Sajid Nawaz Khan :donor:<p>For hobbyist Cobalt Strike Beacon collectors, note that the recently announced 4.11 update introduces a number of changes to frustrate Beacon configuration extraction, namely through the new `transform-obfuscate` field.</p><p>When set, this field can apply multiple layers of encoding, encryption and compression (with some recent Beacons observed with a 32 byte XOR key, configurable upto 2048 bytes!).</p><p>While still reasonably trivial to decode manually, standard automated workflows (say, through the SentinelOne parser) will now fail, not least because of changes to the well-known field markers.</p><p>Beacons with these characteristics have thus far been observed with watermarks indicative of licensed instances, though I imagine it is only a matter of time before the 4.11 capabilities become accessible to all manner of miscreants.</p><p>A sample configuration, via a staged Beacon on 104.42.26[.]200 is attached, including the three distinct XOR keys used to decode it.</p><p><a href="https://www.cobaltstrike.com/blog/cobalt-strike-411-shh-beacon-is-sleeping" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">cobaltstrike.com/blog/cobalt-s</span><span class="invisible">trike-411-shh-beacon-is-sleeping</span></a></p><p><a href="https://infosec.exchange/tags/cobaltstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cobaltstrike</span></a> <a href="https://infosec.exchange/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malwareanalysis</span></a> <a href="https://infosec.exchange/tags/forensics" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>forensics</span></a> <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>blueteam</span></a></p>
101010.pl is one of the many independent Mastodon servers you can use to participate in the fediverse.
101010.pl czyli najstarszy polski serwer Mastodon. Posiadamy wpisy do 2048 znaków.
Administered by:
Server stats:
484active users
101010.pl: About · Status · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.5.0-alpha.1
#cobaltstrike
0 posts · 0 participants · 0 posts today
IT News<p>Europol shuts down almost 600 IP addresses in Cobalt Strike cybercrime crackdown - Nearly 600 IP addresses have been dismantled by Europol as part of a concerted eff... - <a href="https://readwrite.com/europol-shuts-600-ip-addresses-cobalt-strike-cybercrime-crackdown/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">readwrite.com/europol-shuts-60</span><span class="invisible">0-ip-addresses-cobalt-strike-cybercrime-crackdown/</span></a> <a href="https://schleuss.online/tags/cobaltstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cobaltstrike</span></a> <a href="https://schleuss.online/tags/technology" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>technology</span></a> <a href="https://schleuss.online/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://schleuss.online/tags/europol" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>europol</span></a></p>
The Spamhaus Project<p><span class="h-card" translate="no"><a href="https://bird.makeup/users/europol" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>europol</span></a></span> strikes back at Cobalt Strike - another brilliantly coordinated effort with hat tips to <span class="h-card" translate="no"><a href="https://ioc.exchange/@abuse_ch" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>abuse_ch</span></a></span> and Spamhaus Technology Ltd for their involvement and support too 👏 </p><p>This international operation has taken action against criminal abuse with Operation Morpheus.</p><p>Abuse reports are being sent from us to network owners hosting active Cobalt Strike servers. Network operators, if you receive an abuse report, we urge you to take swift action 🙏 </p><p>Read more here:<br><a href="https://www.europol.europa.eu/media-press/newsroom/news/europol-coordinates-global-action-against-criminal-abuse-of-cobalt-strike" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">europol.europa.eu/media-press/</span><span class="invisible">newsroom/news/europol-coordinates-global-action-against-criminal-abuse-of-cobalt-strike</span></a></p><p><a href="https://infosec.exchange/tags/CTI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CTI</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/botnet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>botnet</span></a> <a href="https://infosec.exchange/tags/cobaltstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cobaltstrike</span></a> <a href="https://infosec.exchange/tags/operationmorpheus" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>operationmorpheus</span></a></p>
abuse.ch :verified:<p>Europol coordinates global action against criminal abuse of Cobalt Strike 🔥 We are very proud that together with our partner <span class="h-card" translate="no"><a href="https://infosec.exchange/@spamhaus" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>spamhaus</span></a></span> we are part of this international operation 👏 🎉 </p><p>Indicators on rogue Cobalt Strike botnet C2 servers related to the operation are being made available on ThreatFox 🦊 :</p><p>➡ <a href="https://threatfox.abuse.ch/browse/malware/win.cobalt_strike/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">threatfox.abuse.ch/browse/malw</span><span class="invisible">are/win.cobalt_strike/</span></a></p><p>In addition, The Spamhaus Project is sending out abuse reports to network owners hosting such rogue (active) Cobalt Strike servers 📨 . If you are a network operator receiving such an abuse report, you should take action on it swiftly 🙏 </p><p>Further reading:<br>👉 <a href="https://www.europol.europa.eu/media-press/newsroom/news/europol-coordinates-global-action-against-criminal-abuse-of-cobalt-strike" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">europol.europa.eu/media-press/</span><span class="invisible">newsroom/news/europol-coordinates-global-action-against-criminal-abuse-of-cobalt-strike</span></a></p><p><a href="https://ioc.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybercrime</span></a> <a href="https://ioc.exchange/tags/CTI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CTI</span></a> <a href="https://ioc.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatintel</span></a> <a href="https://ioc.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://ioc.exchange/tags/botnet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>botnet</span></a> <a href="https://ioc.exchange/tags/cobaltstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cobaltstrike</span></a> <a href="https://ioc.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatintelligence</span></a></p>
