ProtectWise 401TRG

Threat Research Group at @ProtectWise. Analyst to analyst content on malware, DFIR, threat intelligence and much more.

[ProtectWise 401TRG @401TRG]

New Post! An Introduction to Exploratory Data Analysis with Network Forensics by Jeff van Geete (@d8aninja) https://t.co/7hVmzbYN6s

[ET Labs @ET_Labs]

The same goes for anyone releasing a blog or paper with network traffic who would like to include a coordinated ET open ids rule release

[hadojae @switchingtoguns]

Posting malware wireshark screencaps is pretty cool, but sharing #pcap with @ET_Labs to help protect the community is even cooler.

[Kafeine @kafeine]

Note:TA505 != Dridex. They were massively spreading it, with, as customer, Necurs. Dridex 125 then 220 and 7200, but also Locky 3, Trickbot mac1 before moving to ServerHelper and FlawedAmmyy. Other actor are spreading Dridex. Smilex was part of the team spreading Dridex 120.

[ProtectWise 401TRG @401TRG]

Check it!
https://t.co/DPr8EvDdXF
Thanks @MalwareKiwi!

[Tom Hegel @TomHegel]

Great post @jms_dot_py! Related: Do a Google search (in Chrome) and your machine does a DNS and HTTP request to the top result without clicking on it. Decent way to let someone know your looking into a domain or unique string. Disable “prediction service” setting! #OPSEC

[Tom Hegel @TomHegel]

The amount of victims identified by the @newegg #magecart incident is quite staggering. Large percent of our @protectwise customers had victim users. Great work @ydklijnsma @RiskIQ @Volexity !

[Intezer @IntezerLabs]

NEW joint BLOG post by @jaytezer & @ChristiaanBeek reflecting months of research highlighting code similarities shared between samples believed to be DPRK. Read more on the connections between different attacks over the course of 11 years in this blog: https://t.co/0mKbBvEPYm

[Tom Hegel @TomHegel]

Great work here from @amnesty & @citizenlab - NSO Group Infrastructure Linked to Targeting of Amnesty International and Saudi Dissident:

1. https://t.co/0fVpbpNo97

2. https://t.co/N12q42FfK0

[ProtectWise 401TRG @401TRG]

Thanks to all who were able to attend!

[James Condon @jameswcondon]

Had a great time presenting at @RiskIQ’s #ThreatHunting workshop today for @ProtectWise. Heard a great talk from @ydklijnsma on #Magecart. Awesome venue!

[Tom Hegel @TomHegel]

Use of googl URL shortening from the CN actors behind the @401TRG #Winnti Umbrella report continue to occur against US & East Asia orgs. Use is primarily on a per-target basis instead of the original per-campaign basis. Love to see how they continue improving. #CTI #ThreatIntel

[ProtectWise 401TRG @401TRG]

Great event with some great trainers coming to Denver - come learn some traffic and infrastructure analysis techniques https://t.co/rVfJ2xoZQP

[James Condon @jameswcondon]

I will be presenting at a Threat Hunting Workshop with @RiskIQ, @FlashpointIntel, and @TryPhantom on July 31st in Denver, CO. If you are interested in doing some network forensics and infrastructure analysis check out the sign up page. https://t.co/Dv8NHD3sI7

[Jack @malwareforme]

Proticc Ransomware (found by @malwrhunterteam) showing it is still in development and changing

[ProtectWise 401TRG @401TRG]

@Viking_Sec @jckichen 10/10 good pun!

[Richard Bejtlich 💾 🇺🇦 @taosecurity]

“Our primary telemetry consists of months to years of full fidelity network traffic captures.” New report by @401TRG on Chinese cyber ops shows the value of instrumenting your network HT ⁦@schneierblog⁩ #networksecuritymonitoring https://t.co/VaKzskCyvJ

[Robert M. Lee @RobertMLee]

Really nicely done report by @401TRG - use of estimative language, calling to others’ work, technical analysis easy to follow, good summary up front, exposing what went into their analysis to make the conclusions they did, etc. kudos y’all! #CTI

[Steve YARA Synapse Miller @stvemillertime]

A quick fun #APT28 blast from the past, here's some sample sourcecode of the "CHOPSTICK" aka "Xagent" proxy piece, which used Python and the Gmail API to for implant C2. Unfortunately I've got no #dailypcap for this one :( See also: https://t.co/2GaMo0k1Wz

[Tom Hegel @TomHegel]

Going to be a fun time, looking forward to it! https://t.co/7v5wVobLGD

[Snyk @snyksec]

** URGENT SECURITY WARNING ** Please share.

Today, version 3.7.2 of eslint-scope (https://t.co/Gkc9XhDRN6) was found to contain malicious code that steals your NPM credentials. Take action now if you are using version 3.7.2.

Snyk DB entry: https://t.co/dAhhA3cZQP

[Steve YARA Synapse Miller @stvemillertime]

Legit Services C2: The Saga Continues. We run some snort rules on sandboxed pcap to ID files that attempt DNS+SSL to legit svcs. Heres one to https://t.co/dxGhJ7UoiE: Launch.docx does ole/vbs/ps to download an Empire stager from a Dropbox acct #dfir #dailypcap #threatintel