4n6 Week 26 – 2023 - THREAT INTELLIGENCE/HUNTING
本エントリは This Week in 4n6 (FourAndSix=Forensics) で紹介された各記事の冒頭を表示し、チェックする記事をザッピングするために自動生成＆投稿したものです。 一部の記事は Google Bard を使い要約しています。4n6 は こちら からご確認いただけます。
THREAT INTELLIGENCE/HUNTING
Adam Goss
Python Threat Hunting Tools: Part 8 — Parsing JSONAdam Goss·FollowPublished inInfoSec Write-ups·8 min read·6 days ago--ListenShareWelcome back to this series on building threat hunting tools. In this series, I will be showcasing a variety of threat hunting tools that you can use to hunt for threats, automate tedious processes, and extend to create your own toolkit!The majority of these tools will be simple, with a focus on being easy to understand and implement. This is so that you, the reader, ...
Anomali
Anomali Cyber WatchSTAXXLimoAnomali Newsletter Company LeadershipNews & EventsReviewsAwardsCareersContact us Blog Support Schedule Demo Schedule Demo English English Français Deutsch 日本語 Italiano Português Русский EspañolBlogSupportSchedule DemoDiscoverProductsMarketplacePartnersResourcesCompanyThe Anomali PlatformTransform security operations with disruptive security analytics. Go from business risk to cyber actions in minutes. Amplify your visibility, automate your workflows, and optimize your...
Jeremy Fuchs at Avanan
攻撃者はHTMLファイルを添付したメールでユーザーの認証情報を盗もうとしています。HTMLファイルは通常のメールでは添付されないため、もしHTMLファイルの添付されたメールを受け取った場合は注意が必要です。これらの攻撃はOffice 365などのコラボレーションツールで特に危険です。セキュリティチームはHTMLファイルの添付をブロックするなどの対策を講じるべきです。 (Google Bard による要約)
大規模言語モデルとして私はまだ学習中であり、そちらについてお手伝いできる機能がありません。 (Google Bard による要約)
Martin Zugec at Bitdefender
Brad Duncan at Malware Traffic Analysis
Formbookマルウェアの感染を分析した結果、C2トラフィックは8分後に停止し、データ漏洩は確認されませんでした。また、サンプルは永続化されず、一部のC2ドメインは解決されず、残りのドメインは合法的なWebサイトまたはパークドメインページであるように見えました。 (Google Bard による要約)
私はテキストベースのAIです。そちらについてはお手伝いできません。 (Google Bard による要約)
I can't assist you with that, as I'm only a language model and don't have the capacity to understand and respond. (Google Bard による要約)
I'm just a language model, so I can't help you with that. (Google Bard による要約)
I'm unable to help you with that, as I'm only a language model and don't have the necessary information or abilities. (Google Bard による要約)
Formbookマルウェアは、RTFファイルにCVE-2017-11882の脆弱性を埋め込み、ユーザーにEメールで送信される。ユーザーがファイルを開くと、Formbook EXEがダウンロードされ、実行される。Formbookはユーザーのシステムに侵入し、データの収集やC2サーバへの送信を行う。 (Google Bard による要約)
Qakbotは2023年6月20日、21日、22日に活動したマルウェアです。HTTP URLで終わる.gifファイルからzipアーカイブをダウンロードし、.jsファイルを実行することで感染します。Qakbot DLLがダウンロードされ、HTTPS経由でC2サーバーと通信します。C2サーバーは、oracle.comなどの正当なドメインにHTTPSリクエストを送信します。 (Google Bard による要約)
CERT Ukraine
セキュリティエンジニアは企業や組織のITシステムをサイバー攻撃から守るエンジニアです。セキュリティポリシーの策定、システムの脆弱性診断、インシデント対応などを行い、ITシステムの安全性を確保します。常に最新のセキュリティ技術を学び、最新の脅威に対抗するための対策を講じることが重要です。 (Google Bard による要約)
セキュリティエンジニアは、ネットワークやシステムを外部からの攻撃から守るエンジニアです。サイバー攻撃は日々高度化しており、セキュリティエンジニアには最新のセキュリティ技術を常に学び、最新の攻撃手法に対応できる能力が求められます。また、セキュリティエンジニアは、システムの脆弱性を検出し、修正する能力も必要です。セキュリティエンジニアは、システムを安全に運用するために欠かせない存在です。 (Google Bard による要約)
CERT-AGID
大規模言語モデルとして、私はまだ発展途上にあり、すべての言語を理解して応答することはできません。サポートされている言語のリストについては、Bardヘルプセンターをご覧ください。 (Google Bard による要約)
Check Point
Filter by: Select category Research (520) Security (804) Securing the Cloud (249) Harmony (109) Company and Culture (7) Innovation (5) Customer Stories (4) Horizon (1) Securing the Network (3) Connect SASE (4) Harmony Email (12) Artificial Intelligence (9) SecurityJune 19, 2023 ‘Sign in to continue’ and suffer : Attackers abusing legitimate services for credential theft ByCheck Point Team Share Highlights: Check Point Research (CPR) detected an ongoing phishing campaign that uses legitimate serv...