Brad<p>Post I wrote for my employer at <a href="https://www.linkedin.com/posts/unit42_ssload-cobaltstrike-timelythreatintel-activity-7187091840968351744-xqe-" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">linkedin.com/posts/unit42_sslo</span><span class="invisible">ad-cobaltstrike-timelythreatintel-activity-7187091840968351744-xqe-</span></a> and <a href="https://twitter.com/Unit42_Intel/status/1781326222019932535" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">twitter.com/Unit42_Intel/statu</span><span class="invisible">s/1781326222019932535</span></a></p><p>024-04-18 (Thursday): <a href="https://infosec.exchange/tags/SSLoad" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SSLoad</span></a> infection leads to <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> DLL. In this case we saw no follow-up Cobalt Strike C2 traffic. List of indicators available at <a href="https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2024-04-18-IOCs-from-SSLoad-infection-with-Cobalt-Strike-DLL.txt" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/PaloAltoNetworks/Un</span><span class="invisible">it42-timely-threat-intel/blob/main/2024-04-18-IOCs-from-SSLoad-infection-with-Cobalt-Strike-DLL.txt</span></a></p><p>A <a href="https://infosec.exchange/tags/pcap" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pcap</span></a> of the <a href="https://infosec.exchange/tags/SSLoad" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SSLoad</span></a> infection traffic leading to the <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> DLL along with the associated malware/artifacts are available at <a href="https://malware-traffic-analysis.net/2024/04/18/index.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">malware-traffic-analysis.net/2</span><span class="invisible">024/04/18/index.html</span></a></p>
𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲<p>See how the attackers use <a href="https://infosec.exchange/tags/IcedID" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IcedID</span></a>'s reverse VNC to buy an iPhone 14 from the Apple Store and then drop <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> on the victim machine.<br>Thanks to <span class="h-card" translate="no"><a href="https://infosec.exchange/@malware_traffic" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>malware_traffic</span></a></span> for sharing the <a href="https://infosec.exchange/tags/pcap" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pcap</span></a> file!<br><a href="https://netresec.com/?b=23A4de6" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">netresec.com/?b=23A4de6</span><span class="invisible"></span></a></p>
Xavier «X» Santolaria :verified_paw: :donor:<p>📨 Latest issue of my curated <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> and <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> list of resources for week #40/2023 is out! It includes the following and much more:</p><p>🇺🇸 🗳️ D.C. Board of <a href="https://infosec.exchange/tags/Elections" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Elections</span></a> confirms voter data stolen in site hack<br>🔓 🪪 <a href="https://infosec.exchange/tags/MGM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MGM</span></a> Resorts confirms hackers stole customers’ personal data during <a href="https://infosec.exchange/tags/cyberattack" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cyberattack</span></a><br>🔓 🧬 <a href="https://infosec.exchange/tags/DNA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DNA</span></a> testing service 23andMe investigating theft of user data<br>🔓 🎧 <a href="https://infosec.exchange/tags/Sony" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Sony</span></a> confirms <a href="https://infosec.exchange/tags/databreach" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>databreach</span></a> impacting thousands in the U.S.<br>📱 💥 Lyca Mobile Group Services Significantly Disrupted by Cyberattack<br>🔓 🕵🏻♂️ <a href="https://infosec.exchange/tags/NATO" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NATO</span></a> investigating breach, <a href="https://infosec.exchange/tags/leak" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>leak</span></a> of internal documents<br>🔓 🇪🇺 European Telecommunications Standards Institute Discloses Data Breach<br>🔓 🏨 <a href="https://infosec.exchange/tags/MotelOne" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MotelOne</span></a> discloses data breach following <a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ransomware</span></a> attack<br>🇰🇵 💰 North Korea's <a href="https://infosec.exchange/tags/Lazarus" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Lazarus</span></a> Group Launders $900 Million in <a href="https://infosec.exchange/tags/Cryptocurrency" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cryptocurrency</span></a><br>🇧🇪 🇨🇳 <a href="https://infosec.exchange/tags/Alibaba" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Alibaba</span></a> accused of ‘possible espionage’ at European hub<br>🇨🇳 <a href="https://infosec.exchange/tags/China" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>China</span></a>-linked cyberspies <a href="https://infosec.exchange/tags/backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>backdoor</span></a> <a href="https://infosec.exchange/tags/semiconductor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>semiconductor</span></a> firms with <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a><br>🥸 Meet LostTrust <a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ransomware</span></a> — A likely rebrand of the <a href="https://infosec.exchange/tags/MetaEncryptor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MetaEncryptor</span></a> gang<br>🇬🇾 🇨🇳 <a href="https://infosec.exchange/tags/Guyana" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Guyana</span></a> Governmental Entity Hit by <a href="https://infosec.exchange/tags/DinodasRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DinodasRAT</span></a> in <a href="https://infosec.exchange/tags/CyberEspionage" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberEspionage</span></a> Attack<br>🇷🇺 🇺🇸 <a href="https://infosec.exchange/tags/FBI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FBI</span></a> most-wanted Russian hacker reveals why he burned his passport<br>🇺🇸 🏥 <a href="https://infosec.exchange/tags/FDA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FDA</span></a> cyber mandates for <a href="https://infosec.exchange/tags/medicaldevices" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>medicaldevices</span></a> goes into effect<br>☁️ 🔓 Number of Internet-Exposed <a href="https://infosec.exchange/tags/ICS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ICS</span></a> Drops Below 100,000<br>☁️ <a href="https://infosec.exchange/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft</span></a> Warns of Cyber Attacks Attempting to Breach Cloud via <a href="https://infosec.exchange/tags/SQL" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SQL</span></a> Server Instance<br>🦠 📈 <a href="https://infosec.exchange/tags/QakBot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>QakBot</span></a> Threat Actors Still in Action, Using Ransom Knight and Remcos RAT in Latest Attacks<br>🔓 🍏 <a href="https://infosec.exchange/tags/Apple" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Apple</span></a> Warns of Newly Exploited iOS 17 Kernel Zero-Day<br>🎣 🧑🏻💼 US Executives Targeted in <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Phishing</span></a> Attacks Exploiting Flaw in Indeed Job Platform<br>🦠 🏦 <a href="https://infosec.exchange/tags/Zanubis" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Zanubis</span></a> <a href="https://infosec.exchange/tags/Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Android</span></a> Banking Trojan Poses as Peruvian Government App to Target Users<br>🦠 🇮🇷 Iranian APT Group <a href="https://infosec.exchange/tags/OilRig" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OilRig</span></a> Using New Menorah <a href="https://infosec.exchange/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Malware</span></a> for Covert Operations<br>🔐 ☁️ <a href="https://infosec.exchange/tags/Amazon" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Amazon</span></a> to make <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> mandatory for 'root' <a href="https://infosec.exchange/tags/AWS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AWS</span></a> accounts by mid-2024<br>🛡️ 🧅 <a href="https://infosec.exchange/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft</span></a> Defender no longer flags <a href="https://infosec.exchange/tags/Tor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Tor</span></a> Browser as malware<br>👀 X-Force uncovers global <a href="https://infosec.exchange/tags/NetScaler" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NetScaler</span></a> Gateway credential harvesting campaign<br>🐛 💰 Zero-days for hacking <a href="https://infosec.exchange/tags/WhatsApp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WhatsApp</span></a> are now worth millions of dollars<br>🩹 <a href="https://infosec.exchange/tags/Cisco" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cisco</span></a> fixes hard-coded root credentials in Emergency Responder<br>🔓 Vulnerabilities in <a href="https://infosec.exchange/tags/Supermicro" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Supermicro</span></a> BMCs could allow for unkillable server <a href="https://infosec.exchange/tags/rootkits" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>rootkits</span></a><br>🔓 🐧 Looney Tunables: New <a href="https://infosec.exchange/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> Flaw Enables Privilege Escalation on Major Distributions<br>🐍 Warning: <a href="https://infosec.exchange/tags/PyTorch" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyTorch</span></a> Models Vulnerable to Remote Code Execution via ShellTorch<br>🩹 Microsoft Edge, Teams get fixes for zero-days in <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>opensource</span></a> libraries<br>🔓 🔥 Live Exploitation Underscores Urgency to Patch Critical WS-FTP Server Flaw<br>☁️ Cloudflare <a href="https://infosec.exchange/tags/DDoS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DDoS</span></a> protections ironically bypassed using <a href="https://infosec.exchange/tags/Cloudflare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cloudflare</span></a></p> <p>📚 This week's recommended reading is: "8 Steps to Better Security: A Simple Cyber Resilience Guide for Business" by Kim Crawley</p> <p>Subscribe to the <a href="https://infosec.exchange/tags/infosecMASHUP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosecMASHUP</span></a> newsletter to have it piping hot in your inbox every week-end ⬇️</p><p><a href="https://infosec-mashup.santolaria.net/p/infosec-mashup-week-402023" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">infosec-mashup.santolaria.net/</span><span class="invisible">p/infosec-mashup-week-402023</span></a></p>
🛡 H3lium@infosec.exchange/:~# :blinking_cursor:<p>"🚨 Earth Lusca's New Linux Backdoor: SprySOCKS Unveiled! 🐙"</p><p>Earth Lusca, a China-linked threat actor, has been spotted employing a novel Linux backdoor, dubbed "SprySOCKS". This malware seems to have evolved from the open-source Windows backdoor Trochilus. The backdoor showcases swift behavior and a SOCKS implementation, hence the name. 🐍💼</p><p>SprySOCKS's structure is reminiscent of the RedLeaves backdoor, a RAT known to infect Windows machines. This backdoor is still under development, with different versions observed. Its interactive shell seems to draw inspiration from the Linux variant of the Derusbi malware. 🕵️♂️🔍</p><p>Recent activities of Earth Lusca indicate a focus on Southeast Asia, Central Asia, and the Balkans. Their primary targets? Government departments in foreign affairs, technology, and telecommunications. They've been exploiting server-based N-day vulnerabilities, including CVE-2022-40684, CVE-2022-39952, and more. Once inside, they deploy Cobalt Strike for lateral movement, aiming to exfiltrate sensitive data and conduct long-term espionage. 🌍🎯</p><p>Source: <a href="https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html" rel="nofollow noopener" target="_blank">Trend Micro Research</a></p><p>Tags: <a href="https://infosec.exchange/tags/EarthLusca" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EarthLusca</span></a> <a href="https://infosec.exchange/tags/SprySOCKS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SprySOCKS</span></a> <a href="https://infosec.exchange/tags/LinuxBackdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LinuxBackdoor</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/APT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APT</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatIntelligence</span></a> <a href="https://infosec.exchange/tags/RedLeaves" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RedLeaves</span></a> <a href="https://infosec.exchange/tags/Trochilus" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Trochilus</span></a> <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> 🌐🔐🖥️</p>
securityaffairs<p>Power Generator in South <a href="https://infosec.exchange/tags/Africa" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Africa</span></a> hit with <a href="https://infosec.exchange/tags/DroxiDat" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DroxiDat</span></a> and <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a><br><a href="https://securityaffairs.com/149432/cyber-crime/power-generator-droxidat.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">securityaffairs.com/149432/cyb</span><span class="invisible">er-crime/power-generator-droxidat.html</span></a><br><a href="https://infosec.exchange/tags/securityaffairs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>securityaffairs</span></a> <a href="https://infosec.exchange/tags/APT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APT</span></a></p>
Brad<p>2023-05-22 (Mon) & 2023-05-23 (Tue): TA577 pushes <a href="https://infosec.exchange/tags/Pikabot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Pikabot</span></a></p><p>2023-05-24 (Wed): TA577 back to pushing <a href="https://infosec.exchange/tags/Qabkot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Qabkot</span></a> (<a href="https://infosec.exchange/tags/Qbot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Qbot</span></a>)</p><p>Pikabot:</p><p>- <a href="https://malware-traffic-analysis.net/2023/05/22/index.html" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">malware-traffic-analysis.net/2</span><span class="invisible">023/05/22/index.html</span></a></p><p>- <a href="https://malware-traffic-analysis.net/2023/05/23/index.html" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">malware-traffic-analysis.net/2</span><span class="invisible">023/05/23/index.html</span></a></p><p>Qakbot (TA570 obama264): </p><p>- <a href="https://malware-traffic-analysis.net/2023/05/24/index.html" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">malware-traffic-analysis.net/2</span><span class="invisible">023/05/24/index.html</span></a></p><p>I was lucky enough to get <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> with the two Pikabot infections, so I wrote tweets for my employer on the bird site.</p><p>See the above links for <a href="https://infosec.exchange/tags/pcap" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pcap</span></a> files, malware samples, IOCs, and links to my employer's tweets for the Pikabot activity.</p>
Xavier «X» Santolaria :verified_paw: :donor:<p>📨 Latest issue of my curated <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> and <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> list of resources for week #20/2023 is out! It includes, but not only:</p><p>‣ 🔓 PoC Tool Exploits Unpatched <a href="https://infosec.exchange/tags/KeePass" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>KeePass</span></a> Vulnerability to Retrieve Master Passwords<br>‣ 📱 Millions of Smartphones Distributed Worldwide With Preinstalled ‘Guerrilla’ <a href="https://infosec.exchange/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Malware</span></a><br>‣ 📨 <a href="https://infosec.exchange/tags/MalasLocker" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MalasLocker</span></a> ransomware targets <a href="https://infosec.exchange/tags/Zimbra" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Zimbra</span></a> servers, demands charity donation<br>‣ 🇯🇵 🇺🇦 🇮🇪 🇮🇸 4 Countries Join <a href="https://infosec.exchange/tags/NATO" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NATO</span></a> Cyber Defense Center<br>‣ 🤐 New <a href="https://infosec.exchange/tags/ZIP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ZIP</span></a> domains spark debate among <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> experts<br>‣ 🍏 Open-source <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> port 'Geacon' used in <a href="https://infosec.exchange/tags/macOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>macOS</span></a> attacks<br>‣ 🇺🇸 <a href="https://infosec.exchange/tags/IBM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IBM</span></a> Snaps up DSPM Startup Polar Security<br>‣ 🇷🇺 🇺🇸 Russian Hacker “Wazawaka” Indicted for <a href="https://infosec.exchange/tags/Ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Ransomware</span></a><br>‣ 🇺🇸 🇦🇺 <a href="https://infosec.exchange/tags/StopRansomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>StopRansomware</span></a>: BianLian Ransomware Group<br>‣ 🇨🇳 Malware turns home routers into proxies for Chinese state-sponsored hackers<br>‣ 🏠 🔌 ‘FriendlyName’ Buffer Overflow Vulnerability in <a href="https://infosec.exchange/tags/Wemo" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Wemo</span></a> Smart Plug V2<br>‣ 🔙 🚪 Stealthy MerDoor malware uncovered after five years of attacks<br>‣ 🇱🇻 ✈️ Airline exposes passenger info to others due to a 'technical error'<br>‣ New 'MichaelKors' Ransomware-as-a-Service Targeting <a href="https://infosec.exchange/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> and <a href="https://infosec.exchange/tags/VMware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>VMware</span></a> ESXi Systems<br>‣ 🇺🇸 🇰🇷 Ransomware group claims 2.5 terabytes of stolen data less than a month after emerging online<br>‣ 🇰🇵 North Korea funding half its missile program with <a href="https://infosec.exchange/tags/cryptocurrency" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cryptocurrency</span></a> theft and cyberattacks<br>‣ 🇺🇸 Former <a href="https://infosec.exchange/tags/Ubiquiti" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Ubiquiti</span></a> Employee Gets 6 Years in Jail for $2 Million Crypto Extortion Case<br>‣ 🇬🇧 <a href="https://infosec.exchange/tags/Capita" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Capita</span></a> warns customers they should assume data was stolen</p><p><a href="https://infosec.exchange/tags/cyberdefense" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cyberdefense</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/automation" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>automation</span></a> <a href="https://infosec.exchange/tags/airline" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>airline</span></a> <a href="https://infosec.exchange/tags/data" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>data</span></a> </p><p>📚 This week's recommended reading is: "PowerShell Automation and Scripting for CyberSecurity: Hacking and Defense for Red and Blue Teamers" by Miriam C. Wiesner</p><p>Subscribe to the <a href="https://infosec.exchange/tags/newsletter" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>newsletter</span></a> to have it piping hot in your inbox every Sunday ⬇️</p><p><a href="https://0x58.substack.com/p/infosec-mashup-week-202023" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">0x58.substack.com/p/infosec-ma</span><span class="invisible">shup-week-202023</span></a></p>
