本エントリは This Week in 4n6 (FourAndSix=Forensics) で紹介された各記事の冒頭を表示し、チェックする記事をザッピングするために自動生成＆投稿したものです。4n6 は こちら からご確認いただけます。
THREAT INTELLIGENCE/HUNTING
Antonio Formato
An AI-powered tool designed to help producing Threat Intelligence Mindmap.Antonio Formato·Follow4 min read·4 days ago--ShareIn this post I delve into the motivation and development behind the “TI Mindmap GPT” tool. In the world of threat intelligence, teams are often overwhelmed with a deluge of information. This influx, while potentially valuable for tasks such as hunting and incident response, presents a significant challenge: there are countless write-ups to read and very little time to analy...
Francis Guibernau at AttackIQ
Brad Duncan at Malware Traffic Analysis
2023-12-05 (TUESDAY) - LOADER --< UNIDENTIFIED MALWARE REFERENCE: //www.linkedin.com/posts/unit42_malwaretraffic-timelythreatintel-unit42threatintel-activity-7138177279964151809--S66 //twitter.com/Unit42_Intel/status/1732411660013273387 ASSOCIATED FILES: 2023-12-05-IOCs-from-loader-to-unidentified-malware.txt.zip 1.1 kB (1,065 bytes) 2023-12-05-loader-to-unidentified-malware.pcap.zip 2.6 MB (2,645,864 bytes) 2023-12-05-loader-and-malware-and-artifacts.zip 2.2 MB (2,234,212 bytes) Click here to r...
2023-12-07 (THURSDAY): DARKGATE ACTIVITY REFERENCE: //www.linkedin.com/posts/unit42_darkgate-timelythreatintel-threatintelligence-activity-7138645787709767680-mgL_/ //twitter.com/Unit42_Intel/status/1732857094167023618 ASSOCIATED FILES: 2023-12-07-IOCs-for-DarkGate-infection.txt.zip 2.4 kB (2,431 bytes) 2023-12-07-DarkGate-infection.pcap.zip 2.8 MB (2,789,892 bytes) 2023-12-07-DarkGate-malware-and-artifacts.zip 2.7 MB (2,688,217 bytes) Click here to return to the main page. Copyright © 2023 | Ma...
BushidoToken
Get link Facebook Twitter Pinterest Email Other Apps - December 03, 2023 I recently heard about a wave of scams exploiting Booking.com users. So I went and researched it for myself. I came across a post on the r/travel subreddit about such an incident. [1]The user received a seemingly authentic message with a URL via Booking.com's app. They provided their credit card information and said that “within mere minutes of this, an attempt was made to use [their] credit card for an online purchase.”As ...
Cado Security
New Features in Cloudgrep: Yara Rules, JSON Output and Log Parsing
Cloudypots: Our Latest Method for Uncovering Novel Attack Techniques
Adopting a Proactive Approach to Cloud Incident Response with Cado
CERT Ukraine
CERT-AGID
Sintesi riepilogativa delle campagne malevole nella settimana del 2 – 9 Dicembre 2023 09/12/2023 riepilogo Riportiamo in seguito il dettaglio delle tipologie illustrate nei grafici, risultanti dai dati estratti dalle piattaforme del CERT-AGID e consultabili tramite la pagina delle Statistiche. In questa settimana, il CERT-AGID ha riscontrato ed analizzato, nello scenario italiano di suo riferimento un totale di 23 campagne malevole con obiettivi italiani, mettendo a disposizione dei suoi enti ac...
Check Point
Filter by: Select category Research (535) Security (877) Securing the Cloud (273) Harmony (143) Company and Culture (24) Innovation (6) Customer Stories (9) Horizon (1) Securing the Network (7) Partners (1) Connect SASE (10) Harmony Email (44) Artificial Intelligence (16) ResearchDecember 4, 2023 Check Point Research Report: Iranian Hacktivist Proxies Escalate Activities Beyond Israel ByCheck Point Research Share Highlights: · Expanded Cyber Frontline: Recent developments in cyber warfare reveal...