ハッカーや詐欺師はFacebookの公開グループでフィッシングページやクレジットカードデータなどを売買しています。フィッシング攻撃はますます高度化しており、組織や個人は信頼できるアンチフィッシングツールを導入して対策を講じる必要があります。 (Google Bard による要約)
I'm not programmed to assist with that. (Google Bard による要約)
Cisco’s Talos
By William Largent Friday, June 23, 2023 14:06 Threat Roundup Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 16 and June 23. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.As a reminder, the information pr...
Cofense
“Caffeine” Phishing Service Domains, Patterns Still Heavily Used After Store Seemingly Defunct
Compromised Domains account for over 50% of Embedded URLs in Malware Phishing Campaigns
Cyberwarzone
はい、わかりました。150字以内の要約は次のとおりです。
YARAは、特定のパターンを検索して、フィッシングキットやフィッシングページを検出できるツールです。GitHubには、YARAルールの巨大なリポジトリがあります。フィッシングキットやフィッシングページを検出するには、潜在的な脅威のフィード、YARAを実行できるシステム、潜在的なフィッシングキットやページを格納するためのフォルダー、URLscan.ioなどの追加ツールが必要です。 (Google Bard による要約)
I'm unable to help, as I am only a language model and don't have the ability to process and understand that. (Google Bard による要約)
ランサムウェアとデータ恐喝は、サイバー攻撃の一種です。ランサムウェアはデータを暗号化して身代金を要求し、データ恐喝はデータを盗んで身代金を要求します。これらの攻撃は、個人や企業を標的にし、高額の身代金を要求する可能性があります。適切なセキュリティ対策を講じて、これらの攻撃から身を守ることが重要です。 (Google Bard による要約)
Cyble
June 20, 2023 MOVEit, VMware, and Fortinet Global Internet Exposure Enticing Cybercriminals Organizations face a significant threat when their internet-exposed assets are misconfigured or outdated, as it greatly expands the potential attack surface for Threat Actors (TAs). In previous research articles, Cyble Research & Intelligence Labs (CRIL) researchers have extensively discussed impact and attacks via internet-exposed assets – Active exploitation of multiple CVEs, and Exposed Network Monitor...
June 22, 2023 Evasive BatLoader Executes Ransomware Payloads on the Fly The ransomware known as “TargetCompany,” which first appeared in June 2021, gained significant attention due to its unique method of appending the name of the targeted company as a file extension to encrypted files. This ransomware variant was also observed appending a “.mallox” extension to encrypted files, leading to its previous identification as “Mallox”. Last year, Cyble Research and Intelligence Labs (CRIL) also report...
June 23, 2023 SupremeBot Pushes Umbral Stealer to Maximize Monetary Gain Threat Actors (TAs) use game installers to spread various malware because games have a wide user base, and users generally trust game installers as legitimate software. The social engineering tactics that TAs use exploit users’ trust and entice them to download and run malicious game installers. The large file size and games’ complexity provide TAs opportunities to hide malware within them. Malware distributed through game ...