Brad<p>Tweet I wrote for my employer at the bird site: <a href="https://twitter.com/Unit42_Intel/status/1659199751265595392" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">twitter.com/Unit42_Intel/statu</span><span class="invisible">s/1659199751265595392</span></a></p><p>2023-05-17 (Wednesday): Today, this week's BB28 <a href="https://infosec.exchange/tags/Qakbot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Qakbot</span></a>-style distribution chain pushed <a href="https://infosec.exchange/tags/Pikabot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Pikabot</span></a> instead of Qakbot. Followed up with <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> using <a href="https://infosec.exchange/tags/DNSTunneling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DNSTunneling</span></a>. We later saw additional Cobalt Strike traffic over HTTPS. List of IOCs available at <a href="https://github.com/pan-unit42/tweets/blob/master/2023-05-17-IOCs-for-Pikabot-with-Cobalt-Strike.txt" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/pan-unit42/tweets/b</span><span class="invisible">lob/master/2023-05-17-IOCs-for-Pikabot-with-Cobalt-Strike.txt</span></a></p><p>A carved <a href="https://infosec.exchange/tags/pcap" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pcap</span></a> of the infection traffic (removed everything not related to the <a href="https://infosec.exchange/tags/Pikabot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Pikabot</span></a> & <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a>) and the associated malware/registry updates available at <a href="https://malware-traffic-analysis.net/2023/05/17/index.html" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">malware-traffic-analysis.net/2</span><span class="invisible">023/05/17/index.html</span></a></p>
securityskeptic :donor: :verified:<p>MSFT obtains court order to sinkhole Cobalt Strike C&C traffic. </p><p>The order lists 16 John Does as </p><p>Appendix A of the order identifies the Hosting Companies/Data <br>Centers Where Defendants <br>Placed the Command and <br>Control Servers and the 1000 or so C&C IP addresses. </p><p>It also includes the Whois for the ~110 C&C domains. </p><p>The contact data for these are redacted or unavailable from the ccTLD operator. </p><p>So...</p><p> _none_ of the domain registrations yielded the name and contact of a party that could be named as a defendant in the action?</p><p>Microsoft's attorneys have filed dozens of orders like this one. Surely they asked for a Whois reveal or asked for billing data.</p><p>So...</p><p> _none_ of the domain registration BILLING DATA yielded the name and contact of a party that could be named as a defendant in the action?</p><p><a href="https://www.databreachtoday.com/microsoft-gets-court-order-to-sinkhole-cobalt-strike-traffic-a-21650" rel="nofollow noopener" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">databreachtoday.com/microsoft-</span><span class="invisible">gets-court-order-to-sinkhole-cobalt-strike-traffic-a-21650</span></a></p><p><a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ransomware</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/cobaltstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cobaltstrike</span></a> <a href="https://infosec.exchange/tags/c2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>c2</span></a> <a href="https://infosec.exchange/tags/whois" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>whois</span></a> <a href="https://infosec.exchange/tags/itsalwaysdns" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>itsalwaysdns</span></a> <a href="https://infosec.exchange/tags/exceptwhenitsIPs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>exceptwhenitsIPs</span></a></p><p>Set aside privacy protection (it can be managed for all natural person's complete and accurate contact data) but share with me:</p>
Opalsec :verified:<p>The cyber crims are working through the holidays, and so are we. Here's Monday's newsletter on all the developments in infosec, just for you:</p><p><a href="https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-744?sd=pf" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">opalsec.substack.com/p/soc-gou</span><span class="invisible">lash-weekend-wrap-up-744?sd=pf</span></a></p><p>International law enforcement agencies notched up another win last week, having successfully taken down the notorious Initial Access Broker Genesis Marketplace last week - or did they? The site remains active and the admins appear to have gotten away unscathed, so what victory was there to be had?</p><p><a href="https://infosec.exchange/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft</span></a>, in collaboration with <a href="https://infosec.exchange/tags/Fortra" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Fortra</span></a> and the Health ISAC, are commencing work to dismantle infrastructure used by actors abusing cracked versions of the offensive Cobalt Strike framework. It'll be an uphill battle, and it remains to be seen if they can make a dent in the sprawling global footprint achieved by the cyber crim's implant of choice.</p><p>Be warned - a PoC exploit has been released for a CVSS 10.0 Sandbox Escape vulnerability impacting the VM2 JavaScript Sandbox, which itself has >16 million monthly downloads on <a href="https://infosec.exchange/tags/npm" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>npm</span></a>. Researchers have also uncovered a vulnerability in <a href="https://infosec.exchange/tags/WiFi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WiFi</span></a> APs that could allow hijacking and snooping of client traffic; <a href="https://infosec.exchange/tags/Apple" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Apple</span></a> patches two actively exploited 0-days in <a href="https://infosec.exchange/tags/iOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iOS</span></a>, <a href="https://infosec.exchange/tags/iPadOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iPadOS</span></a> and <a href="https://infosec.exchange/tags/macOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>macOS</span></a>, and <a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CISA</span></a> urges patching of <a href="https://infosec.exchange/tags/Zimbra" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Zimbra</span></a> bugs exploited by Russian APTs.