Faraday

Security Analyst @Huntresslabs |
SGF2ZSBhIG5pY2UgZGF5IQ== |
Personal opinions and research are my own and don’t represent my employer

[Tib3rius @0xTib3rius]

For those of you who saw the amazing floppy disk bags as prizes at my contests and were wondering where to get them, @Kiwi_FruitBird is the creator and her store is here: https://t.co/QVXiMKaFlV

[kiwi @Kiwi_FruitBird]

This part of Defcon sucks, I miss my friends already 😭

[Faraday @0xffaraday]

@Cthulhu_Answers

[Faraday @0xffaraday]

@IzzyBoopFPV Just drop this on disk: https://t.co/3dQRUPSoIS 🥰

[Malware Village @MalwareVillage]

That wraps up #MalwareVillage
@DEFCON 33! 🥳

Special thanks to all the organizers, sponsors, volunteers, speakers, workshoppers, collaborators, attendees, and everyone involved, for making this event absolutely legendary! 🤩

Thank you all! 🙏

[Anton @Antonlovesdnb]

Got a new @HuntressLabs blog out today taking a look at some intrusion analysis methodology with practical examples - check it out!

https://t.co/cb61n4nFCB

[Wietze @Wietze]

ATT&CK v17 is out! It contains an update I have campaigned for since 2022: DLL Hijacking is now a single sub-technique, merging Search Order Hijacking & Sideloading, plus supporting related techniques.

Huge thanks & congrats to the @MitreATTACK team on this release 🎉

[Faraday @0xffaraday]

IOCs:
SC domain:
https://t.co/EdIyHQLZ42
Domain involved with scheduled task:
http[:]//shopeasy.giize[.]com/dashboard/bor3y/update[.]php
SC installer:
Recently_S_S_A_Statement9030773.exe
VBS file from SC:
C:\Users\Public\Music\//n5R79uzirhL2.vbs

[Faraday @0xffaraday]

@HuntressLabs SOC is seeing a newly suspected KoiLoader/KoiStealer attack chain. Details below:

[Faraday @0xffaraday]

Screenconnect installer downloaded from a newly registered domain. After installation, SC is used to drop a malicious .VBS in the directory "C:\Users\Public\Music\" and creates a scheduled task named:
"MicrosoftEdgeUpdateTaskMachineCore"

[ACE Responder @ACEResponder]

Windows audit policies, some common events they enable, and the volume of events they produce.

#ThreatHunting #DFIR #Cybersecurity

[TrustedSec @TrustedSec]

Who says #Python Malware is out of style? In our new #blog,@GuhnooPlusLinux revisits an old technique he believes is a prime candidate to host #malware payloads—Python for Windows. Read it now! https://t.co/YhiypqvWpS

[PandaRE 🐼 🇺🇦 @PandaRE__]

Happy Friday, everyone! With recent changes in #LummaStealer - using ChaCha20 for C2 encryption, here is the new config extractor in C/C++. We will try a different approach this time 🐦
Enjoy!
https://t.co/8hXyToCPGt

[Aura @SecurityAura]

"svchost.exe should always have services.exe as a parent process and should never be launched without any arguments/parameters"

Welcome to the real world.

[Faraday @0xffaraday]

Ensure the client config "c:\programdata\jwrapper-remote access\jwappssharedconfig\serviceconfig.xml" does not have malicious entries within the <ConnectTo> tag. This allows the agent to be used remotely from multiple domains/IPs.

https://t.co/fcPxug3mTd

[Faraday @0xffaraday]

@HuntressLabs SOC is seeing further malicious activity from SimpleHelp RMM. Please update your SimpleHelp instance to its latest version!
IOCs in replies: