#ParsedReport
02-06-2022

NSIS Installer Malware Included with Various Malicious Files

https://asec.ahnlab.com/en/34955

Threats:
Agent_tesla (tags: malware)
Redline_stealer (tags: malware)
Smokeloader_backdoor (tags: malware)
Beamwinhttp_loader (tags: malware)
Cold_stealer (tags: malware)
Ransomware/win.stop.r484442 (tags: malware)

IOCs:
File: 2
Hash: 5

#ParsedReport
02-06-2022

WinDealer dealing on the side

https://securelist.com/windealer-dealing-on-the-side/105946

Actors/Campaigns:
Luoyu

Threats:
Windealer
Spydealer
Demsty
Watering_hole_technique

Industry:
Telco, Logistic

Geo:
Russia, Austria, Asia, India, China, Germany, Czech, Japan

IOCs:
File: 2
Hash: 38
Url: 3

#ParsedReport
02-06-2022

Tales From the Honeypot: WatchDog Evolves With a New Multi-Stage Cryptojacking Attack

https://www.cadosecurity.com/tales-from-the-honeypot-watchdog-evolves-with-a-new-multi-stage-cryptojacking-attack

Actors/Campaigns:
Teamtnt

Threats:
Zgrab_scanner_tool
Masscan_tool
Xmrig_miner
Pnscan_tool
Log4shell_vuln

TTPs:
Tactics: 1
Technics: 0

IOCs:
Domain: 2
File: 2
IP: 2
Hash: 6
Url: 10
Coin: 1

Links:
https://github.com/zmap/zgrab2
https://github.com/robertdavidgraham/masscan
https://github.com/ptrrkssn/pnscan

#ParsedReport
02-06-2022

YourCyanide: A CMD-based Ransomware With Multiple Layers of Obfuscation. YourCyanide technical analysis

https://www.trendmicro.com/en_us/research/22/f/yourcyanide-a-cmd-based-ransomware.html

Threats:
Passview_tool
Ransom.win32.gonnacope.yxcew
Trojan.vbs.gonnacope.a
Trojan.win64.kekpop.yxcet
Trojan.win64.kekpop.yxcest
Trojan.win64.kekpop.yxcert

Industry:
Financial

TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 27
Url: 2
Registry: 2
Hash: 56

Functions Names: 1

#ParsedReport
02-06-2022

Exposing POLONIUM activity and infrastructure targeting Israeli organizations

https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations

Actors/Campaigns:
Polonium (tags: trojan, vpn, malware, backdoor)
Volatile_cedar
Muddywater
Siamesekitten
Copykittens

Threats:
Creepydrive
Creepysnail
Creepyring

Industry:
Financial, Government, Aerospace, Healthcare

Geo:
Iran, Israel

CVEs:
CVE-2018-13379 [Vulners]
Vulners: Score: 5.0, CVSS: 4.0,
Vulners: Exploitation: True
X-Force: Risk: 7.5
X-Force: Patch: Official fix
Soft:
- fortinet fortios (le6.0.4, le5.6.7)


IOCs:
File: 3
IP: 11

Links:
https://github.com/Azure/Azure-Sentinel/tree/master/Detections/MultipleDataSources/POLONIUMIPIoC.yaml
https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/CommonSecurityLog/RiskyCommandB64EncodedInUrl.yaml
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CommonSecurityLog/CreepyDriveURLs.yaml
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CommonSecurityLog/CreepySnailURLParameters.yaml
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CommonSecurityLog/CreepyDriveRequestSequence.yaml
https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/CommonSecurityLog/B64IPInURL.yaml
https://github.com/Azure/Azure-Sentinel/tree/master/Detections/MultipleDataSources/B64IPInURLFromMDE.yaml
https://github.com/Azure/Azure-Sentinel/tree/master/Detections/MultipleDataSources/B64UserInWebURIFromMDE.yaml

#ParsedReport
02-06-2022

Avoid Taking Shortcuts New Emotet Technique

https://cyberint.com/blog/research/avoid-taking-shortcuts-new-emotet-technique

Threats:
Emotet (tags: malware, rat, botnet, stealer, trojan)
Ryuk
Trickbot
Saintbot
Outsteel

Industry:
Financial

IOCs:
File: 1
Hash: 4
Url: 1
IP: 1

#ParsedReport
02-06-2022

Hacker group "Ocean Lotus" combat weapon "Buni" latest exposure, targeting Linux platform

https://mp-weixin-qq-com.translate.goog/s/zHLY81XeNL8afYaPtd0Myw?_x_tr_sl=zh-CN&_x_tr_tl=en&_x_tr_hl=en