</p><p>The <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>redteam</span></a> have some great tooling and tradecraft to help with Microsoft <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> enumeration and performing port forwarding on compromised <a href="https://infosec.exchange/tags/Cisco" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cisco</span></a> gear, while the <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>blueteam</span></a> are again spoiled for choice - a new database of exploited drivers, research on abuse of SFX archives for persistence, and threat models for <a href="https://infosec.exchange/tags/AWS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AWS</span></a> KMS and CI/CD pipelines - take your pick!</p><p>Check out the newsletter and catch all this and much more excellent threat and tradecraft research, to help you gear up for the week ahead: </p><p><a href="https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-744?sd=pf" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">opalsec.substack.com/p/soc-gou</span><span class="invisible">lash-weekend-wrap-up-744?sd=pf</span></a></p><p>Happy Easter Monday to everyone lucky enough to be enjoying the holiday, I hope you're all having a great break wherever you are, and a reminder that if you're travelling on the roads, to please drive safe!</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/cyber" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cyber</span></a> <a href="https://infosec.exchange/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>news</span></a> <a href="https://infosec.exchange/tags/cybernews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybernews</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/infosecnews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosecnews</span></a> <a href="https://infosec.exchange/tags/informationsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>informationsecurity</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/newsletter" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>newsletter</span></a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hacking</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/technology" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>technology</span></a> <a href="https://infosec.exchange/tags/hacker" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hacker</span></a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerability</span></a> <a href="https://infosec.exchange/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerabilities</span></a> <a href="https://infosec.exchange/tags/exploit" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>exploit</span></a> <a href="https://infosec.exchange/tags/PoC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PoC</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ransomware</span></a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>dfir</span></a> <a href="https://infosec.exchange/tags/soc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>soc</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/DarkWeb" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DarkWeb</span></a> <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> <a href="https://infosec.exchange/tags/IAB" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IAB</span></a> <a href="https://infosec.exchange/tags/InitialAccessBroker" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InitialAccessBroker</span></a> <a href="https://infosec.exchange/tags/GenesisMarketplace" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GenesisMarketplace</span></a></p>
Hackread.com<p>Microsoft and cybersecurity firm Forta have joined forces to take down the malicious infrastructure of <a href="https://mstdn.social/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a>, which is used in large-scale ransomware attacks.</p><p>Read: <a href="https://www.hackread.com/microsoft-fortra-cobalt-strike-infrastructure/" rel="nofollow noopener" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">hackread.com/microsoft-fortra-</span><span class="invisible">cobalt-strike-infrastructure/</span></a> </p><p><a href="https://mstdn.social/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Security</span></a> <a href="https://mstdn.social/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybercrime</span></a> <a href="https://mstdn.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://mstdn.social/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ransomware</span></a> <a href="https://mstdn.social/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft</span></a></p>
Opalsec :verified:<p>Happy Monday folks, I hope you had a restful weekend and managed to take a breather from all things cyber! Time to get back into it though, so let me give you hand - catch up on the week’s infosec news with the latest issue of our newsletter:</p><p><a href="https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-09e?sd=pf" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">opalsec.substack.com/p/soc-gou</span><span class="invisible">lash-weekend-wrap-up-09e?sd=pf</span></a></p><p><a href="https://infosec.exchange/tags/Emotet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Emotet</span></a> are back and are using…OneNote lures? ISO disk images? Malvertising? Nah – they’re sticking with tier tried and true TTPs – their Red Dawn maldoc template from last year; macro-enabled documents as lures, and null-byte padding to evade automated scanners. </p><p>We’ve highlighted a report on the Xenomorph <a href="https://infosec.exchange/tags/Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Android</span></a> Banking Trojan, which added support for targeting accounts of over 400 banks; automated bypassing of MFA-protected app logins, and a Session Token stealer module. With capabilities like these becoming the norm, is it time to take a closer look at the threat Mobile Malware could pose to enterprise networks?</p><p>North Korean hackers have demonstrated yet again that they’re tracking and integrating the latest techniques, and investing in malware development. A recent campaign saw eight new pieces of malware distributed throughout the kill chain, leveraging <a href="https://infosec.exchange/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft</span></a> <a href="https://infosec.exchange/tags/InTune" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InTune</span></a> to deliver payloads and an in-memory dropper to abuse the <a href="https://infosec.exchange/tags/BYOVD" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BYOVD</span></a> technique and evade EDR solutions.