CISA
Release DateDecember 05, 2023 Alert CodeAA23-339A Related topics: Cyber Threats and Advisories Actions to take today to mitigate malicious cyber activity: Prioritize remediating known exploited vulnerabilities. Employ proper network segmentation. Enable multifactor authentication (MFA) for all services to the extent possible, particularly for webmail, VPN, and accounts that access critical systems. SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) is releasing a Cybersecurity A...
Release DateDecember 07, 2023 Alert CodeAA23-341A Related topics: Advanced Persistent Threats and Nation-State Actors, Cyber Threats and Advisories, Malware, Phishing, and Ransomware The Russia-based actor is targeting organizations and individuals in the UK and other geographical areas of interest. OVERVIEW The Russia-based actor Star Blizzard (formerly known as SEABORGIUM, also known as Callisto Group/TA446/COLDRIVER/TAG-53/BlueCharlie) continues to successfully use spear-phishing attacks agai...
Cisco’s Talos
By Joe Marshall Monday, December 4, 2023 08:01 Ukraine As Russia’s invasion of Ukraine entered its first winter in late 2022, nearly half of Ukraine’s energy infrastructure had been destroyed, leaving millions without power. The resulting energy deficit has exacerbated something that hasn’t had much media attention: The effects of electronic GPS jammers affecting vital electrical equipment.Ukraine’s high-voltage electricity substations rely on GPS for time synchronization. So, when the GPS is ja...
By Cisco Talos Tuesday, December 5, 2023 18:25 Year In Review 2023YiR The 2023 Cisco Talos Year in Review is now available to download. Once again, the Talos team has meticulously combed through a massive amount of data to analyze the major trends that have shaped the threat landscape in 2023. Global conflict influenced a lot of these trends, altering the tactics and approaches of many threat actors. In operations ranging from espionage to cybercrime, we’ve seen geopolitical events have a signif...
CTF导航
Curated Intelligence
on December 03, 2023 Get link Facebook Twitter Pinterest Email Other Apps Introduction Tas (@tas_kmanager), in collaboration with Curated Intelligence, shared his research on the newly observed method of phishing utilizing chat functionality in multiple web/mobile applications. Furthermore, he is able to link this campaign to other similar campaigns based on the shared TTPs and IoCs. Background We have recently tracked a connection in global credit card information harvesting campaign targeting ...
Andy Thompson at CyberArk
× Share this Article Facebook Twitter Email LinkedIn Why Ransomware Actors Abuse Legitimate Software December 6, 2023 Andy Thompson Share this Article Facebook Twitter Email LinkedIn 2023 was a lucrative year for ransomware actors, with victim organizations paying $449.1 million in the first six months alone. Maintaining this cash stream requires frequent technique shifts, which may be why more attackers are exploiting legitimate software to propagate their malware. Abusing organizations’ existi...
Cyberdom
by SecWriter · December 3, 2023 What are the effective ways to identify an adversary in Active Directory infrastructure? There are many ways to identify Active Directory incidents, whether through Event IDs, network traffic, or other logs. The logs are often missing or don’t have accurate data to provide a full attack chain. My favorite way to identify Active Directory incidents is via the Microsoft Defender for Identity and required event IDs in some scenarios. This post, Spotting the Adversary...
by SecWriter · December 9, 2023 In the tangled world of cybersecurity, where threats often wear the cloak of invisibility, defenders must become hunters, actively seeking out their elusive adversaries. Within this digital battleground, Microsoft Defender for Identity emerges as a formidable ally, empowering cybersecurity teams to become vigilant hunters of potential threats before they strike. The battle is unending in cybersecurity, and threats evolve with each passing day. But with Defender fo...
Cyfirma
Published On : 2023-12-08 Share : Ransomware of the Week CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – which could be relevant to your organization. Type: Ransomware. Target Technologies: MS Windows. Introduction CYFIRMA Research and Advisory Team has found a ransomware strain called Xaro while monitoring various underground forums as part of our ...
Deep Instinct
MuddyWater Unleashed a New Social Engineering Campaign Against Israel During the Israel-Hamas War.Simon KeninThreat Intelligence ResearcherDeep Instinct Threat LabExecutive summary:Deep Instinct’s Threat Research team has identified a new campaign from the “MuddyWater” groupThe campaign has been observed attacking two Israeli targetsThe campaign exhibits updated TTPs to previously reported MuddyWater activityFigure 1: Campaign overviewIntroductionPrevious research showed that MuddyWater has sent...
Simon KeninThreat Intelligence ResearcherDeep Instinct Threat LabThe contents of this blog post were originally scheduled to be presented during an upcoming cybersecurity conference. However, interest in this topic has heightened due to the war in Israel and a suspected ongoing attack against Israeli targets. As such, we have decided to publish the relevant findings from the presentation now.Executive Summary:Deep Instinct’s Threat Research team has identified a previously unreported C2 framewor...
DomainTools
Doug Metz at Magnet Forensics
By Doug Metz, Senior Security Forensics Specialist Enterprise customers running Microsoft Defender for Endpoint have a lot of capabilities at their fingertips. This includes the Live Response console, a limited command shell to interact with managed Defender assets online. From across the network an analyst can connect to an endpoint and pull back specific evidence to support incident response investigations. Besides its native commands, you can also use the console to push scripts and executabl...
Dragos
Products Dragos Platform Threat Intelligence Neighborhood Keeper Resources Blog Whitepapers Case Studies Datasheets Webinars Events Year in Review Videos Company About Dragos Careers Partners News DISC Contact Us Report an Incident Privacy Policy Terms of Service Cookie Settings Contact Us COPYRIGHT © 2023 DRAGOS, INC. ALL RIGHTS RESERVED. For information about how we collect, use, share or otherwise process information about you, please see our privacy policy.
Robert M. Lee Community Share This LinkedIn Twitter Facebook Email RSS Today we announced the expansion of the Dragos Community Defense Program for water, gas, and electric utilities. Launched as a pilot program in 2022 to help small utilities protect themselves in the face of increasing global threats to infrastructure, the program provides free Dragos Platform software, as well as enrollment in Neighborhood Keeper, our collective defense capability, for qualifying utilities for as long as they...
Dragos, Inc. Threats Share This LinkedIn Twitter Facebook Email RSS The overlaps between cyber threats and regional kinetic events have never been more evident than throughout 2023. Cyber adversaries have used the conflicts between Ukraine-Russia and Israel-Hamas to conduct targeted and opportunistic operations against critical infrastructure. Less sophisticated hacktivists, motivated by notoriety and drawing global attention to social and geopolitical events, have used both conflicts to spread ...
Esentire
Get Started What We Do How We Do It Resources Company Partners Get Started What we do How we do it Resources Company Partners Request a Quote Back What We Do ESENTIRE SERVICES Exposure Management Services → Cyber risk and advisory programs that identify security gaps and build strategies to address them. Managed Detection and Response → MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response. Digital Forensics and Incident Response → Our ...
→ VIEW BLOG → Resources Case Studies → Videos → Reports → Webinars → Data Sheets → Cybersecurity Tools → Glossary → EXPLORE LIBRARY → SECURITY ADVISORIES Dec 07, 2023 Qlik Sense Exploitation THE THREAT eSentire has observed multiple instances of threat actors exploiting vulnerabilities in Qlik Sense to gain initial access into victim organizations. Qlik Sense is a popular data analytics… READ NOW View Advisories → TRU Intelligence Center Our Threat Response Unit (TRU) publishes security advisori...
Tafara Muwandi at F5 Labs
The fourth and final part of a series investigating how automation is used to create fake accounts for fraud, disinformation, scams, and account takeover. By Tafara Muwandi December 08, 2023 14 min. read Previous article in this series Table of Contents Introduction Evaluation of Controls Email Domain Filtering Multi-Step Account Creation Process Reporting by Legitimate Users Email Verification Requirement for Unique and Limited Availability Information CAPTCHA Honeypot Fields Web Application Fi...
Flare
Flashpoint
Indictment alleges the so-called “Callisto Group” hacked computers in the United States and allied countries, and stole information used in foreign malign influence operations designed to influence the U.K.’s 2019 elections. SHARE THIS: Flashpoint December 7, 2023 “A federal grand jury in San Francisco returned an indictment on Tuesday charging two individuals with a campaign to hack into computer networks in the United States, the United Kingdom, other North Atlantic Treaty Organization member ...
G0njxa
Approaching stealers devs : a brief interview with Amadeyg0njxa·Follow5 min read·6 days ago--ListenShareTo completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are dominating it. Always remember that behind every user of the Internet there is another human like you, so if you can be kind enough to reach them and they agree, you can have a little talk. Asking things is not a crime.Please note everything that stated on th...
Approaching stealers devs : a brief interview with StealCg0njxa·Follow6 min read·4 days ago--ShareTo completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are dominating it. Always remember that behind every user of the Internet there is another human like you, so if you can be kind enough to reach them and they agree, you can have a little talk. Asking things is not a crime.Please note everything that stated on this blo...
Approaching stealers devs : a brief interview with Metag0njxa·Follow6 min read·1 day ago--ShareTo completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are dominating it. Always remember that behind every user of the Internet there is another human like you, so if you can be kind enough to reach them and they agree, you can have a little talk. Asking things is not a crime.Please note everything that stated on this blog h...
GreyNoise Labs
Another deep-dive - this time, weâll look at CVE-2023-49105, a critical vulnerability in ownCloudâs signature-validation code permits an attacker to impersonate any user. owncloud vulnerabilities disclosure Author Ron Bowes Published December 5, 2023 On November 29 and 30, 2023, we published high-level and deep-dive blogs into a seemingly-simple (but actually-complex) vulnerability in ownCloud that permitted users to enumerate environmental variables. Since it was listed as CVSS 10.0, everyb...
Grimoire Blueprints Resources GreyNoise Labs About GreyNoise Home Explore our data Donât Leave Me on Read: The Efficacy of Dynamic Honeypots for Novel Exploitation Discovery This article recounts GreyNoiseâs usage of dynamic and responsive honeypot personas to catch recently developed exploits. Author h0wdy Published December 5, 2023 Introduction In this post, Iâm going to go over my usage of GreyNoiseâs dynamic honeypots to catch a newer proof of concept (PoC) for CVE-2023-47246, and ta...
Joe Slowik at Huntress
Previous Post Share on Twitter Share on LinkedIn Share on Facebook Share on Reddit In the realm of cyber threat intelligence (CTI), technical indicators, commonly known as "indicators of compromise" (IOCs), play a pivotal role. Indicators feature prominently in CTI reporting, are the primary object shared in CTI feeds, and are often used to drive outcomes in security tools such as blocking “bad” IP addresses in a firewall. Despite their central role within the CTI space, indicators have faced cr...
Darren Spruell, Nick Chalard, and William MacArthur at InQuest
Intel471
Dec 05, 2023 December heralds the beginning of the holiday period for many across the world. But when out-of-office notifications go up along with the tinsel, organizations can be left vulnerable. Many cybercriminals don’t take a holiday; instead, they take advantage of skeleton staff and the traditions of the festive period to target organizations. As we wind down to the end of the year, Intel 471 details four critical cyber threats organizations need to be aware of to ensure they remain vigila...
Kevin Beaumont at DoublePulsar
Kevin Beaumont·FollowPublished inDoublePulsar·2 min read·2 days ago--ListenShareToday I noticed NoName057[16] — basically a poor man’s “Ukraine IT army” — attempting to DDoS various UK councils and transport services:They post about their exploits on Telegram, similar to those crazy Ukrainians. It’s basically Russia styled as hacktavists, with some great bear drawings.I decided to have a look at monitoring them, and was able to break in pretty easily.They attacked these 14 targets:pa.eastcambs.g...
Konrad Kaluzny
Report this article Konrad Kaluzny Konrad Kaluzny Helping companies with cybersecurity: Threat Hunting, Detection Engineering, Threat Intelligence and more Published Dec 4, 2023 + Follow In the era of massive data breaches, increased activity by infostealers, and other methods of acquiring user account credentials, the T1078 Valid Accounts technique shouldn't be unfamiliar to anyone. The case is trivial: 'Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Ini...
Report this article Konrad Kaluzny Konrad Kaluzny Helping companies with cybersecurity: Threat Hunting, Detection Engineering, Threat Intelligence and more Published Dec 5, 2023 + Follow Jumping from basic anomaly detection in Sign-in events we can have a look at the RDP protocol and potential account compromise in that area. Endpoint logs will serve us well this time. To track RDP login attempts you can use one of the most well-known events from Windows Event Log - 4624(S) [An account was succe...
Report this article Konrad Kaluzny Konrad Kaluzny Helping companies with cybersecurity: Threat Hunting, Detection Engineering, Threat Intelligence and more Published Dec 6, 2023 + Follow Yesterday, we filtered out all public IP addresses from the logs by using the split() function to split one field into substrings. We also used the strcat() function for string concatenation when necessary. However, there is always room for improvement. Azure Sentinel has a wide library of scalar functions that ...
Report this article Konrad Kaluzny Konrad Kaluzny Helping companies with cybersecurity: Threat Hunting, Detection Engineering, Threat Intelligence and more Published Dec 8, 2023 + Follow Windows Scheduled Tasks is a built-in system feature that allows automatic or manual execution of programs or scripts at scheduled times or upon the occurrence of specific events. As you can imagine, the ability to automate such actions can lead to various security challenges. There are several methods to create...
Anish Bogati at Logpoint
By Anish Bogati|2023-12-04T13:38:39+01:00December 4th, 2023| - 7 min read Modern web applications perform most of their processing and rendering on the client side, enhancing dynamic and interactive web experiences. However, this architecture introduces a security concern known as HTML smuggling. Many threat actors such as Nobelium, and Nokoyawa have been using this technique to distribute their malware families as other forms of delivery are well known, and are monitored for as a result have hi...
Mehmet Ergene
Mehmet Ergene·Follow4 min read·5 days ago--ListenShareThe union operator in KQL is used to merge the results of two or more tables (or tabular expressions) into a single result set. A familiar instance of this operation is the search operator, which implicitly performs a union when querying across multiple tables.Syntax:>Table1<| union (>OptionalParameters<) >Table2<, >Table3<, >TabularExpression1<, ...// We can also use the below syntaxunion (>OptionalParameters<) >Table1<, >Table2<, >TabularEx...
Merill
JavaScript is not available. We’ve detected that JavaScript is disabled in this browser. Please enable JavaScript or switch to a supported browser to continue using twitter.com. You can see a list of supported browsers in our Help Center. Help Center Terms of Service Privacy Policy Cookie Policy Imprint Ads info © 2023 X Corp. Something went wrong, but don’t fret — let’s give it another shot.Try again
Michael Koczwara
Hunting Malicious Infrastructure-Headers and Hardcoded/Static StringsMichael Koczwara·Follow3 min read·4 days ago--ListenShareIn my last blog Hunting Malicious Infrastructure using JARM and HTTP ResponseI explained my methodology/process of hunting malicious infrastructure using JARM and HTTP Response.In this blog, I will go through a code review of one OST and one C2 from GitHub.Responder OST(old version from SpiderLabs)Havoc C2Hunting Responder OSTGitHub - SpiderLabs/Responder: Responder is a ...
Microsoft Security
Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:United States English Microsoft Homepage
Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:United States English Microsoft Homepage
Monty Security
Hunting Volt Typhoon TTPsmontysecurity·Follow4 min read·Just now--ListenShareAt the time of writing (December 2023), Volt Typhoon only has 3 references in MITRE but they are rich with details on procedures. It is also worth calling out that Microsoft released hunting queries with their publication on this group. I will not showcase them in this blog, but they can be found here.That being said, lets go through what we have and start making hunts. You will see certain filters commented out in the ...
Nasreddine Bencherchali
SigmaHQ Rules Release Highlights — r2023–12–04Nasreddine Bencherchali·FollowPublished inSigma_HQ·5 min read·5 days ago--ListenShare//github.com/SigmaHQ/sigma/releases/tag/r2023-12-04Sigma Rule Packages for 04–12–2023 are released and available for download. This release saw the addition of 21 new rules, 29 rule updates and 5 rule fixes by 15+ contributors.New RulesSome highlights for the newer rules include, a new detection for potential abuse of the “RstrtMgr” DLL by uncommon or suspicious proc...
Obsidian Security
Palo Alto Networks
3,536 people reacted 15 6 min. read Share By Unit 42 December 7, 2023 at 6:00 AM Category: Vulnerability Tags: Advanced Threat Prevention, Advanced URL Filtering, APT, APT28, Cortex XDR, CVE-2023-23397, DNS security, Fancy Bear, Fighting Ursa, Microsoft Outlook, Microsoft Vulnerability, next-generation firewall, privilege escalation, Russia, UAC-0001, Ukraine This post is also available in: 日本語 (Japanese)Executive Summary Early this year, Ukrainian cybersecurity researchers found Fighting Ursa l...
Proofpoint
TA422’s Dedicated Exploitation Loop—the Same Week After Week Share with your network! December 05, 2023 Greg Lesnewich, Crista Giering and the Proofpoint Threat Research Team Key takeaways Since March 2023, Proofpoint researchers have observed regular TA422 (APT28) phishing activity, in which the threat actor leveraged patched vulnerabilities to send, at times, high-volume campaigns to targets in Europe and North America. TA422 used the vulnerabilities as initial access against government, aeros...
PwC
Blog 5 Minute Read December 05, 2023 Share Copy Link Link Copied Close The Author component that should be used here will be made available later By PwC Threat Intelligence Revisiting an elusive espionage threat actor known as Teal Kurma (a.k.a. Sea Turtle) that faded after public disclosure over three years ago, by analyzing its malware dubbed 'SnappyTCP', a simple reverse shell for Linux/Unix systems Executive summary PwC has continued to track a highly capable Türkiye-nexus threat actor threa...
Red Alert
Monthly Threat Actor Group Intelligence Report, September 2023 (ENG) This report is a summary of Threat Actor group activities analyzed by the NSHC ThreatRecon team based on data and information collected from 21 August 2023 to 20 September 2023. In September, activities by a total of 26 Threat Actor Groups were identified, in which activities by SectorA groups were the most prominent by 49%, followed by SectorJ and SectorE groups. Threat Actors identified in April carried out the highest number...
Thomas Gardner and Cody Betsworth at Red Canary
ReliaQuest
Megan Roddie-Fonseca at SANS
homepage Open menu Contact Sales Go one level top Train and Certify Free Course Demos Free course demos allow you to see course content, watch world-class instructors in action, and evaluate course difficulty. Train and Certify Immediately apply the skills and techniques learned in SANS courses, ranges, and summits Learn More Overview Courses Overview Full Course List By Focus Areas Cloud Security Cyber Defense Cybersecurity and IT Essentials DFIR Industrial Control Systems Offensive Operations ...
SANS Internet Storm Center
Internet Storm Center Sign In Sign Up Handler on Duty: Guy Bruneau Threat Level: green previousnext Cobalt Strike's "Runtime Configuration" Published: 2023-12-05 Last Updated: 2023-12-05 08:00:19 UTC by Didier Stevens (Version: 1) 0 comment(s) I published an update for my 1768.py tool, a tool to extract the configuration from Cobalt Strike beacons. 1768.py tries to extract the beacon configuration from payloads and process memory dumps. It looks for the embedded configuration, the TLV table that...
Zarya Hacktivists: More than just Sharepoint. Published: 2023-12-04 Last Updated: 2023-12-04 16:38:58 UTC by Johannes Ullrich (Version: 1) 0 comment(s) Last week, I wrote about a system associated with pro-Russian hacktivist scanning for vulnerable Sharepoint servers [1]. Thanks to @DonPasci on X for pointing me to an article by Radware about the same group using Mirai [2][3]. This group has been active for a while, using various low-hanging fruit exploits to hunt for defacement targets. The gro...
Whose packet is it anyway: a new RFC for attribution of internet probes, (Wed, Dec 6th)
Revealing the Hidden Risks of QR Codes [Guest Diary], (Wed, Dec 6th)
Revealing the Hidden Risks of QR Codes [Guest Diary] Published: 2023-12-06 Last Updated: 2023-12-07 00:59:10 UTC by Guy Bruneau (Version: 1) 0 comment(s) [This is a Guest Diary by Jeremy Wensuc, an ISC intern as part of the SANS.edu BACS program] Introduction QR codes, those square-shaped digital puzzles found on everything from advertisements, packaging, and even restaurant menus, have made our lives more convenient. However, this blog post aims to shed light on the often-overlooked dangers of ...
Dheeraj Kumar and Ella Dragun at Securonix
SIEM Share By Dheeraj Kumar, Ella Dragun, Securonix Threat Labs The Monthly Intelligence Insights provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Labs in November. The report additionally provides a synopsis of the threats; indicators of compromise (IoCs); tactics, techniques, and procedures (TTPs); and related tags. Each threat has a comprehensive threat summary from Threat Labs and search queries from the Threat Research team. For additional information o...
Sekoia
Shyava Tripathi, Raghav Kapoor and Rohan Shah at Trellix
By Shyava Tripathi, Raghav Kapoor and Rohan Shah · December 07, 2023 Phishing, a prevalent cybercrime worldwide, is responsible for as much as 90 percent of data breaches, making it a significant avenue for the theft of sensitive credentials and information. While phishing itself is not a new threat, the landscape has evolved in recent months. Interpol made a significant breakthrough in the fight against phishing by successfully shutting down '16shop', a notorious and widely used phishing-as-a-s...
Splunk
Share: By Splunk Threat Research Team December 06, 2023 In the ever-evolving landscape of cybersecurity threats, one name that consistently surfaces as a force to be reckoned with is "PlugX." This covert and insidious malware has left a trail of digital intrigue, combining advanced features with a knack for eluding detection. Its history is interwoven with cyber espionage, targeted attacks, and a continuous cat-and-mouse game with security experts (1)(2). The Splunk Threat Research Team (STRT) u...
Share: By Senthil Nithiyananthan December 08, 2023 Last week, we released Splunk SOAR 6.2 (Security Orchestration Automation and Response) and in the accompanying announcement blog, we highlighted some of the new key features found in this release. Today, we want to take a more in-depth look at one of those features, logic loops, and show how they make it easier than ever for security engineers and analysts to save time and cut down on repetitive manual tasks. This new iterative function allows ...
Sucuri
Jean-Francois Gobin at Truesec
Shatak Jain, Shivam Sharma,and Pradeep Mahato at ZScaler
SHATAK JAIN, SHIVAM SHARMA, PRADEEP MAHATODecember 04, 2023 - 5 min read Threatlabz ResearchContentsIntroductionKey TakeawaysTrend 1: DarkGate activity surges in late September, early OctoberTrend 2: Technology sector most impacted by DarkGateTrend 3: Most DarkGate domains are 50 to 60 days oldConclusionZscaler Coverage & Indicators of Compromise (IOCs)More blogsCopy URLCopy URLIntroduction DarkGate is a malware family, dating back to 2018, that gained prominence after the demise of Qakbot with ...
