#ParsedReport
31-05-2022

Staying Ahead of CVE-2022-30190 (Follina)

https://www.sentinelone.com/blog/staying-ahead-of-cve-2022-30190-follina

Threats:
Follina_vuln (tags: malware)
Log4shell_vuln
Beacon

Geo:
Chinese, Ukraine, Russian, Belarus

CVEs:
CVE-2022-30190 [Vulners]

IOCs:
Hash: 2
Domain: 2
IP: 1
Registry: 2
File: 5

Functions Names: 1

#ParsedReport
01-06-2022

MSDT abused to achieve RCE on Microsoft Office

https://blog.sekoia.io/msdt-abused-to-achieve-rce-on-microsoft-office

Threats:
Follina_vuln
Cobalt_strike
Beacon
Plugx_rat
Lolbas_technique

Geo:
Chinese, Philippines, Russian, Nepal, Ukraine

CVEs:
CVE-2022-30190 [Vulners]

TTPs:

IOCs:
Hash: 9
File: 4
Domain: 6
Url: 5
IP: 3

YARA: Found
SIGMA: Found

#ParsedReport
01-06-2022

Minerva Labs Blog

https://blog.minerva-labs.com/new-microsoft-office-follina-zero-day-already-shared-on-ransomware-forums

Threats:
Follina_vuln
Conti (tags: ransomware)
Blackcat (tags: ransomware)

Geo:
Russian

CVEs:
CVE-2022-30190 [Vulners]

#ParsedReport
01-06-2022

Hazard Token Grabber. Upgraded version of Stealer Targeting Discord Users

https://blog.cyble.com/2022/06/01/hazard-token-grabber

Threats:
HazardToken_Grabber
Beacon

TTPs:
Tactics: 8
Technics: 15

IOCs:
Registry: 2
File: 6
Url: 1
Hash: 3

#ParsedReport
01-06-2022

Threat Brief: CVE-2022-30190 MSDT Code Execution Vulnerability

https://unit42.paloaltonetworks.com/cve-2022-30190-msdt-code-execution-vulnerability

Threats:
Follina_vuln

Geo:
Japanese, Apac, America, Japan, Emea, Belarus, Tokyo

CVEs:
CVE-2022-30190 [Vulners]

IOCs:
Url: 1
File: 4

#ParsedReport
01-06-2022

SideWinder.AntiBot.Script

https://blog.group-ib.com/sidewinder-antibot

Actors/Campaigns:
Sidewinder
Blackmatter

Industry:
Education, Financial, Ngo, Government

Geo:
Bhutan, Indian, India, Asia, Pakistan, Afghanistan, Myanmar, Philippines, China, Pakistani, Singapore, Nepal, Bangladesh

TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 6
Hash: 5
Url: 464
IP: 89
Domain: 10

Грабь, воруй, качай TI
https://cyberthreat.thalesgroup.com/api/adversaries?attackers_type=&origin_area=&target_area=&target_sectors=&motivations=&attack_patterns=&malwares=

#ParsedReport
01-06-2022

Follina: Zero-Day Vulnerability found in MS-MSDT

https://www.netskope.com/blog/follina-zero-day-vulnerability-found-in-ms-msdt

Threats:
Follina_vuln (tags: malware, stealer)
Log4shell_vuln
Emotet
Redline_stealer

Geo:
Italy, Belarus

CVEs:
CVE-2021-40444 [Vulners]
Vulners: Score: 6.8, CVSS: 2.1,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft windows 10 (-, 20h2, 21h1, 1607, 1809, 1909, 2004)
- microsoft windows 7 (-)
- microsoft windows 8.1 (-)
- microsoft windows rt 8.1 (-)
- microsoft windows server 2008 (-, r2)
have more...
CVE-2022-30190 [Vulners]

IOCs:
File: 5
Path: 1
Registry: 2
Hash: 6
Url: 2

#ParsedReport
01-06-2022

CVE-2022-30190: New Zero-Day Vulnerability (Follina) in Microsoft Support Diagnostic Tool

https://www.netskope.com/blog/cve-2022-30190-new-zero-day-vulnerability-follina-in-microsoft-support-diagnostic-tool

Threats:
Follina_vuln (tags: malware, stealer, fraud)
Log4shell_vuln
Emotet
Redline_stealer

Geo:
Belarus, Italy

CVEs:
CVE-2022-30190 [Vulners]
CVE-2021-40444 [Vulners]
Vulners: Score: 6.8, CVSS: 2.1,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- microsoft windows 10 (-, 20h2, 21h1, 1607, 1809, 1909, 2004)
- microsoft windows 7 (-)
- microsoft windows 8.1 (-)
- microsoft windows rt 8.1 (-)
- microsoft windows server 2008 (-, r2)
have more...

IOCs:
File: 5
Path: 1
Registry: 2
Hash: 6
Url: 2

#ParsedReport
01-06-2022

Browser-in-the Browser sextortion scam makes victims pay by imitating Indian Gov

https://www.zscaler.com/blogs/security-research/browser-browser-sextortion-scam-makes-victims-pay-imitating-indian-gov

Industry:
Financial, Government

Geo:
India

IOCs:
Url: 2
Domain: 56
IP: 2

#ParsedReport
01-06-2022

The Popular Malware Downloader, GootLoader, Expands its Payloads Yet Again, Infecting a Law Firm with IcedID. Appendix

https://www.esentire.com/blog/gootloader-initial-access-as-a-service-malware-expands-its-payloads-yet-again-infecting-law-firm-with-icedid

Threats:
Gootloader (tags: ransomware, malware, rat, trojan)
Icedid (tags: ransomware, malware, trojan, rat)
Cobalt_strike (tags: ransomware, malware)
Beacon (tags: malware)
Conti (tags: malware)
Revil (tags: malware)
Fivehands (tags: malware)
Blackcat (tags: malware)
Gootkit

Industry:
Financial, Aerospace

IOCs:
Hash: 1
IP: 1
Domain: 1
File: 1

Links:
https://github.com/pan-unit42/tweets/blob/master/2022-01-27-IOCs-for-Contact-Forms-IcedID-with-Cobalt-Strike.txt

#ParsedReport
02-06-2022

Iranian Threat Actor Continues to Develop Mass Exploitation Tools

https://www.deepinstinct.com/blog/iranian-threat-actor-continues-to-develop-mass-exploitation-tools

Actors/Campaigns:
Cleaver
Cobalt_mirage

Threats:
Blister_loader
Log4shell_vuln (tags: malware)
Mirage
Plink
Proxyshell_vuln

Geo:
Iranian, Iran

CVEs:
CVE-2018-13379 [Vulners]
Vulners: Score: 5.0, CVSS: 4.0,
Vulners: Exploitation: True
X-Force: Risk: 7.5
X-Force: Patch: Official fix
Soft:
- fortinet fortios (le6.0.4, le5.6.7)


TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 1
Path: 2
Hash: 34
IP: 7
Domain: 12

Links:
https://github.com/fatedier/frp

#ParsedReport
02-06-2022

AgentTesla Being Distributed Through Windows Help File (*.chm)

https://asec.ahnlab.com/en/34793

Threats:
Agent_tesla (tags: malware, phishing, trojan)

IOCs:
Url: 3
File: 1
Hash: 4

Functions Names: 1

#ParsedReport
02-06-2022

ASEC Weekly Malware Statistics (May 23rd, 2022 May 29th, 2022)

https://asec.ahnlab.com/en/34876

Threats:
Agent_tesla (tags: malware, scan, dropper, spam, stealer, rat)
Formbook
Lokibot_stealer
Beamwinhttp_loader
Garbage_cleaner
Remcos_rat
Nanocore_rat

Industry:
Transport

Geo:
Pacific

IOCs:
Domain: 4
IP: 3
Email: 5
File: 28
Url: 11

#ParsedReport
02-06-2022

NSIS Installer Malware Included with Various Malicious Files

https://asec.ahnlab.com/en/34955

Threats:
Agent_tesla (tags: malware)
Redline_stealer (tags: malware)
Smokeloader_backdoor (tags: malware)
Beamwinhttp_loader (tags: malware)
Cold_stealer (tags: malware)
Ransomware/win.stop.r484442 (tags: malware)