</p><p>A joint investigation by <a href="https://infosec.exchange/tags/Mandiant" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Mandiant</span></a> and <a href="https://infosec.exchange/tags/SonicWall" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SonicWall</span></a> has unearthed a two-year campaign by Chinese actors, enabled through exploitation of unpatched SMA100 appliances and delivery of tailored payloads. A critical vulnerability reported by <a href="https://infosec.exchange/tags/Fortinet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Fortinet</span></a> this week helps reinforce the point that perimeter devices need to be patched with urgency, as it’s a well-documented target for Chinese-affiliated actors.</p><p><a href="https://infosec.exchange/tags/HiatusRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>HiatusRAT</span></a> is a novel malware targeting <a href="https://infosec.exchange/tags/DrayTek" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DrayTek</span></a> routers, sniffing network traffic and proxying C2 traffic to forward-deployed implants. TTPs employed in recent <a href="https://infosec.exchange/tags/BatLoader" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BatLoader</span></a> and <a href="https://infosec.exchange/tags/Qakbot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Qakbot</span></a> campaigns are also worth taking note of, as is <a href="https://infosec.exchange/tags/GoBruteforcer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GoBruteforcer</span></a>, a new malware family targeting specific web server applications to brute force logins and deploy an IRC bot for C2.</p><p>Those in Vulnerability Management should take particular note of the <a href="https://infosec.exchange/tags/Veeam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Veeam</span></a> vulnerability, which appears trivial to exploit and actually delivers plaintext credentials to the attacker. CISA have also taken note of nearly 40k exploit attempts of a 2 year old code-exec-as-root vulnerability in the <a href="https://infosec.exchange/tags/VMWare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>VMWare</span></a> Cloud Foundation product in the last two months, so make sure you’re patched against it.</p><p><a href="https://infosec.exchange/tags/Redteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Redteam</span></a> members have some excellent reading to look forward to, looking at HTTP request smuggling to harvest AD credentials and persisting with a MitM Exchange server, as well as a detailed post that examines <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a>’s reflective loading capability;</p><p>The <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>blueteam</span></a> has some great tradecraft tips from <span class="h-card"><a href="https://infosec.exchange/@inversecos" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>inversecos</span></a></span> on <a href="https://infosec.exchange/tags/Azure" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Azure</span></a> DFIR, as well as tools to help scan websites for malicious objects, and to combat the new <a href="https://infosec.exchange/tags/Stealc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Stealc</span></a> <a href="https://infosec.exchange/tags/infostealer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infostealer</span></a> and well-established Raccoon Stealer.</p><p>Catch all this and much more in this week's newsletter:</p><p><a href="https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-09e?sd=pf" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">opalsec.substack.com/p/soc-gou</span><span class="invisible">lash-weekend-wrap-up-09e?sd=pf</span></a></p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/cyber" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cyber</span></a> <a href="https://infosec.exchange/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>news</span></a> <a href="https://infosec.exchange/tags/cybernews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybernews</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/infosecnews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosecnews</span></a> <a href="https://infosec.exchange/tags/informationsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>informationsecurity</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/newsletter" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>newsletter</span></a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hacking</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/technology" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>technology</span></a> <a href="https://infosec.exchange/tags/hacker" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hacker</span></a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerability</span></a> <a href="https://infosec.exchange/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerabilities</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ransomware</span></a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>dfir</span></a> <a href="https://infosec.exchange/tags/soc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>soc</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/DarkWeb" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DarkWeb</span></a> <a href="https://infosec.exchange/tags/mdm" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>mdm</span></a> <a href="https://infosec.exchange/tags/dprk" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>dprk</span></a> <a href="https://infosec.exchange/tags/FortiOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FortiOS</span></a> <a href="https://infosec.exchange/tags/FortiProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FortiProxy</span></a></p>
