Paul Hutchinson

APT & Threat Intel Hunter.
Cyber Kill Chain practitioner.
Find Evil! Solve Crime!

[Paul Hutchinson @AllAboutAPT]

The team @Crowdstrike Intelligence are attributing #whispergate wiper activityto Ember Bear (aka UAC-0056, Lorec53, Lorec Bear, Bleeding Bear, Saint Bear). The group does not present known links with previously tracked adversaries #APT

Blog
https://t.co/bFrRW6XZbA

[Paul Hutchinson @AllAboutAPT]

In light of recent events between the US & Iran the concern for #cyberwarfare retaliation is high.

@RecordedFuture posted a great overview of the current state, players in this space, their tools and suggested mitigations for your vigilance. #APT

https://t.co/vgHojxvPBN

[Paul Hutchinson @AllAboutAPT]

#OperationWocao @foxit report and #APT20 (aka #Twivy #ViolinPanda) assessment align with @FireEye 2018 #MTrends which cited a return of the group and their signature malware #CETTRA (tunneler) & #COOKIECLOG

Report:
https://t.co/D270tGcPjL

M-Trends 2018:
https://t.co/KIoBMMzbKL

[Paul Hutchinson @AllAboutAPT]

The @ESET team uncover previously unknown #backdoor #Okrum (which attempts to evade detection using #steganography) used by suspected #Ke3chang #APT to target diplomatic missions in Slovakia, Belgium, Chile, Guatemala, and Brazil

https://t.co/r9bZZBfALp

[Paul Hutchinson @AllAboutAPT]

Recent research from @RecordedFuture shows #APT group #APT33 (#Elfin) continues to conduct and prepare for widespread #cyberespionage activity, with over 1,200 domains used since March 2019

Blog: https://t.co/Jdu6o3uWVW

I suspect more Elfin is coming ... and right on time!

[Paul Hutchinson @AllAboutAPT]

With #FIN7 news last month and #FIN8 news this month, there's a bit of discussion around who's really responsible

https://t.co/bw6T4QkmqQ

The groups have some similar TTPs, even IOC overlap, however, there are still some differences in their tradecraft #APT

[Paul Hutchinson @AllAboutAPT]

With #MuddyWater (aka #Seedworm) #APT group activity popping up over the last week, @TrendMicroRSRCH release blog and whitepaper highlighting several campaigns from first half of 2019

Blog: https://t.co/kkRT1HKK5g

WP: https://t.co/kURxLtZ29n

[Paul Hutchinson @AllAboutAPT]

Attribution lesson regarding #Ryuk #ransomware from 'North Korea' to 'Eastern Europe' shows that basing it on code similarities alone isn't high fidelity.

A caution when it comes to #attribution - whatever you decide, you will always be right ... until you find out you're not.

[Paul Hutchinson @AllAboutAPT]

The #Sofacy (#FancyBear #APT28 #Sednit) #APT group continue to evolve their custom malware to evade detection by employing multiple languages. Updated #Zebrocy code written in Go programming included in recent "Dear Joohn" campaign.

https://t.co/ad66k4x986

[Paul Hutchinson @AllAboutAPT]

The financially motivated #APT group within the North Korean regime has finally been given it's own official identity after being active for around 4 years: #APT38

@FireEye Blog:
https://t.co/pQB5keRdd5

[Paul Hutchinson @AllAboutAPT]

@cyb3rops @jantdm @pstirparo @davidbizeul @BieberMalware @Gasgas4Ggyy @JoelEsler @kc0iqx_bleich @mmorenog @monnappa22 @theweeZ @BlackCaesar1973 @AndreGironda @aboutdfir @cfragoso @eyalsela @egflo I like it at a first glance. The immediate pro for me is ability to filter from a single form.

[Paul Hutchinson @AllAboutAPT]

금융보안원은 2015년부터 2018년 상반기까지 알려진 악성 한글문서들에 대한 분석을 진행하여 특징점을 분류하고, 이에 따른 연관성 분석 결과와 변화 추이를 살펴보��다.

#도깨비 #Dokkaebi #블루노로프 #Bluenoroff #김수키 #Kimsuky #스카크러프트 #Scarcruft #APT

https://t.co/z6CsfNoVap

[Paul Hutchinson @AllAboutAPT]

Artificial Intelligence-based Targeted Attack Analytics uncovers #Thrip #APT espionage group hitting Satellite, Telecoms, and Defence Companies.

@Symantec blog: https://t.co/URFsdDOsl5

[Paul Hutchinson @AllAboutAPT]

#LuckyMouse #APT group (#EmissaryPanda #BronzeUnion #APT27) go after cheese in a Central Asian National Data Center in ongoing campaign of waterholing government websites.

@Securelist https://t.co/rY8dbWCMmY

[Paul Hutchinson @AllAboutAPT]

Recent #APT10 (#HogFish #StonePanda #MenuPass) (of #RedLeaves fame) group's latest campaign dubbed "New Battle" reviewed by the @iDefense team includes taunting messages for analysts #APT

https://t.co/5GMXdFx4tL

[Paul Hutchinson @AllAboutAPT]

Suspected Chinese espionage #APT group #TEMP.Periscope (aka #Leviathan) targeting engineering and maritime entities with a focus on South China Sea issues.

@FireEye Blog: https://t.co/JpYfCdGVSu

[Paul Hutchinson @AllAboutAPT]

#APT15 (#SocialNetworkTeam) deploys an updated arsenal to target UK government departments and military technology #APT

@NCCGroupInfosec report
https://t.co/LYRxEsuRg3

[Paul Hutchinson @AllAboutAPT]

The #Sofacy #APT group (aka #APT28 #FancyBear #Strontium) was #Kaspersky GReAT's most reported APT activity for 2017

@Securelist https://t.co/5gmrfDGWcR

[Paul Hutchinson @AllAboutAPT]

Newest report from @FireEye uncovers their latest #APT group #APT37 (formerly TEMP.Reaper) (aka #LabyrinthChollima)

Blog https://t.co/3jKdDHJsUw
Report https://t.co/r2bPEjJnj3

[Paul Hutchinson @AllAboutAPT]

#Lazarus #APT (#SilentChollima #Unit121) resurfaces (not that they ever disappear) targeting Global Banks and Bitcoin users with "HaoBao" campaign

@McAfee Labs https://t.co/Fx1bVYI8mS