IOCs:
File: 2
Hash: 5

#ParsedReport
02-06-2022

WinDealer dealing on the side

https://securelist.com/windealer-dealing-on-the-side/105946

Actors/Campaigns:
Luoyu

Threats:
Windealer
Spydealer
Demsty
Watering_hole_technique

Industry:
Telco, Logistic

Geo:
Russia, Austria, Asia, India, China, Germany, Czech, Japan

IOCs:
File: 2
Hash: 38
Url: 3

#ParsedReport
02-06-2022

Tales From the Honeypot: WatchDog Evolves With a New Multi-Stage Cryptojacking Attack

https://www.cadosecurity.com/tales-from-the-honeypot-watchdog-evolves-with-a-new-multi-stage-cryptojacking-attack

Actors/Campaigns:
Teamtnt

Threats:
Zgrab_scanner_tool
Masscan_tool
Xmrig_miner
Pnscan_tool
Log4shell_vuln

TTPs:
Tactics: 1
Technics: 0

IOCs:
Domain: 2
File: 2
IP: 2
Hash: 6
Url: 10
Coin: 1

Links:
https://github.com/zmap/zgrab2
https://github.com/robertdavidgraham/masscan
https://github.com/ptrrkssn/pnscan

#ParsedReport
02-06-2022

YourCyanide: A CMD-based Ransomware With Multiple Layers of Obfuscation. YourCyanide technical analysis

https://www.trendmicro.com/en_us/research/22/f/yourcyanide-a-cmd-based-ransomware.html

Threats:
Passview_tool
Ransom.win32.gonnacope.yxcew
Trojan.vbs.gonnacope.a
Trojan.win64.kekpop.yxcet
Trojan.win64.kekpop.yxcest
Trojan.win64.kekpop.yxcert

Industry:
Financial

TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 27
Url: 2
Registry: 2
Hash: 56

Functions Names: 1

#ParsedReport
02-06-2022

Exposing POLONIUM activity and infrastructure targeting Israeli organizations

https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations

Actors/Campaigns:
Polonium (tags: trojan, vpn, malware, backdoor)
Volatile_cedar
Muddywater
Siamesekitten
Copykittens

Threats:
Creepydrive
Creepysnail
Creepyring

Industry:
Financial, Government, Aerospace, Healthcare

Geo:
Iran, Israel

CVEs:
CVE-2018-13379 [Vulners]
Vulners: Score: 5.0, CVSS: 4.0,
Vulners: Exploitation: True
X-Force: Risk: 7.5
X-Force: Patch: Official fix
Soft:
- fortinet fortios (le6.0.4, le5.6.7)


IOCs:
File: 3
IP: 11

Links:
https://github.com/Azure/Azure-Sentinel/tree/master/Detections/MultipleDataSources/POLONIUMIPIoC.yaml
https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/CommonSecurityLog/RiskyCommandB64EncodedInUrl.yaml
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CommonSecurityLog/CreepyDriveURLs.yaml
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CommonSecurityLog/CreepySnailURLParameters.yaml
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CommonSecurityLog/CreepyDriveRequestSequence.yaml
https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/CommonSecurityLog/B64IPInURL.yaml
https://github.com/Azure/Azure-Sentinel/tree/master/Detections/MultipleDataSources/B64IPInURLFromMDE.yaml
https://github.com/Azure/Azure-Sentinel/tree/master/Detections/MultipleDataSources/B64UserInWebURIFromMDE.yaml

#ParsedReport
02-06-2022

Avoid Taking Shortcuts New Emotet Technique

https://cyberint.com/blog/research/avoid-taking-shortcuts-new-emotet-technique

Threats:
Emotet (tags: malware, rat, botnet, stealer, trojan)
Ryuk
Trickbot
Saintbot
Outsteel

Industry:
Financial

IOCs:
File: 1
Hash: 4
Url: 1
IP: 1

#ParsedReport
02-06-2022

Hacker group "Ocean Lotus" combat weapon "Buni" latest exposure, targeting Linux platform

https://mp-weixin-qq-com.translate.goog/s/zHLY81XeNL8afYaPtd0Myw?_x_tr_sl=zh-CN&_x_tr_tl=en&_x_tr_hl=en

Actors/Campaigns:
Oceanlotus
Blacktech

Threats:
Doubleheaded_dragon
Wannacry

Industry:
Government, Iot, Transport, Financial, Energy, Healthcare

Geo:
China, Asia

TTPs:
Tactics: 1
Technics: 0

IOCs:
IP: 1