New paper: Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects
https://www.virusbulletin.com/blog/2023/10/new-paper-nexus-android-banking-botnet-compromising-cc-panels-and-dissecting-mobile-appinjects/
🎖@malwr
https://www.virusbulletin.com/blog/2023/10/new-paper-nexus-android-banking-botnet-compromising-cc-panels-and-dissecting-mobile-appinjects/
🎖@malwr
Virusbulletin
Virus Bulletin :: New paper: Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects
In a new paper, researchers Aditya K Sood and Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited in order to gather threat intelligence, and present a model of mobile AppInjects.
Detect Wi-Fi deauthentication attack using ESP8266 and receive notification on smartphone
https://www.mobile-hacker.com/2023/10/12/detect-wi-fi-deauthentication-attack-using-esp8266-and-receive-notification-on-smartphone/?utm_source=rss&utm_medium=rss&utm_campaign=detect-wi-fi-deauthentication-attack-using-esp8266-and-receive-notification-on-smartphone
🎖@malwr
https://www.mobile-hacker.com/2023/10/12/detect-wi-fi-deauthentication-attack-using-esp8266-and-receive-notification-on-smartphone/?utm_source=rss&utm_medium=rss&utm_campaign=detect-wi-fi-deauthentication-attack-using-esp8266-and-receive-notification-on-smartphone
🎖@malwr
Mobile Hacker
Detect Wi-Fi deauthentication attack using ESP8266 and receive notification on smartphone Mobile Hacker
A Wi-Fi deauthentication attack, also known as a "deauth attack" or "disassociation attack," is a type of denial-of-service that targets wireless networks. The primary goal of this attack is to disconnect or deauthenticate devices (such as smartphones, laptops…
DarkGate Opens Organizations for Attack via Skype, Teams
We detail an ongoing campaign abusing messaging platforms Skype and Teams to distribute the DarkGate malware to targeted organizations. We also discovered that once DarkGate is installed on the victim’s system, additional payloads were introduced to the environment.
https://www.trendmicro.com/en_us/research/23/j/darkgate-opens-organizations-for-attack-via-skype-teams.html
🎖@malwr
We detail an ongoing campaign abusing messaging platforms Skype and Teams to distribute the DarkGate malware to targeted organizations. We also discovered that once DarkGate is installed on the victim’s system, additional payloads were introduced to the environment.
https://www.trendmicro.com/en_us/research/23/j/darkgate-opens-organizations-for-attack-via-skype-teams.html
🎖@malwr
Trend Micro
DarkGate Opens Organizations for Attack via Skype, Teams
Forensic Timeline of an IcedID Infection
The BackConnect and VNC parsers that were added to NetworkMiner 2.8.1 provide a unique possibility to trace the steps of an attacker with help of captured network traffic from a hacked computer. In this blog post I use the free and open source version of NetworkMiner to see how GzipLoader downloads...
https://www.netresec.com/?page=Blog&month=2023-10&post=Forensic-Timeline-of-an-IcedID-Infection
🎖@malwr
The BackConnect and VNC parsers that were added to NetworkMiner 2.8.1 provide a unique possibility to trace the steps of an attacker with help of captured network traffic from a hacked computer. In this blog post I use the free and open source version of NetworkMiner to see how GzipLoader downloads...
https://www.netresec.com/?page=Blog&month=2023-10&post=Forensic-Timeline-of-an-IcedID-Infection
🎖@malwr
Netresec
Forensic Timeline of an IcedID Infection
The BackConnect and VNC parsers that were added to NetworkMiner 2.8.1 provide a unique possibility to trace the steps of an attacker with help of captured network traffic from a hacked computer. In this blog post I use the free and open source version of…
Ransomware review: October 2023
https://www.malwarebytes.com/blog/threat-intelligence/2023/10/ransomware-review-october-2023
🎖@malwr
https://www.malwarebytes.com/blog/threat-intelligence/2023/10/ransomware-review-october-2023
🎖@malwr
Malwarebytes
Ransomware review: October 2023
In September, two high-profile casino breaches taught us about the nuances of the RaaS affiliate landscape, the asymmetric dangers of phishing, and of two starkly different approaches to ransomware negotiation.
