🌐 Maverits researchers are releasing a comprehensive special report on APT28. This report delves into #APT28’s activities since the start of the Russian war in Ukraine in 2022, analyzing their major campaigns, evolving tactics and objectives.
🔗
https://t.co/L6TW9oQAI0
🚨 UAC-0050 is spreading NetSupport Manager in a new campaign.
C2 servers:
hxxp://178.16.54[.]130/fakeurl.htm
hxxp://178.16.54[.]131/fakeurl.htm
hxxp://178.16.54[.]132/fakeurl.htm
Delivered as a 32-bit DLL and executed using the regsvr32 service, #SAFEPAY utilizes detection evasion techniques:
regsvr32 /n /i:"-pass=XXXXXXXXXXXXXXXXXXXXX -enc=1 -uac" locker.dll
#Ransomware#CyberSecurity
Last week we have observed 185 events across 35 countries and attributed them to 29 ransomwares.
The top targeted country was #UnitedStates and the most targeted sector was #Construction.
The ransomware #SAFEPAY has been busy with 31 new events (17%)!
🌐 Our latest report dives into how cybercriminals are exploiting trending topics—like the recent surge around Trump and Melania meme coins—to launch crypto drainer schemes.
🔗
https://t.co/uZp9jTWsaS
#Gamaredon targeting Ukrainian entities, using TryCloudflare to mask their activities.
📄 Indicators of Compromise:
Name:
По справі 498-803-24 (провадження 2-498-277-24) надійшов документ Судова повістка про виклик в суд.hta
MD5:
B70E6AC1055C5B7B0B089AB14E850778
1/3
🌐 Maverits researchers are releasing a comprehensive special report on APT28. This report delves into #APT28’s activities since the start of the Russian war in Ukraine in 2022, analyzing their major campaigns, evolving tactics and objectives.
🔗
https://t.co/L6TW9oQAI0
Back from vacation it appears; campaigns starting back up after a brief respite
2f8e8b2783c8c47da0f265199671f3cae4e31b2a03999fff12aa3090c74c7a51
linkcuts[.]com/5xu034g2 -> doads[.]org -> mocky ->
jkbfgkjdffghh.linkpc[.]net