MaorH

[Max_Malyutin @Max_Mal_]

#Qakbot infection leads to Ransomware(#BlackBasta) attack🚨

#DFIR and #ThreatIntel report covers full execution flow TTPs (Adversary Tactics, Techniques, and Procedures)

#MalSapm > Qakbot > #CobaltStrike > BlackBasta

https://t.co/SoSyonrwjz

[MaorH @4d616f722048751]

@Max_Mal_ Wonderful work!

[MaorH @4d616f722048751]

@T045T3 @PaloAltoNtwks @0xs0ns3

[Max_Malyutin @Max_Mal_]

#DFIR and #ThreatIntel report ❗️

#Bumblebee new loader campaign Initial Access, TTPs & IOCs, and binary analysis

ZIP > ISO > LNK > Rundll32 > #CobaltStrike

https://t.co/z8TeC6xOwz

[Max_Malyutin @Max_Mal_]

#Emotet strikes with new TTPs 🚨

Project X elevated to Project Y

#DFIR analysis report covers the new infection flow:

Initial Access
Execution
Privilege Escalation
Persistence
Defense Evasion

https://t.co/6EFsJB8zIH

[Cynet @Cynet_Security]

The notorious Emotet strikes again. In this new write-up, Cynet Orion Threat Research and Intelligence Team Leader, @Max_Mal_ walks through what this means for you, check it out here 👇

https://t.co/RwbmbAh4W7

[Max_Malyutin @Max_Mal_]

#Emotet 🧟‍♀️

C2 next stage distributer (PowerShell):

forwardmart[.]club - @Namecheap

everisyouglobal[.]everis[.]com

teachingcenter[.]xyz - @Namecheap

...

C2 Server (Rundll32):
45.63.5[.]129 🔥

Thanks @abuse_ch 🖤
https://t.co/IKu0maKjRJ

[MaorH @4d616f722048751]

@Max_Mal_ Great report, proud to work with you

[Max_Malyutin @Max_Mal_]

#Quakbot (A.K.A #Qakbot 🦆🤖) #QuakNightmare
Threat actors strike with #PrintNightmare for the first time (#CVE-2021-34527) vulnerability ❗️

A #DFIR report include TTPs, Artifacts, IOCs, and full analysis of the kill chain infection 🔥
#ThreatIntell

https://t.co/zinzmabTN8

[MaorH @4d616f722048751]

@Amigo_A_ @demonslay335 @fbgwls245 Please share a sample if you get any, thanks :)

[MaorH @4d616f722048751]

@PolarToffee Any luck finding a sample?