Xavier «X» Santolaria :verified_paw: :donor:<p>This week's <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> newsletter issue is out! Have a look at it. It includes, but not only:</p><ul><li>CISA warns of actively exploited <a href="https://infosec.exchange/tags/Plex" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Plex</span></a> bug after <a href="https://infosec.exchange/tags/LastPass" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LastPass</span></a> breach</li><li>Brazil seizing <a href="https://infosec.exchange/tags/FlipperZero" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FlipperZero</span></a> shipments to prevent use in crime</li><li><a href="https://infosec.exchange/tags/IBM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IBM</span></a> X-Force on defining the <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> Reflective Loader</li><li>Security researchers targeted with new <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> via job offers on <a href="https://infosec.exchange/tags/LinkedIn" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LinkedIn</span></a></li><li>Alleged NetWire RAT Operator Arrested in Croatia as FBI Seizes Website</li><li>Xenomorph <a href="https://infosec.exchange/tags/Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Android</span></a> malware now steals data from 400 banks</li><li><a href="https://infosec.exchange/tags/GitHub" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GitHub</span></a> makes 2FA mandatory next week for active developers</li><li>The <a href="https://infosec.exchange/tags/Akuvox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Akuvox</span></a> E11 door phone/intercom is riddled with security holes</li><li>Custom Chinese Malware Found on <a href="https://infosec.exchange/tags/SonicWall" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SonicWall</span></a> Appliance</li><li>Building Great OT Incident Response Tabletop Exercises, by <span class="h-card"><a href="https://infosec.exchange/@hacks4pancakes" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>hacks4pancakes</span></a></span> </li><li>Warning: Don't Let <a href="https://infosec.exchange/tags/Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Google</span></a> Manage Your <a href="https://infosec.exchange/tags/Passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Passwords</span></a> </li><li><a href="https://infosec.exchange/tags/Fortinet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Fortinet</span></a> warns of new critical unauthenticated RCE <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerability</span></a></li><li><a href="https://infosec.exchange/tags/Veeam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Veeam</span></a> fixes bug that lets hackers breach <a href="https://infosec.exchange/tags/backup" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>backup</span></a> infrastructure</li><li>AI-Powered '<a href="https://infosec.exchange/tags/BlackMamba" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BlackMamba</span></a>' Keylogging Attack Evades Modern <a href="https://infosec.exchange/tags/EDR" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EDR</span></a> Security</li><li>Hard-coded secrets up 67% as secrets sprawl threatens software supply chain</li><li><a href="https://infosec.exchange/tags/Emotet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Emotet</span></a> malware attacks return after three-month break</li></ul><p>.. And many more. Subscribe to receive it directly in your inbox every Sunday!</p><p><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/newsletter" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>newsletter</span></a> </p><p><a href="https://0x58.substack.com/p/my-shared-links-week-102023" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">0x58.substack.com/p/my-shared-</span><span class="invisible">links-week-102023</span></a></p>
Brad<p>Originally posted at: <a href="https://twitter.com/Unit42_Intel/status/1623707361184477185" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">twitter.com/Unit42_Intel/statu</span><span class="invisible">s/1623707361184477185</span></a></p><p>2023-02-08 (Wednesday) As follow-up to an <a href="https://infosec.exchange/tags/IcedID" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IcedID</span></a> (<a href="https://infosec.exchange/tags/Bokbot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Bokbot</span></a>) infection, I saw a <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> stager hosted at hxxp://167.172.154[.]189/b360802.dll with follow-up Cobalt Strike C2 on 79.132.128[.]191:443 using thefirstupd[.]com as its domain. </p><p>IoCs available at <a href="https://github.com/pan-unit42/tweets/blob/master/2023-02-08-IOCs-for-Cobalt-Strike-from-IcedID.txt" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/pan-unit42/tweets/b</span><span class="invisible">lob/master/2023-02-08-IOCs-for-Cobalt-Strike-from-IcedID.txt</span></a></p>
Brad<p>Originally posted on Twitter at: <a href="https://twitter.com/Unit42_Intel/status/1620531956504055812" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">twitter.com/Unit42_Intel/statu</span><span class="invisible">s/1620531956504055812</span></a></p><p>2023-01-31 (Tuesday) - <a href="https://infosec.exchange/tags/Qakbot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Qakbot</span></a> (<a href="https://infosec.exchange/tags/Qbot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Qbot</span></a>) returns after one month hiatus, now using OneNote (.one) files as initial lure. Saw <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> on 104.237.219[.]36 using ciruvowuto[.]com as the domain. Also saw VNC traffic from this infection. IoCs available at <a href="https://github.com/pan-unit42/tweets/blob/master/2023-01-31-BB12-Qakbot-infection-IOCs.txt" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/pan-unit42/tweets/b</span><span class="invisible">lob/master/2023-01-31-BB12-Qakbot-infection-IOCs.txt</span></a></p><p><a href="https://infosec.exchange/tags/pcap" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pcap</span></a> and malware samples at <a href="https://www.malware-traffic-analysis.net/2023/01/31/index.html" rel="nofollow noopener" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">malware-traffic-analysis.net/2</span><span class="invisible">023/01/31/index.html</span></a></p><p>VNC traffic on 78.31.67[.]7 port 443.</p><p>Overall, this is the same type of Qakbot activity seen last year. The only real difference is the OneNote files.</p>
ath0<p><a href="https://infosec.exchange/tags/hack100days" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hack100days</span></a> : day 14d : Watched Mudge’s lateral movement video for <a href="https://infosec.exchange/tags/cobaltstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cobaltstrike</span></a>. <a href="https://infosec.exchange/tags/activedirectory" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>activedirectory</span></a> and <a href="https://infosec.exchange/tags/windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>windows</span></a> refresher. <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>redteam</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
TrendingLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload