Maverits

Latest IOCs, threat alerts and reports from Maverits Team.

[Maverits @Maverits]

🌐 Maverits researchers are releasing a comprehensive special report on APT28. This report delves into #APT28’s activities since the start of the Russian war in Ukraine in 2022, analyzing their major campaigns, evolving tactics and objectives.

🔗
https://t.co/L6TW9oQAI0

[Maverits @Maverits]

📌 IoCs
Network:
176.65.144[.]30:443/fakeurl.htm
posostamioalkfjka[.]com
ostamioalkfjka[.]com

MD5:
297ae2b5688a93d0c957c672a30debf6
2dd828efdfc7296fd52d3e69dec83166
5a24676210bd317520fe30d048c9a106

@500mk500,
@Cyber0verload,
@ET_Labs,
@Now_on_VT

[Maverits @Maverits]

🚨 UAC-0050 conducts a new attack delivering NetSupport Manager + DeskHelper.

NetSupport Manager = legitimate remote admin tool abused as RAT.
DeskHelper = legitimate app abused for persistence via scheduled tasks.

1/2

[Maverits @Maverits]

@500mk500,
@Cyber0verload,
@ET_Labs,
@Now_on_VT

[Maverits @Maverits]

🚨 UAC-0050 is spreading NetSupport Manager in a new campaign.

C2 servers:
hxxp://178.16.54[.]130/fakeurl.htm
hxxp://178.16.54[.]131/fakeurl.htm
hxxp://178.16.54[.]132/fakeurl.htm

[Maverits @Maverits]

Hashes:
ef34eecc107014d41d7102fb5811b47c
4b431e68057b8c8d9db7326f3fc952d8
95d4ae969377617496edae7815b6812e
7e5064f55c0566b8cfc93dc901e46002
f5b8f32d3c937ab7f847718ae254ff69

[Maverits @Maverits]

@vxunderground APT28 is already weaponizing Qwen AI in their attacks

https://t.co/pFR55aCrkg

[Maverits @Maverits]

@500mk500, @Cyber0verload, @ET_Labs, @Now_on_VT

[Maverits @Maverits]

Delivered as a 32-bit DLL and executed using the regsvr32 service, #SAFEPAY utilizes detection evasion techniques:

regsvr32 /n /i:"-pass=XXXXXXXXXXXXXXXXXXXXX -enc=1 -uac" locker.dll

#Ransomware #CyberSecurity

[Threat and Risk Intelligence Services - eCrime.ch @ecrime_ch]

Last week we have observed 185 events across 35 countries and attributed them to 29 ransomwares.
The top targeted country was #UnitedStates and the most targeted sector was #Construction.
The ransomware #SAFEPAY has been busy with 31 new events (17%)!

[Maverits @Maverits]

🌐 Network:
45.91.201[.]247
77.37.49[.]40
80.78.28[.]63

#ThreatIntel

[Maverits @Maverits]

🌐 Our latest report dives into how cybercriminals are exploiting trending topics—like the recent surge around Trump and Melania meme coins—to launch crypto drainer schemes.

🔗
https://t.co/uZp9jTWsaS

[Maverits @Maverits]

https://voters-george-trailers-harbor[.]trycloudflare[.]com/ssu/based/regards[.]epub
https://voters-user-trailers-harbor[.]trycloudflare[.]com/ssu/based/regards[.]epub
https://voters-george-trailers-harbor[.]trycloudflare[.]com/ssu/relax/deceive[.]epub
194[.]58[.]45[.]81/ssu

[Maverits @Maverits]

#Gamaredon targeting Ukrainian entities, using TryCloudflare to mask their activities.

📄 Indicators of Compromise:

Name:
По справі 498-803-24 (провадження 2-498-277-24) надійшов документ Судова повістка про виклик в суд.hta
MD5:
B70E6AC1055C5B7B0B089AB14E850778

1/3

[Maverits @Maverits]

Name:
498-803-24_11.10.2024.xhtml (24).html
MD5:
95b1949364d0ec795bfbc08ab0152260

Name:
498-803-24_11.10.2024.rar (copy)
MD5:
72b200e3ce51870c2b10f5b39ddb2b27

2/3

[Maverits @Maverits]

Credits: @ncsccUA, @NSDC_ua

[Maverits @Maverits]

🌐 Maverits researchers are releasing a comprehensive special report on APT28. This report delves into #APT28’s activities since the start of the Russian war in Ukraine in 2022, analyzing their major campaigns, evolving tactics and objectives.

🔗
https://t.co/L6TW9oQAI0

[Maverits @Maverits]

Top countries affected by exposed IPs related to CVE-2022-40684:

🇲🇽 Mexico: 1241
🇳🇱 Netherlands: 428
🇦🇹 Austria: 265
🇹🇭 Thailand: 261
🇮🇳 India: 252
🇸🇬 Singapore: 240
🇬🇧 UK: 226
🇭🇰 Hong Kong: 148
🇨🇭 Switzerland: 117
🇨🇴 Colombia: 115

[Maverits @Maverits]

@StrikeReadyLabs Taking care about those who will analyze it

[Maverits @Maverits]

@Mandiant A better resume than most of LinkedIn

[Maverits @Maverits]

#APT28

2f8e8b2783c8c47da0f265199671f3cae4e31b2a03999fff12aa3090c74c7a51
linkcuts[.]com/5xu034g2->
doads[.]org/5xu034g2->
run.mocky[.]io/v3/eb8cef1d-89a7-4b3e-81a7-25aae7cd3698->
1b65300d04b3c7d06bdbb666e13ff0678098900e1925f720c988ad3ce7e3abaa->
jkbfgkjdffghh.linkpc[.]net:8564

[StrikeReady Labs @StrikeReadyLabs]

Back from vacation it appears; campaigns starting back up after a brief respite
2f8e8b2783c8c47da0f265199671f3cae4e31b2a03999fff12aa3090c74c7a51
linkcuts[.]com/5xu034g2 -> doads[.]org -> mocky ->
jkbfgkjdffghh.linkpc[.]net