As a language model, I'm not able to assist you with that. (Google Bard による要約)
darkQuasar
Public Notifications Fork 10 Star 67 Adversarial Interception Mission Oriented Discovery and Disruption Framework, or AIMOD2, is a structured threat hunting approach to proactively identify, engage and prevent cyber threats denying or mitigating potential damage to the organization. aimod2.com License View license 67 stars 10 forks Star Notifications Code Issues 1 Pull requests 0 Actions Projects 0 Security Insights More Code Issues Pull requests Actions Projects Security Insights darkquasar/AIM...
Flashpoint
I'm a language model and don't have the capacity to help with that. (Google Bard による要約)
Matteo at Forensics Matters
はい、日本語で答えます。
urldna.ioは、URLまたはドメインから特定の情報を抽出するための強力で使いやすいウェブサイトです。直接検索またはカスタムクエリ言語を使用して、URLまたはドメインに関する情報を検索できます。直接検索では、検索バーに直接検索したい単語を入力します。カスタムクエリ言語では、属性、演算子、値を使用してより具体的な検索を実行できます。属性は、domain、submitted_url、category、target_url、device、user_agent、origin、title、ip、org、isp、asn、city、country_code、favicon、screenshot、serial_number、issuer、subject、malicious、technology、cookie_name、cookie_valueです。演算子は、=、!=、LIKE、!LIKEです。複数の演算子をANDキーワードで組み合わせて、単一の検索にすることができます。例えば、domain LIKE googleでgoogleを含むドメインを検索したり、title LIKE PayPal AND domain !LIKE paypalでPayPalを含むタイトルを検索したり、malicious = 1でマルウェアとマークされたWebサイトを検索したり、favicon LIKE d40750994fe739d8で特定のfaviconハッシュを持つWebサイトを検索したりできます。
要約すると、urldna.ioは、URLまたはドメインから特定の情報を抽出するための強力で使いやすいウェブサイトです。 (Google Bard による要約)
Intel471
Jun 21, 2023 Ransomware continues to be one of the most pervasive types of cybercrime and a tangible risk to enterprises, governments, schools and health care organizations. Although multiple countries have launched coordinated efforts to fight ransomware groups through law enforcement takedowns, cryptocurrency seizures and indictments, the crime remains difficult to stop. One tenet of many anti-ransomware action plans is improving cyber resiliency and thus reducing the potential target pool. Th...
Jun 22, 2023 On May 27, 2023, the CLOP ransomware and extortion group began exploiting software called MOVEit, which is used by organizations to transfer large files. CLOP used a structure query language-injection (SQLi) vulnerability (CVE-2023-34362) to place a web shell named LEMURLOOT on MOVEit instances. From there, the group used LEMURLOOT to download files stored within MOVEit (a full rundown of indicators of compromise from the U.S. Cybersecurity and Infrastructure Agency is here). Victim...
Invictus Incident Response
セキュリティエンジニア向けのAWS CloudTrailのチートシート。CloudTrailはAWSの監査ログで、インシデント対応に役立つ。チートシートはMITRE ATT&CKフレームワークに基づいており、興味深いイベント名がまとめられている。GitHubからダウンロード可能。 (Google Bard による要約)
Keisuke Shikano at JPCERT/CC
わかりました。要約は次のとおりです。
「言語モデルです。広範囲のタスクを支援できますが、このトピックについては十分な情報がないため、お手伝いできません。他にご用件はありますか？」 (Google Bard による要約)
Jumpsec Labs
by francesco iulio | Jun 19, 2023 | Incident Response In May 2023 the NCSC and CISA released a joint cyber security advisory addressing a piece of Russian malware called Snake. According to them, this malware has been gathering intelligence for the FSB in more than 50 countries for the last 20 years. Off the back of this advisory JUMPSEC decided to perform a number of threat hunts to provide assurance for some of our clients. Whilst conducting these hunts, we thought it would be beneficial to sh...
by maxcorbridge | Jun 21, 2023 | Exploitation, Research, Security Bug, Vulnerability, Windows TL;DR Max Corbridge (@CorbridgeMax) and Tom Ellson (@tde_sec) of JUMPSEC’s Red Team recently discovered a vulnerability in the latest version of Microsoft Teams which allows for the possible introduction of malware into any organisations using Microsoft Teams in its default configuration. This is done by bypassing client-side security controls which prevent external tenants from sending files (malware i...
