FaLcon Intelligence

[FaLcon Intelligence @FaLconIntel]

2021-10-29
#Malvertising -> #MagnitudeEK -> #Magniber #Ransomware
location:Japan

[DirectoryRanger @DirectoryRanger]

Post Compromise Active Directory Checklist
https://t.co/e85wblANnW

[BleepingComputer @BleepinComputer]

Exploit code released for three iOS 0-days that Apple failed to patch - @serghei
https://t.co/npqGoVOayI

[Max_Malyutin @Max_Mal_]

#MSHTML RCE Vulnerability #CVE-2021-40444 (#CVE202140444)

#DFIR #BlueTeam - Not only Control - CPL‼️

Potentially the exploit could run:
#LOLBins 🔥🔥🔥🔥
MSHTA - HTA ✅
WSCRIPT - JS, JSE, VBA, WSF...✅
JAVAW - JAR ✅
MSIEXEC - MSI ✅
RegEdit - REG ✅

And MORE (?)

[Jakub Kroustek @JakubKroustek]

#Sodinokibi / #REvil #ransomware is back and not just their sites. The latest variant from today: https://t.co/V6qq74UKMR

[BleepingComputer @BleepinComputer]

Windows CVE-2021-40444 defenses bypassed as new info emerges - @LawrenceAbrams
https://t.co/8Q6yf8VIFK

[Max_Malyutin @Max_Mal_]

#MSHTML RCE Vulnerability #CVE-2021-40444

#DFIR How to find mhtml object:

1) Unzip the MalDoc
2) Navigate to *\word\_rels\*
3) open document.xml.rels
4) Screech for: Target="mhtml:

Sample:
https://t.co/lqQGn7t7gf

[Gen Threat Labs @GenThreatLabs]

We’ve found #UnderminerEK has the following modules and can exploit a whopping 11 different vulnerabilities including #PrintNightmare.

[RIVER @wugeej]

Fortinet FortiWeb OS Command Injection [‼️0-day]

[PoC]
POST /api/v2.0/user/remoteserver.saml HTTP/1.1
...
...
Content-Disposition: form-data; name="name"
`touch /tmp/vulnerable`

https://t.co/lWmj6JA5BR

[Florian Roth ⚡️ @cyb3rops]

A #PrinterNightmare overview

https://t.co/lw1n2PesFi

[Virus Bulletin @virusbtn]

Proofpoint reports an increase in malicious use of Cobalt Strike in threat actor campaigns. Cobalt Strike is currently used by more cybercrime and general commodity malware operators than APT and espionage threat actors. https://t.co/r8yfgtaS5f

[Analysis Center @jpcert_ac]

ラッキービジター詐欺で不正サイトへのリダイレクトに悪用されるドメインを掲載するレポジトリを公開しました。新しい不正ドメインが観測された際は、こちらに掲載されますので、ご活用ください。 ^ST
https://t.co/s11Nr8RKGt

[FaLcon Intelligence @FaLconIntel]

2021年5月に観測したPurple Foxのランディングはこちらです。
#PurpleFox(#PurpleFoxEK)

[株式会社マクニカ ネットワークス カンパニー @mncofficial2004]

海外においてPurple Fox EKが活発です。

IEのパッチ適用状況確認（特に21年3月修正のCVE-2021-26411）やIE以外のブラウザへの切替について海外拠点への注意喚起をご検討ください。

ランディングページは特定できておりませんが、PSの接続先は以下ドメインです。

[nao_sec @nao_sec]

New blog post! #nccTrojan is a RAT used by #TA428 in attacks targeting East Asian defense and aviation organizations. Please see the analysis result of nccTrojan v1 and v2😆
https://t.co/RxR2zzVoLj

[FaLcon Intelligence @FaLconIntel]

2021-02-17
#Malvertising -> #RIGEK -> #loader -> #BrowserAssistant

The loader had Microsoft digital certification, which has been identified as an invalid signature.

https://t.co/FC1BQXLJ2c
https://t.co/uKmrhrXPLI

[FaLcon Intelligence @FaLconIntel]

2021-01-29
#Malvertising -> #RIGEK(#ExploitKit) -> #Smokeloader -> #Ursnif(#Dreambot)
location:Japan

SerpentKey=78347829JSDUKLHG
Version:250161
id=8005
https://t.co/sY5MKIpb8l
https://t.co/kGOmhXrbAv

[FaLcon Intelligence @FaLconIntel]

2021-01-28
#Malvertising -> #RIGEK(#ExploitKit) -> #Buer(##BuerLoader)

https://t.co/XzFbPUtY6z
https://t.co/BcRAzJsRDs

[FaLcon Intelligence @FaLconIntel]

2021-01-20
#Malvertising -> #RIGEK(#ExploitKit) -> #Dridex OR Unknown malware

It seems that the malware that infects depends on the location.

https://t.co/4e4ENBSjWU
https://t.co/l3W8mVmh5G

https://t.co/kdWNIVC7PR
https://t.co/4K2YvX9cLc
https://t.co/5PjxTVS03u

[nao_sec @nao_sec]

#PurpleFox Exploit Kit -> #PhantomNugget
https://t.co/ekoZOGYnRr

[FaLcon Intelligence @FaLconIntel]

2020-12-08
#Malvertising(#Makemoney) -> #RIGEK(#ExploitKit) -> #Taurus

Sample
https://t.co/oEKPcoHL4r
https://t.co/vKKkM8pz8b

Reference
https://t.co/3fjQJT7W5R