Bitdefender's Martin Zugec shares recent insights about the tactics, techniques and procedures of the Charming Kitten group (APT35/APT42, Mint Sandstorm/PHOSPHORU), including unpacking a new piece of malware used by the group, named BellaCiao. https://www.bitdefender.com/blog/businessinsights/unpacking-bellaciao-a-closer-look-at-irans-latest-malware/
🗣virusbtn


🎖@malwr

Monitoring Active Directory for Signs of Compromise
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/monitoring-active-directory-for-signs-of-compromise
🗣DirectoryRanger


🎖@malwr

CloudSEK’s Threat Intelligence Research Team look into the details of the Daam Android malware distributed via trojanized applications. https://cloudsek.com/threatintelligence/copy-of-malware-intelligence-analysis-of-daam-android-malware
🗣virusbtn


🎖@malwr

A Deep Dive into the Emotet Malware

Emotet is a trojan that is primarily spread through spam emails. During its lifecycle, it has gone through a few iterations. Early versions were delivered as a malicious JavaScript file.
https://www.fortinet.com/blog/threat-research/deep-dive-into-emotet-malware.html
🗣InfosecMonk


🎖@malwr

Elastic Security Labs' @DanielStepanic analyses the functionality and capabilities of LOBSHOT, an hVNC malware family spreading through Google Ads. https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware
🗣virusbtn


🎖@malwr

Researchers from Palo Alto's Unit42 identified a new variant of the PingPull malware used by Alloy Taurus actors (aka GALLIUM, Softcell) & designed to target Linux systems. They also found Sword2033 backdoor samples linked to the same C2 infrastructure.
https://unit42.paloaltonetworks.com/alloy-taurus/
🗣virusbtn


🎖@malwr

A keylogger/sniffer for the on-screen-keyboard? Sure, ETW is happy to help here with {4F768BE8-9C69-4BBC-87FC-95291D3F9D0C}😁
Enjoy the C source code, and the compiled exe, as usual - https://github.com/gtworek/PSBits/tree/master/ETW
🗣0gtweet


🎖@malwr

How to get IDA global information? min and max addresses, entry point, main, other configuration values, etc.
https://youtu.be/2w8LdSCPUQc
🗣allthingsida


🎖@malwr

NIST Cloud Computing Forensic Reference Architecture
Release Date: February 2023
Direct Download Link (PDF):
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-201.ipd.pdf
For more unique resources and tools for the cyber community, please visit:
https://cyberstartupobservatory.com
#CyberSecurity #InfoSec #InformationSecurity
🗣CyberSecOb


🎖@malwr

If a website allows you to upload ZIP files it might be vulnerable to a #ZipSlip #vulnerability leading to #RCE.
Watch this explanation video from @gregxsunday on how he got $5.5k #BugBounty from GitHub & built a #CodeQL query to detect this bug:

#AppSec

https://youtu.be/F95U912u7OQ
🗣securestep9


🎖@malwr

Sharing a tool I developed to help Blue Teamers discover Persistence on Windows - please check it out!
🗣panscanner

Hey everyone - thought I would share a tool some of you may find useful. The GitHub readme has most of the information you'd want but basically it scans Windows for possible persistence mechanisms and reports on them in a CSV format (JSON soon).

The difference between this and something like PersistenceSniper is my attempt to add built-in allow-lists, risk assignments and the capability to 'snapshot' a system (such as a golden image) then use that snapshot as a dynamic runtime allow-list. Most functionality also supports 'drive-retargeting' if you are analyzing a mounted image.

Feel free to DM me/reply with any questions/comments/ideas/etc for improving it! This wouldn't exist without the amazing InfoSec community and I'm just trying to give back.
👤panscanner


🎖@malwr

Frida 16.0.19 is out! 🎊 We're excited to share that @bezjaje and @hsorbo solved two high-impact reliability issues 🔥
https://frida.re/news/2023/04/27/frida-16-0-19-released/
🗣fridadotre


🎖@malwr

Check Point researchers discuss various infection chains and lures used by APT37 in their recent attacks & the resulting payloads of ROKRAT and Amadey. The lures used are largely focused on South Korean foreign and domestic affairs. https://research.checkpoint.com/2023/chain-reaction-rokrats-missing-link/
🗣virusbtn


🎖@malwr

Debugging with IDA: Understanding how user mode API hooks work and how to detect them in IDA.

https://youtu.be/spsRgAKv6SE
🗣allthingsida


🎖@malwr

SentinelOne's Phil Stokes (@philofishal) takes a close look at how macOS Atomic Stealer works and describes a previously unreported second variant. https://www.sentinelone.com/blog/atomic-stealer-threat-actor-spawns-second-variant-of-macos-malware-sold-on-telegram/
🗣virusbtn


🎖@malwr

My colleague Elias Bachaalany (@0xeb) has kept an excellent channel about IDA Pro (@allthingsida) with videos about its advanced features. No doubts, it's worth subscribing and following it.

https://www.youtube.com/@allthingsida

#idapro #reverseengineering
🗣ale_sp_brazil


🎖@malwr

Binary Ninja 3.4 released. They are getting scary good at C++ decompilation. Can't wait for @vector35 to get scary-good at Go, Rust, and other compiled languages https://binary.ninja/2023/05/03/3.4-finally-freed.html
🗣OpenMalware


🎖@malwr

Zero Trust Architecture (NIST Special Publication 800-207)
Download Link in PDF:
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
For more unique resources and tools for the cyber community, please visit:
https://cyberstartupobservatory.com/cyber-startup-observatory-community/
#CyberSecurity #InfoSec #InformationSecurity
🗣CyberSecOb


🎖@malwr