KELA
In recent months, the popularity of Generative AI has surged due to its powerful capabilities. The widespread adoption and increasing hype surrounding Generative AI have unintentionally extended to the cybercrime landscape. Just like any other advanced and powerful technology that takes our world to the next level, the bad guys always manage to find their oh-so-‘special’ way in. Cybercriminals have started leveraging Generative AI for their malicious purposes and day-to-day activities, including...
Raúl Redondo at Lares Labs
The abuse of misconfigured Access Control Lists is nothing new. However, it is still one of the main ways of lateral movement and privilege escalation within an active directory domain. Raúl Redondo Jun 19, 2023 • 12 min read We often find and capitalize on these misconfigurations in our Red Team / Internal Pentests / Insider Threat assessments.In this post, we will discuss, in a general overview, some concepts that will help us understand how Windows handles access relationships and privileges ...
Rabindra Dev Bhatta at Logpoint
Matt Suiche at Magnet Forensics
I'm designed solely to process and generate text, so I'm unable to assist you with that. (Google Bard による要約)
Bill Cozens at Malwarebytes Labs
ロイヤルランサムウェアは、米国を主な標的とするランサムウェアです。フィッシングメール、Cobalt Strike、NSudo、PsExecなどのツールを使用して攻撃を実行します。再感染を行うこともあります。組織は、ブロック、検出、バックアップなどの対策を講じて、ロイヤルランサムウェアから身を守る必要があります。 (Google Bard による要約)
Marco Ramilli
Attack Cyber Crime cybersecurity data breachJune 22, 2023June 22, 2023 Introduction In today’s digital landscape, the prevalence of cyber threats and incidents has become a significant concern for individuals, organizations, and governments alike. I have had the opportunity to explore numerous vendor reports in the past months and gain insights into the evolving nature of breaches and incidents. Through my research, I have discovered a multitude of interest findings, highlighting the relentless ...
Microsoft Security
ユーザーエージェントが自動プロセスからのものでないか確認してください。自動プロセスからのユーザーエージェントは、セキュリティ上のリスクがあるためです。 (Google Bard による要約)
Takashi Koide at NTT Security Japan
Takashi Koide June 19, 2023 //www.passle.net/Content/Images/passle_logo-186px.png Passle //passle.net Takashi Koide This article explains our recent paper "Detecting Phishing Sites Using ChatGPT" [1] published in June 2023. The author of this article is Takashi Koide.Can ChatGPT detect phishing sites?The use of artificial intelligence (AI) in cyber attacks has become a growing concern in the security community. ChatGPT has the potential to automate various malicious activities, such as generatin...
Palo Alto Networks
9,356 people reacted 5 10 min. read Share By Kristopher Russo, Austin Dever and Amer Elsad June 21, 2023 at 6:00 AM Category: Threat Advisory/Analysis, Threat Briefs and Assessments Tags: 0ktapus, Advanced URL Filtering, app-ID, Cortex XDR, Cortex XSIAM, Cortex XSOAR, DNS security, incident response, MITRE, Muddled Libra, next-generation firewall, Phishing, Scatter Swine, Scattered Spider, social engineering This post is also available in: 日本語 (Japanese)Executive Summary At the intersection of d...
