2, *)
- microsoft windows 8.1 (*)
have more...

TTPs:
Tactics: 10
Technics: 54

IOCs:
File: 51
Path: 20
Email: 1
IP: 23
Hash: 156
Registry: 8

Links:
https://translate.google.com/website?sl=auto&tl=en&hl=ru&client=webapp&u=https://github.com/obfuscator-llvm/obfuscator/wiki/Control-Flow-Flattening
https://translate.google.com/website?sl=auto&tl=en&hl=ru&client=webapp&u=https://github.com/bitsadmin/ReVBShell
https://translate.google.com/website?sl=auto&tl=en&hl=ru&client=webapp&u=https://github.com/vzex/dog-tunnel
https://translate.google.com/website?sl=auto&tl=en&hl=ru&client=webapp&u=https://github.com/LiveMirror/pcshare

#ParsedReport
19-05-2022

Phishing Campaign Delivering Three Fileless Malware: AveMariaRAT / BitRAT / PandoraHVNC Part I

https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware

Actors/Campaigns:
Keksec (tags: malware, phishing)

Threats:
Avemaria_rat (tags: ransomware, spam, malware, phishing, rat, ddos, proxy, botnet)
Sbit_rat (tags: ransomware, spam, malware, phishing, rat, ddos, proxy, botnet)
Pandorahvnc (tags: spam, botnet, malware, phishing, rat, ddos, proxy, ransomware)
Emotet (tags: malware, phishing)
Enemybot (tags: malware, phishing)
Vba/agent.ddon!tr (tags: malware)

Industry:
Financial

IOCs:
File: 17
Url: 5
Path: 2
Hash: 3

#ParsedReport
19-05-2022

The BlackByte ransomware group is striking users all over the globe

http://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html

Threats:
Blackbyte (tags: vpn, phishing, malware, ransomware)
Lolbin
Anydesk_tool
Proxyshell_vuln
Psexec_tool

Industry:
Financial

Geo:
Mexico, Netherlands, America, China, Colombia, Vietnam

IOCs:
File: 5
Path: 1

Links:
https://github.com/Neo23x0/Raccine

#ParsedReport
19-05-2022

Chaos Ransomware Variant Sides with Russia

https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-sides-with-russia

Threats:
Chaos (tags: phishing, ransomware, malware)
Conti (tags: ransomware)
Lockbit (tags: ransomware)
Filecoder

Industry:
Financial

Geo:
Russia, Japanese, Ukraine

TTPs:
Tactics: 5
Technics: 6

IOCs:
File: 1
Hash: 1

#ParsedReport
19-05-2022

New SYK Crypter Distributed Via Discord

https://blog.morphisec.com/syk-crypter-discord

Threats:
Babadeda (tags: ransomware)
Dnetloader (tags: rat, ransomware, malware, stealer)
Asyncrat_rat (tags: ransomware)
Njrat_rat (tags: ransomware)
Quasar_rat (tags: ransomware)
Avemaria_rat (tags: ransomware)
Nanocore_rat (tags: ransomware)
Redline_stealer (tags: ransomware)
Agent_tesla

TTPs:
Tactics: 2
Technics: 0

IOCs:
File: 6
Url: 26
Domain: 17
IP: 2
Path: 5
Hash: 47

#ParsedReport
20-05-2022

Why Remediation Alone Is Not Enough When Infected by Malware

https://asec.ahnlab.com/en/34549

Actors/Campaigns:
Darkside (tags: malware)

Threats:
Cobalt_strike (tags: malware)
Runminer
Reverserdp_technique
Dropper/win.agent
Dropper/win32.agent
Nbtscan_tool
Malware/win64.generic
Win_loader

Geo:
Korean

CVEs:
CVE-2017-10271 [Vulners]
Vulners: Score: 5.0, CVSS: 4.9,
Vulners: Exploitation: True
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- oracle weblogic server (10.3.6.0.0, 12.2.1.1.0, 12.1.3.0.0, 12.2.1.2.0)


IOCs:
IP: 6
File: 4
Hash: 21

#ParsedReport
20-05-2022

Emotet Being Distributed Using Various Files

https://asec.ahnlab.com/en/34556

Threats:
Emotet (tags: rat, trojan, malware)
Findpos
Trojan/win.agent.r488899

Industry:
Financial

Geo:
Korea

IOCs:
Url: 18
File: 24
Path: 1
Hash: 4

#ParsedReport
20-05-2022

XLL malware distributed through mail

https://asec-ahnlab-com.translate.goog/ko/34497/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp

Threats:
Lokibot_stealer (tags: malware)
Trojan/win.agent.c5025449 (tags: malware)
Ransomware/win.carlos.c5025252 (tags: malware)

Geo:
Korea

IOCs:
File: 4
Url: 3
Hash: 5

#ParsedReport
20-05-2022

Weaponization of Excel Add-Ins Part 2: Dridex Infection Chain Case Studies

https://unit42.paloaltonetworks.com/excel-add-ins-dridex-infection-chain

Threats:
Dridex (tags: malware, rat, dropper)
Agent_tesla
Atomic_bombing_technique

Geo:
Japan, Apac, Emea, America

IOCs:
File: 2
Hash: 6338
Url: 1496
IP: 4

Links:
https://github.com/pan-unit42/iocs/blob/master/Dridex%20Infection%20Chain%20Case%20Studies