Actors/Campaigns:
Oceanlotus
Blacktech

Threats:
Doubleheaded_dragon
Wannacry

Industry:
Government, Iot, Transport, Financial, Energy, Healthcare

Geo:
China, Asia

TTPs:
Tactics: 1
Technics: 0

IOCs:
IP: 1

#ParsedReport
02-06-2022

Alert (AA22-152A)

https://www.cisa.gov/uscert/ncas/alerts/aa22-152a

Actors/Campaigns:
Karakurt

Threats:
Log4shell_vuln
Cobalt_strike
Beacon
Mimikatz
Blister_loader

Industry:
Government, Healthcare, Financial

Geo:
America

CVEs:
CVE-2021-44228 [Vulners]
Vulners: Score: 9.3, CVSS: 4.0,
Vulners: Exploitation: True
X-Force: Risk: 10
X-Force: Patch: Official fix
Soft:
- apache log4j (2.0, 2.0, 2.0, 2.0, <2.15.0, <2.3.1, <2.12.2)
- siemens sppa-t3000 ses3000 firmware (*)
- siemens logo\! soft comfort (*)
- siemens spectrum power 4 (4.70, 4.70, <4.70, 4.70)
- siemens siveillance control pro (*)
have more...

TTPs:
Tactics: 4
Technics: 12

IOCs:
Url: 1
File: 6
Email: 9
Hash: 11

#ParsedReport
02-06-2022

To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions

https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions

Actors/Campaigns:
Silverfish (tags: trojan, rat, dns, malware, ransomware, vpn, dropper)
Evil_corp (tags: trojan, rat, malware, ransomware, vpn)
Unc1543
Gold_winter
Unc2758

Threats:
Hades (tags: trojan, rat, dns, malware, ransomware, vpn, dropper)
Lockbit (tags: trojan, rat, dns, malware, ransomware, vpn, dropper)
Blister_loader
Dridex
Wastedlocker
Cridex
Friedex
Doppelpaymer
Beacon
Phoenix_locker
Macaw
Fakeudpate
Netsupportmanager_rat
Cobalt_strike
Donut
Mimikatz
Kerberoasting_technique
Keethief_tool
Secretserversecretstealer
Putty_tool
Megasync_tool
Psexec_tool
Timestomp_tool
Domain_fronting_technique

Industry:
Government, Financial

Geo:
Russia

TTPs:
Tactics: 13
Technics: 85

IOCs:
Domain: 17
File: 1
Path: 1

YARA: Found

Links:
https://github.com/TheWover/donut

#ParsedReport
02-06-2022

Clipminer Botnet Makes Operators at Least $1.7 Million

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking

Threats:
Clipminer (tags: malware, scan, botnet, trojan, cryptomining, rat, dropper)
Kryptocibule (tags: malware)
Xmrig_miner

Industry:
Financial

IOCs:
File: 5
Hash: 4
Path: 3
Registry: 4
IP: 2

Functions Names: 1

#ParsedReport
02-06-2022

GoodWill Ransomware? Or Just Another Jasmin Variant?

https://www.netskope.com/blog/goodwill-ransomware-or-just-another-jasmin-variant

Actors/Campaigns:
Carbanak (tags: ransomware)

Threats:
Goodwill (tags: malware, rat, ransomware, stealer, fraud)
Jasmin (tags: malware, rat, ransomware, stealer, fraud)
Zeus
Hiddentear (tags: ransomware)
Follina_vuln
Redline_stealer

Industry:
Financial

CVEs:
CVE-2022-30190 [Vulners]
Vulners: Score: 9.3, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 1809, 21h1, 21h2)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
- microsoft windows server 2008 (-, r2)
have more...

IOCs:
File: 4

YARA: Found

Links:
https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Jasmin%20Ransomware/IOCs
https://github.com/codesiddhant/Jasmin-Ransomware
https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Jasmin%20Ransomware

#ParsedReport
02-06-2022

CrowdStrike Uncovers New MacOS Browser Hijacking Campaign

https://www.crowdstrike.com/blog/how-crowdstrike-uncovered-a-new-macos-browser-hijacking-campaign

Threats:
Applescript
Beacon

TTPs:
Tactics: 3
Technics: 0

IOCs:
File: 2
Domain: 1
Url: 1
Hash: 6

Functions Names: 1

Публикацию разобранных отчетов в github прекратили.

Публикация саммари в этом канале продолжится.