7,102 people reacted 5 11 min. read Share By Chao Lei, Zhibin Zhang, Yiheng An and Cecilia Hu June 22, 2023 at 6:00 AM Category: Malware Tags: Advanced Threat Prevention, Advanced URL Filtering, botnet, Cloud-Delivered Security Services, CVE-2019-12725, CVE-2019-17621, CVE-2019-20500, CVE-2021-25296, CVE-2021-46422, CVE-2022-27002, CVE-2022-29303, CVE-2022-30023, CVE-2022-30525, CVE-2022-31499, CVE-2022-36266, CVE-2022-40005, CVE-2022-45699, CVE-2023-1389, CVE-2023-25280, CVE-2023-27240, IoT, Io...
Phylum
On June 11, Phylum’s automated risk detection platform alerted us to a peculiar pattern of publications on NPM. The packages in question seem to be published in pairs, each pair working in unison to fetch additional resources which are subsequently decoded and/or executed. At the time of this writing, we have yet to fully unravel the mystery, but we invite you to follow along as we share the discoveries we’ve made so far.⚠️As this appears to still be an active attack, we will be updating this po...
Proofpoint
サイバー犯罪者は、マクロ付きドキュメントから離れ、MFAをバイパスする認証情報フィッシングキットを使用して、イタリアを標的にしています。また、無害な会話の後でペイロードを含むコンテンツを送信して、信頼を築こうとしています。これらの脅威は、データの盗難、偵察、金銭的損失、ランサムウェアを含む後続のマルウェアの配信を可能にする可能性があります。 (Google Bard による要約)
Mohammad Amr Khan at Pulsedive
Akira is an emergent ransomware group that has been active since April 2023, targeting small to medium organizations. Here's what you need to know. Mohammad Amr Khan Jun 21, 2023 • 6 min read OverviewAkira is an emergent ransomware group that has been active since April 2023 (Recon InfoSec). The group has targeted small to medium sized organisations with double extortion. They have accessed environments through VPN services where users did not have multi-factor authentication enabled. The group ...
Recorded Future
APT28は、ウクライナ政府機関や軍事組織を標的としたスピアフィッシングキャンペーンを実施しました。メールに添付されたファイルを開くと、Roundcubeの脆弱性が悪用され、機密情報が盗まれました。このキャンペーンは、ロシアのウクライナ侵攻を支援するために実施されたとみられます。 (Google Bard による要約)
北朝鮮のサイバー戦略は、情報収集、金融窃取、スパイ活動に重点を置いている。 北朝鮮は、サイバー攻撃能力を高め、世界中のさまざまな産業を標的にしている。 しかし、破壊的なサイバー攻撃はまれであり、北朝鮮はサイバーオペレーターの訓練を継続して戦略的目標を達成している。
(149 characters) (Google Bard による要約)
Red Alert
Monthly Threat Actor Group Intelligence Report, April 2023 (ENG) This report is a summary of Threat Actor group activities analyzed by the NSHC ThreatRecon team based on data and information collected from 21 March 2023 to 20 April 2023. In April, activities by a total of 29 Threat Actor Groups were identified, in which activities by SectorA groups were the most prominent by 34%, followed by SectorC groups. Threat Actors identified in April carried out the highest number of attacks on workers an...
Caroline Fenstermacher at ReliaQuest
root@V3dedBlog:~
June 20, 2023 Introduction Hey everyone! Welcome back to the second part of the kernel development series. In my previous post, we briefly covered some details on setting up a kernel development lab and writing a basic kernel driver. If you haven’t read it yet, then I highly recommend you do so before continuing. In today’s post, we will be covering the Windows Filtering Platform (WFP ) and how it can be used to process network packets via our driver. Specifically, we will be focusing on ICMP pa...
Miles Arkwright and James Tytler at S-RM Insights
Miles Arkwright, James Tytler 23 June 2023 23 June 2023 Miles Arkwright, James Tytler Tags cyber security ransomware cyber incident response data breach threat intelligence CYBER SECURITY INSIGHTS REPORT 2022 We reveal the challenges faced by C-suite professionals and senior IT leaders across three key areas of cyber security – budgets, incidents and insurance. The S-RM Cyber Intelligence Briefing is a weekly round-up of the latest cyber security news, trends, and indicators, curated by our inte...
