We've just published a new report on a Widespread Credential Harvesting Campaign.
Moving forward, all our CTI updates will come from our main account @bridewellsec, so give us a follow to keep up with our latest updates.
#ransomware#threatintelligence
Joshua Penny, our Senior Threat Intelligence Analyst has analysed a widespread credential harvesting campaign. The threat actors are utilising the Dadsec platform to conduct widespread phishing of global organisations to steal Microsoft 365 credentials.
The threat actors are using Cyber Panel, an open-source web development panel, hundreds of Domain Generated Algorithm (DGA) domains that are created daily to host credential harvesting pages.
For more information, including Indicators of Compromise (IoCs) and associated infrastructure, see our full report 👉 https://t.co/LGzJJUmGDg
@AnyRun_App
#BridewellCTI #ThreatIntelligence
We've just published a new report on an information stealer known as "Easy Stealer".
For more info, head over to our main account @bridewellsec. (All future CTI updates will be shared from there so give us a follow!)
#infostealer#threatintelligence
Bridewell CTI has identified infrastructure associated with a new information stealer called “Easy Stealer”.
Easy Stealer is currently up for sale and under active development. Found out more in our full report: https://t.co/EbYU7JFo52
#infostealer#ThreatIntelligence
We've just published a new report on a major Ransomware-as-a-Service player, ShadowSyndicate.
Moving forward, all our CTI updates will come from our main account @bridewellsec, so give us a follow to keep up with our latest updates.
#ransomware#threatintelligence
ShadowSyndicate is a new Ransomware-as-a-Service player who's having a major impact on the global stage.
We've teamed up with Group-IB and Michael Koczwara to publish a full report on the group: https://t.co/QWnAJFldRk
#ransomware#threatintelligence
📧 Stay up to date with Bridewell's CTI reports by receiving them directly in your inbox. Sign up here: https://t.co/BNrpZjVkpw
In case you missed it 👇 💭
➡ Bridewell and Group-IB expose the APT’s unknown infrastructure - https://t.co/WaDFQo7QZD
➡ Hunting for Ursnif - https://t.co/ZcyxBKXCWF
#CTI #Updates
When cybersecurity researchers work together, they make the world safer🤝 Group-IB and @bridewellsec are proud to share the joint blog post about previously unknown infrastructure belonging to #APT#SideWinder:
https://t.co/iF0wF8T9Te
👉SideWinder’s servers can be detected using several hunting rules
👉Group-IB and Bridewell detected 55 previously unknown IP addresses that SideWinder could use in future attacks.
Bridewell and Group-IB expose the APT’s unknown infrastructure.
In our latest report our Bridewell CTI team and the @GroupIB Research Team detail key findings into the APT group ‘SideWinder’.
Read the full report here: https://t.co/sIB84hOsI1
Bridewell CTI track down Ursnif, aka Gozi malware, the ex-banking trojan facilitating ransomware operations such as Royal. The Bridewell team describes recent campaigns involving the malware and how they underwent the hunt for its C2 infrastructure, including an analysis of their findings.
The report can be found here👉https://t.co/iWVQ9dMqdR
#Ursnif #Gozi #Royal #Ransomware
LIDSHOT has two primary functions: system enumeration and downloading and executing shellcode from the C2.
LIDSHOT sends the following information to its C2:
Computer Name
Product name
IP address
Process List
🚨⚠️Potential #Nukesped/#LIDSHOT#malware🔍 uploaded from South Korea. Only 2 detections on VT:
🔗ddb240cf6125f320330fcba78c3ac219c934ca6c8878bb659a84b7d78ae39ba3 📁FWDataViz.dll
LIDSHOT's dual threat:
1️⃣ System enumeration🕵️♂️
2️⃣ Downloading & executing shellcode from C2 🌐
Mandiant’s UNC2970 conduct recruitment themed spear-phishing campaigns, recently delivering a trojanised version of TightVNC (LIDSHIFT) to victims.
LIDSHIFT reflectively loads an encrypted .dll into memory; a trojanised Notepad++ plugin, called LIDSHOT.