BCON Collective

👾 This account is not currently in use.

[BCON Collective @BconCollective]

We've just published a new report on a Widespread Credential Harvesting Campaign.

Moving forward, all our CTI updates will come from our main account @bridewellsec, so give us a follow to keep up with our latest updates.

#ransomware #threatintelligence

[Bridewell @bridewellsec]

Joshua Penny, our Senior Threat Intelligence Analyst has analysed a widespread credential harvesting campaign. The threat actors are utilising the Dadsec platform to conduct widespread phishing of global organisations to steal Microsoft 365 credentials.

The threat actors are using Cyber Panel, an open-source web development panel, hundreds of Domain Generated Algorithm (DGA) domains that are created daily to host credential harvesting pages.

For more information, including Indicators of Compromise (IoCs) and associated infrastructure, see our full report 👉  https://t.co/LGzJJUmGDg

@AnyRun_App

#BridewellCTI #ThreatIntelligence

[BCON Collective @BconCollective]

We've just published a new report on an information stealer known as "Easy Stealer".

For more info, head over to our main account @bridewellsec. (All future CTI updates will be shared from there so give us a follow!)

#infostealer #threatintelligence

[Bridewell @bridewellsec]

Bridewell CTI has identified infrastructure associated with a new information stealer called “Easy Stealer”.

Easy Stealer is currently up for sale and under active development. Found out more in our full report: https://t.co/EbYU7JFo52

#infostealer #ThreatIntelligence

[BCON Collective @BconCollective]

We've just published a new report on a major Ransomware-as-a-Service player, ShadowSyndicate.

Moving forward, all our CTI updates will come from our main account @bridewellsec, so give us a follow to keep up with our latest updates.

#ransomware #threatintelligence

[Bridewell @bridewellsec]

ShadowSyndicate is a new Ransomware-as-a-Service player who's having a major impact on the global stage.

We've teamed up with Group-IB and Michael Koczwara to publish a full report on the group: https://t.co/QWnAJFldRk

#ransomware #threatintelligence

[Bridewell @bridewellsec]

WEBINAR: Looking to improve your organisation's operational visibility?👁️‍

Register today 👉 https://t.co/MPn0Z3TXxZ

#ManagedSecurityServices #ThreatDetection #Webinar

[BCON Collective @BconCollective]

📧 Stay up to date with Bridewell's CTI reports by receiving them directly in your inbox. Sign up here: https://t.co/BNrpZjVkpw

In case you missed it 👇 💭
➡ Bridewell and Group-IB expose the APT’s unknown infrastructure - https://t.co/WaDFQo7QZD
➡ Hunting for Ursnif - https://t.co/ZcyxBKXCWF

#CTI #Updates

[Group-IB Global @GroupIB]

Read our joint research with @bridewellsec about #APT #SideWinder👇

[Group-IB Threat Intelligence @GroupIB_TI]

When cybersecurity researchers work together, they make the world safer🤝 Group-IB and @bridewellsec are proud to share the joint blog post about previously unknown infrastructure belonging to #APT #SideWinder:
https://t.co/iF0wF8T9Te

[BCON Collective @BconCollective]

👉SideWinder’s servers can be detected using several hunting rules
👉Group-IB and Bridewell detected 55 previously unknown IP addresses that SideWinder could use in future attacks.

[BCON Collective @BconCollective]

Bridewell and Group-IB expose the APT’s unknown infrastructure.
In our latest report our Bridewell CTI team and the @GroupIB Research Team detail key findings into the APT group ‘SideWinder’.

Read the full report here: https://t.co/sIB84hOsI1

[BCON Collective @BconCollective]

#APT #SideWinder #threatintelligence #threathunting #CTI

[BCON Collective @BconCollective]

Bridewell CTI track down Ursnif, aka Gozi malware, the ex-banking trojan facilitating ransomware operations such as Royal. The Bridewell team describes recent campaigns involving the malware and how they underwent the hunt for its C2 infrastructure, including an analysis of their findings.

The report can be found here👉https://t.co/iWVQ9dMqdR

#Ursnif #Gozi #Royal #Ransomware

[BCON Collective @BconCollective]

LIDSHOT has two primary functions: system enumeration and downloading and executing shellcode from the C2.

LIDSHOT sends the following information to its C2:
Computer Name
Product name
IP address
Process List

[BCON Collective @BconCollective]

🚨⚠️Potential #Nukesped/#LIDSHOT #malware🔍 uploaded from South Korea. Only 2 detections on VT:
🔗ddb240cf6125f320330fcba78c3ac219c934ca6c8878bb659a84b7d78ae39ba3 📁FWDataViz.dll

LIDSHOT's dual threat:
1️⃣ System enumeration🕵️‍♂️
2️⃣ Downloading & executing shellcode from C2 🌐

[BCON Collective @BconCollective]

Mandiant’s UNC2970 conduct recruitment themed spear-phishing campaigns, recently delivering a trojanised version of TightVNC (LIDSHIFT) to victims.

LIDSHIFT reflectively loads an encrypted .dll into memory; a trojanised Notepad++ plugin, called LIDSHOT.

[BCON Collective @BconCollective]

@MichalKoczwara @SOSIntel @Gi7w0rm @1ZRR4H @BushidoToken @500mk500 @UK_Daniel_Card @TLP_R3D @josh_penny

[BCON Collective @BconCollective]

Bridewell Unravels #AlphV infrastructure following Mandiant report on the prolific #Ransomware group.

Read the full report here: https://t.co/WCYqczxena
IOCs included:
29 - AlphV Domains
36 – Cherry Server IPs
97 – Meterpreter IPs

#Meterpreter #IcedID
@Mandiant @proofpoint