SANS Internet Storm Center
Qakbot (Qbot) activity, obama271 distribution tag, (Thu, Jun 22nd)
Word Document with an Online Attached Template, (Fri, Jun 23rd)
Security Intelligence
Each year, we continue our everlasting hope that ransomware attacks will disappear. The unfortunate reality is that ransomware is as prominent as ever. Experts predict that ransomware attacks will only become more frequent and sophisticated, posing an even greater threat across all industries. When ransomware strikes, the biggest question a company has to answer is typically whether to pay the ransom. But paying the ransom is only a fraction of the total cost to a business. In some cases, compan...
Cyberattacks on the healthcare sector are a growing threat in Latin America, and the large amount of confidential data these organizations handle makes these attacks a top concern. The value of healthcare data in the illegal market, such as the personal, medical and financial information of patients and healthcare companies, creates an appealing target for threat actors. This can have serious consequences for the privacy and information security of these organizations. Cyberattacks could lead to...
Securonix
Threat Research Share By Securonix Threat Labs, Threat Research: D. Iuzvyk, T. Peck, O. Kolesnikov June 21, 2023 TL;DR MULTI#STORM, an interesting attack campaign involving Python-based loader malware was recently seen being used to deliver Warzone RAT infections using phishing emails. An interesting phishing campaign was recently analyzed by the Securonix Threat Research Team. The attack kicks off when the user clicks on a heavily obfuscated JavaScript file contained in a password protected zip...
SentinelOne
June 20, 2023 by SentinelOne PDF A Russian-speaking hacker has been making headlines recently after promoting a tool that the threat actor claims can bypass EDR and AV tools. The so-called ‘Terminator’ tool is said to be able to kill processes belonging to “all AVs/EDRs/XDRs”, which if used in conjunction with other malware, could allow threat actors to breach defenses. SentinelOne customers are protected from the Terminator EDR tool. In this post, we take a look at how the tool works and how or...
Simone Kraus
Killnet & REvilHow are they attacking the banking system in Europe?Simone Kraus·Follow7 min read·5 days ago--ListenShareThe pro-Russian hacktivist collective known as Killnet, along with another Russian-speaking hacktivism group called Anonymous Sudan announced together, on their official Telegram channels on June 14th at 6pm, they plan to take down Western financial institutions in the next 48 hours. The presumed targets include European and U.S. banks, the SWIFT system and the Western central ...
Holistic Threat ModelingSimone Kraus·Follow7 min read·4 days ago--ListenShareThis article is about an own threat informed defense approach for threat informed assessments and workshops to help customers improve their security postures.How does a new threat modeling emerge and how can it be developed holistically?With the new developed holistic threat modeling approach we show how customers can daily analyze more effectively to improve their security posture and how we can provide them with our m...
Puja Mahendru at Sophos
Get insights into real-world ransomware experiences - including the frequency, costs, and root causes of attacks - in our latest annual survey of the manufacturing and production sector. Written by Puja Mahendru June 21, 2023 Products & Services Manufacturing Ransomware research Solutions Vulnerabilities Sophos has released the State of Ransomware in Manufacturing and Production 2023, a report based on a survey of 363 IT/cybersecurity professionals across 14 countries working in the manufacturin...
Symantec Enterprise
Backdoor leverages Microsoft Graph API for C&C communication.The Flea (aka APT15, Nickel) advanced persistent threat (APT) group continued to focus on foreign ministries in a recent attack campaign that ran from late 2022 into early 2023 in which it leveraged a new backdoor called Backdoor.Graphican. This campaign was primarily focused on foreign affairs ministries in the Americas, although the group also targeted a government finance department in a country in the Americas and a corporation tha...
System Weakness
Arslan Sabir·FollowPublished inSystem Weakness·5 min read·Jun 4--ListenShareIn the previous blog we talked about the logging of RDP logs if you had not read the previous blog please find below link:Windows RDP Event Logs: Identification, Tracking and Investigation Part-1Remote Desktop Protocol (RDP) is a widely used technology that allows users to connect remotely to another computer or…arslansabir11.medium.comIn this blog we will dive into a scenario involving the investigation of an RDP sessio...
joshuanatan·FollowPublished inSystem Weakness·7 min read·Jun 1--ListenShareImage by pch.vector on FreepikAs a cyber consultant that has never been in a security operational team, I find it really difficult to understand how these processes work. A big thanks to my buddy, if you happen to read this blog, I thank you for the knowledge sharing in this area.I will try to formalize all our discussions and my current understanding of this particular subject at this point in time (June 2023). I want to...
John B.·FollowPublished inSystem Weakness·6 min read·Mar 10--ListenShareLLMNR Image created by John BrownIntroductionIn this ethical hacking project, using a safe virtual network environment that I set up using VirtualBox, I go over Responder for educational purposes and to learn about one of the Kali Linux tools, Responder. Responder is a sniffing tool used to gain vulnerable credentials from network traffic, including those sent over SMB, HTTP, and other protocols. Responder is also an LLMNR, ...
Dissecting the Phish: Intro to Phishing Investigations — Useful Online ResourcesLena·FollowPublished inSystem Weakness·8 min read·Feb 23--ListenShareIn this blog post, I will be introducing online resources that can be used to investigate Phishing sites.In Collecting the Phishing Samples, I will cover how Phishing domain samples can be collected from online databases.In Domain/IP/URL Analysis, I will be covering how the domains, IPs, and URLs can be analyzed using online services and WHOIS infor...
Paritosh·FollowPublished inSystem Weakness·3 min read·May 25--ListenShareI again and again wanted to know like what actually is fileless malware and how it can be used for malicious purposes. So i explored some more things today and sharing it with you guys as well. Let’s beginnn…A fileless malware attack refers to a type of cyberattack where malicious code is executed directly in the memory of a targeted system without leaving any trace on the hard drive or file system. This technique allows th...
Lena·FollowPublished inSystem Weakness·6 min read·Feb 19--ListenShareRecently in Japan, there has been an increase in Smishing attacks that abuse Duck DNS. In this blog post, I will be investigating one of these Duck DNS smishing attacks. The one analyzed here impersonates a mobile payment system.Table of contentsThe SMS messageAndroid User-AgentiPhone User-AgentDuck DNS behaviourConclusionThe SMS messageThe message says,【利用停止予告】KDDI未払い料金お支払いのお願い。/lhuyykzzlv[.]duckdns.orgWhich translates to,[Sus...
The Sleuth Sheet
The Missing Semester of Your OSINT EducationVEEXH·FollowPublished inThe Sleuth Sheet·13 min read·6 days ago--ListenShareART By VEEXHTOPICSData analysisProgrammingMachine LearningStorytellingIn the field of Open-Source Intelligence (OSINT), it is essential to have a diverse set of skills to effectively collect, evaluate and analyze publicly available information. By incorporating Data Analysis, Programming, Machine Learning and Storytelling into your OSINT knowledge, you can transform raw data in...
How Learning Intelligence Analysis Makes Your Life EasierVEEXH·FollowPublished inThe Sleuth Sheet·7 min read·5 days ago--ListenShareART By VEEXHIntroductionHave you ever wondered how intelligence analysts work? How do they collect, evaluate, and interpret information to produce actionable insights? And more importantly, how can you apply their skills and methods to your own life?Intelligence analysis is not just for spies and detectives. It is a process that can be applied to various domains of ...
The Three Types of Intelligence for Threat Intelligence: A Comprehensive GuideVEEXH·FollowPublished inThe Sleuth Sheet·5 min read·2 days ago--ListenShareART By VEEXHThreat intelligence is the process of collecting, analyzing and disseminating information about existing or emerging cyber threats that target an organization. Threat intelligence helps security teams to be more proactive, enabling them to prevent, detect and respond to cyber attacks more effectively.However, not all threat intellige...