Stalkerware activity drops as glaring spying problem is revealed
https://www.malwarebytes.com/blog/news/2023/10/stalkerware-activity-drops-but-glaring-problem-with-spying-revealed
🎖@malwr
https://www.malwarebytes.com/blog/news/2023/10/stalkerware-activity-drops-but-glaring-problem-with-spying-revealed
🎖@malwr
Malwarebytes
Stalkerware activity drops as glaring spying problem is revealed
North America has a spying problem. Its perpetrators are everyday people.
Top resources for Cybersecurity Awareness Month
Plus, many of the world’s largest cloud providers are warning of a vulnerability that attackers exploited in August to launch the largest distributed denial-of-service attack on record.
https://blog.talosintelligence.com/threat-source-newsletter-oct-12-2023/
🎖@malwr
Plus, many of the world’s largest cloud providers are warning of a vulnerability that attackers exploited in August to launch the largest distributed denial-of-service attack on record.
https://blog.talosintelligence.com/threat-source-newsletter-oct-12-2023/
🎖@malwr
Cisco Talos Blog
Top resources for Cybersecurity Awareness Month
Plus, many of the world’s largest cloud providers are warning of a vulnerability that attackers exploited in August to launch the largest distributed denial-of-service attack on record.
Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant
Almost a year after Void Rabisu shifted its targeting from opportunistic ransomware attacks with an emphasis on cyberespionage, the threat actor is still developing its main malware, the ROMCOM backdoor.
https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html
🎖@malwr
Almost a year after Void Rabisu shifted its targeting from opportunistic ransomware attacks with an emphasis on cyberespionage, the threat actor is still developing its main malware, the ROMCOM backdoor.
https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html
🎖@malwr
Trend Micro
Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant
Almost a year after Void Rabisu shifted its targeting from opportunistic ransomware attacks with an emphasis on cyberespionage, the threat actor is still developing its main malware, the ROMCOM backdoor.
🤷♀1
2023-10-12 - DarkGate infection from Teams Chat
https://www.malware-traffic-analysis.net/2023/10/12/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2023/10/12/index.html
🎖@malwr
2023-10-13 - TA577 DarkGate infection
https://www.malware-traffic-analysis.net/2023/10/13/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2023/10/13/index.html
🎖@malwr
2023-10-11 - Lumma Stealer infection
https://www.malware-traffic-analysis.net/2023/10/11/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2023/10/11/index.html
🎖@malwr
Microsoft Azure Sentinel 101: Log Source, DataTable & End Point Monitoring
Lots of great content and experience on how to do monitoring for log sources coming in to Sentinel.
https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-log-source-dataable-end-point-monitoring-be-alerted-when-a-1ff4fae77892
🗣thattechkitten
🎖@malwr
Lots of great content and experience on how to do monitoring for log sources coming in to Sentinel.
https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-log-source-dataable-end-point-monitoring-be-alerted-when-a-1ff4fae77892
🗣thattechkitten
🎖@malwr
Medium
Microsoft Azure Sentinel 101: Log Source, Dataable & End Point Monitoring — Be alerted when a…
One of the most important thing is monitoring log ingestion and making alerts for when sources go down.
CovenantDecryptor: designed to decrypt the communication data of Covenant traffic - Extract_privatekey script retrieves the p and q primes from a minidump file to construct an RSA private key. decrypt_covenant_traffic script decrypts..
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - naacbin/CovenantDecryptor
Contribute to naacbin/CovenantDecryptor development by creating an account on GitHub.
McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Follow The Money
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-follow-the-money/
🎖@malwr
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-follow-the-money/
🎖@malwr
McAfee Blog
McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service - Follow The Money | McAfee Blog
Episode 3: Follow the Money This is the third installment of the McAfee Advanced Threat Research (ATR) analysis of Sodinokibi and its connections to
👍1