#ParsedReport
02-06-2022

Zero-Day Exploitation of Atlassian Confluence

https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence

Threats:
Chinachopper (tags: rat, vpn)
Behinder (tags: malware)
Meterpreter_tool
Cobalt_strike

Geo:
China

CVEs:
CVE-2022-26134 [Vulners]
Vulners: Score: Unknown, CVSS: Unknown,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Unavailable


IOCs:
File: 2
IP: 15
Hash: 2

Links:
https://github.com/tennc/webshell/blob/master/caidao-shell/%E8%8F%9C%E5%88%80jsp%E4%BF%AE%E6%94%B9.jsp
https://github.com/volexity/threat-intel/blob/main/2022/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day/indicators/indicators.csv
https://github.com/Freakboy/Behinder
https://github.com/volexity/threat-intel/blob/main/2022/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day/indicators/yara.yar

#ParsedReport
03-06-2022

Outbreak of Follina in Australia. Key Observations

https://decoded.avast.io/threatintel/outbreak-of-follina-in-australia

Threats:
Follina_vuln (tags: trojan, rat, proxy, malware)
Lolbas_technique
Asyncrat_rat (tags: trojan)

Industry:
Telco

Geo:
Australia, Pacific, Palau, Australian

CVEs:
CVE-2022-30190 [Vulners]
Vulners: Score: 9.3, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft windows server 2012 (r2, -)
- microsoft windows 10 (1607, -, 20h2, 1809, 21h1, 21h2)
- microsoft windows 8.1 (-)
- microsoft windows server 2016 (-)
- microsoft windows server 2008 (-, r2)
have more...

IOCs:
File: 3
Domain: 1
Hash: 13

#ParsedReport
03-06-2022

Threat Actors Prey on Eager Travelers

https://www.fortinet.com/blog/threat-research/threat-actors-prey-on-eager-travelers

Actors/Campaigns:
Stone_panda

Threats:
Asyncrat_rat (tags: phishing, trojan, malware, rat)
Netwire_rat (tags: trojan, malware)
Quasar_rat (tags: trojan, malware, rat)
Kryptik_trojan
W32/vbkrypt.c!tr

Industry:
Aerospace, Government

Geo:
Colombia, Colombian

IOCs:
File: 14
Domain: 5
Hash: 13

#ParsedReport
03-06-2022

Gootkit Loader Returns to Deliver Cobalt Strike

https://www.esentire.com/blog/gootkit-loader-returns-to-deliver-cobalt-strike

Threats:
Cobalt_strike (tags: phishing, ransomware, malware)
Gootkit (tags: phishing, ransomware, malware)
More_eggs
Gootloader

Industry:
Aerospace

Geo:
America, Apac, China, Emea, Africa

IOCs:
File: 5

#ParsedReport
06-06-2022

Analyzing the PowGoop variant "E400" of Iran's APT attack group Muddy Water, discovering dozens of C & C servers

https://insight-jp.nttsecurity.com/post/102hq2r/aptmuddywaterpowgoope400cc

Actors/Campaigns:
Muddywater (tags: malware, backdoor, rat)
Blacktech

Threats:
Powgoop (tags: malware, backdoor, rat)
Flagpro

Geo:
Japanese, Thailand, Japan, Iran, Iranian

IOCs:
File: 1
IP: 34

#ParsedReport
06-06-2022

From the Front Lines \| Another Rebrand? Mindware and SFile Ransomware Technical Breakdown

https://www.sentinelone.com/blog/from-the-front-lines-another-rebrand-mindware-and-sfile-ransomware-technical-breakdown

Actors/Campaigns:
Mindware (tags: malware, ransomware, rat)
Blackmatter

Threats:
Sfile (tags: malware, ransomware, rat)
Blister_loader (tags: ransomware)

Industry:
Financial, Healthcare, Retail

TTPs:
Tactics: 2
Technics: 8

IOCs:
File: 25
Hash: 18
Url: 1

Functions Names: 2

#ParsedReport
06-06-2022

Will the Real Msiexec Please Stand Up? Exploit Leads to Data Exfiltration

https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration

Threats:
Plink

Industry:
Financial, Healthcare

CVEs:
CVE-2021-44077 [Vulners]
Vulners: Score: 7.5, CVSS: 4.4,
Vulners: Exploitation: True
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- zohocorp manageengine servicedesk plus (11.1, 11.1, 11.1, 11.1, 11.1, 11.1, 11.1, 11.1, 11.2, 11.2, 11.2, 11.2, 11.2, 11.2, 11.2, 11.2, 11.2, 11.2, 11.2, 11.2, 11.3, 11.3, 11.3, 11.3, 11.3, 11.3)
- zohocorp manageengine servicedesk plus msp (10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, 10.5, le10.5)
- zohocorp manageengine supportcenter plus (11.0, 11.0, 11.0, 11.0, 11.0, 11.0, 11.0, 11.0, 11.0, 11.0, 11.0, 11.0, 11.0, 11.0, le11.0)


TTPs:
Tactics: 11
Technics: 12

IOCs:
IP: 13
Path: 8
File: 9
Registry: 2
Url: 1
Hash: 5

YARA: Found
SIGMA: Found

Links:
https://github.com/horizon3ai/CVE-2021-44077