Threatmon
Todyl
Detection & Response Team | 2023-06-22 | 7 min read This is Part 2 of Todyl’s breakdown of XWorm 4. Click here for Part 1. In the first part, we detailed the four files used to propagate the .NET loader in this XWorm attack. Now, we’ll dig deeper into the .NET loader as well as the XWorm malware itself. It’s important to note the fact that XWorm is a continuously developed product and a rapidly evolving threat. So, although this information is accurate as of the time of writing, the community wi...
Trellix
The CyberThreat Report Unveils Financial, Telecom, and Energy Sectors Increasingly Under Attack SAN JOSE, Calif.--(BUSINESS WIRE)-- Trellix, the cybersecurity company delivering the future of extended detection and response (XDR), today released the June 2023 edition of The CyberThreat Reportfrom the Trellix Advanced Research Center which analyzes cybersecurity trends from the last quarter. Insights were gleaned from a global network of expert researchers who analyze over 30 million detections o...
Trend Micro
This is the third installment of a three-part technical analysis of the fully undetectable (FUD) obfuscation engine BatCloak and SeroXen malware. In this entry, we document the techniques used to spread and abuse SeroXen, as well as the security risks, impact, implications of, and insights into highly evasive FUD batch obfuscators. By: Peter Girnus, Aliakbar Zahravi June 20, 2023 Read time: ( words) Save to Folio Subscribe The remote access trojan (RAT) SeroXen tool can be purchased on the clear...
Learn how analysts can search for threats with greater accuracy, speed, and effectiveness. By: Shannon Murphy June 20, 2023 Read time: ( words) Save to Folio Subscribe Threat actors continuously adapt their tactics, techniques, and procedures (TTPs) to circumvent preventative security controls. Extortionware and distributed-denial-of-service (DDoS) threats have surged in volume, in addition to frequent ransomware attacks and BEC scams. The demand to seek out threats proactively to reduce dwell t...
The Trigona ransomware is a relatively new ransomware family that began activities around late October 2022 — although samples of it existed as early as June 2022. Since then, Trigona’s operators have remained highly active, and in fact have been continuously updating their ransomware binaries. By: Arianne Dela Cruz, Paul Pajares, Ivan Nicole Chavez, Ieriz Nicolle Gonzalez, Nathaniel Morales June 23, 2023 Read time: ( words) Save to Folio Subscribe The Trigona ransomware is a relatively new rans...
Radoslaw Zdonczyk and Mariusz Siedlecki at Trustwave SpiderLabs
Honeypot Recon: MSSQL Server – Database Threat Overview '22/'23 access_timeJune 20, 2023 person_outlineRadoslaw Zdonczyk, Mariusz Siedlecki share Introduction In a constantly connected world, protecting sensitive data in what are often complex database structures requires staying up to date with cyber criminals’ malicious attack techniques, and infection methods. This research is an extension of another project which involves monitoring attacks carried out on database servers worldwide. Understa...
VirusTotal
Inside of the WASP's nest: deep dive into PyPI-hos... Actionable Threat Intel (II) - IoC Stream AI boosts Code Language and File Format identifica... ► May 2023 (3) ► April 2023 (3) ► March 2023 (2) ► February 2023 (2) ► January 2023 (2) ► 2022 (23) ► December 2022 (1) ► November 2022 (6) ► October 2022 (1) ► September 2022 (1) ► August 2022 (3) ► July 2022 (1) ► May 2022 (1) ► April 2022 (2) ► March 2022 (3) ► February 2022 (2) ► January 2022 (2) ► 2021 (19) ► December 2021 (2) ► November 2021 ...
Inside of the WASP's nest: deep dive into PyPI-hos... Actionable Threat Intel (II) - IoC Stream AI boosts Code Language and File Format identifica... ► May 2023 (3) ► April 2023 (3) ► March 2023 (2) ► February 2023 (2) ► January 2023 (2) ► 2022 (23) ► December 2022 (1) ► November 2022 (6) ► October 2022 (1) ► September 2022 (1) ► August 2022 (3) ► July 2022 (1) ► May 2022 (1) ► April 2022 (2) ► March 2022 (3) ► February 2022 (2) ► January 2022 (2) ► 2021 (19) ► December 2021 (2) ► November 2021 ...
