Marcus

Labeling everything APT10

[Church News @the_churchnews]

During September, members of The Church of Jesus Christ of Latter-day Saints in Oklahoma participated in various community projects through @JustServe, which is an online community service platform that connects organizations and volunteers.

Volunteers and Church members helped to gather food for those in need, plant trees and harvest vegetables.

Read more about the projects here: https://t.co/g1VGkCdu7S

📸: Priscilla Eddy, Stephen Southward

[National Cyber League (NCL) @NatlCyberLeague]

Top placements in NCL Spring 2023 Season Experienced Students Bracket! 🎉

Team Game:
1. @SANS_EDU
2. Joint Team
3. @BYU
4. @NDSU
5. @OfficialCCSF

Individual Game:
1. Andrew Effenhauser (@ClearSpringsHS)
2. Salah Abbas (@NWMOSTATE)
3. Houstoun Hall (@uofnorthgeorgia)
#cyber #ctf

[Marcus @Nameksei_jin]

@Securonix 46.101.167.60

[Microsoft Threat Intelligence @MsftSecIntel]

Iran-based threat actor MERCURY was recently observed targeting organizations in Israel. Microsoft assesses with moderate confidence the actor leveraged exploitation of Log4j 2 vulnerabilities as initial access in these attacks. Get TTPs & protection info: https://t.co/ARiqUVj69J

[Marcus @Nameksei_jin]

@Cleafy @cleafylabs https://t.co/fSKWaib4fj

[Marcus @Nameksei_jin]

@SethKingHi nt.php/?dt=

nymedsvcsystems[.]com
unocmngmntsvc[.]com
bwhealthsystemapp[.]net
slrpnlcontrlintrface[.]com
urocakpmpanel[.]com
olmajhnservice[.]com
rurushophoogtypnl[.]com
wmbwowxsvc[.]com

[Marcus @Nameksei_jin]

@billyleonard

[Marcus @Nameksei_jin]

@billyleonard @Google @Android

[Marcus @Nameksei_jin]

@alex_lanstein https://t.co/5OcvCA6MGj[.]ly (Ivacy VPN)

File: papa
MD5: 3F1FE513615A826D2D545A6C30F8E3E4
Compiled: Sun, May 10 2020, 5:24:51 - 32 Bit .NET EXE

File: remo
MD5: 316CD1091DC1DDD737137104495C62CC
Compiled: Thu, Oct 26 1905, 9:58:32 - 32 Bit .NET DLL

[Marcus @Nameksei_jin]

@alex_lanstein C:\Users\All Users\Core\Intel.vbs
C:\Users\Public\Music\alosh.ps1
C:\Users\Public\Music\run.ps1
C:\Users\Public\Music\vb.bat
C:\Users\Public\Music\vb.vbs
C:\Users\Public\install.ps1
C:\Users\Public\Intel.bat
C:\Users\Public\Intel.ps1
C:\Users\Public\Run.ps1

[Marcus @Nameksei_jin]

@malwrhunterteam @VK_Intel @bryceabdo @JAMESWT_MHT @cyb3rops happen to get the cobalt config for this one?

[Marcus @Nameksei_jin]

@IronNetTR solid

[Marcus @Nameksei_jin]

@ShadowChasing1 File: js.ps1
MD5: 5D198273A8B99B145AAB0A1B6BE60002

hxxp://microersof.xyz/4e62872fa8a96cbd1de04e65852a862cf848b7a5/offices.js

File: offices.js
MD5: 01000FF302DADC3DBA377FEBC86850B9

[Marcus @Nameksei_jin]

@cybereason @ashimmy @csoandy @anton_chuvakin @EvanKirstel @Raj_Samani @jwgoerlich @benrothke @stiennon @jack_daniel @MrJeffMan Cobalt Hosting Servers
101.132.251.212:443/MWiO
121.43.140.54:443/KbmB
171.91.196.166:443/IgYT
185.10.68.203:443/S0gr
8.210.83.18:443/bAPi
54.254.58.201:443/Yp9Z
13.212.143.15:443/cT0v
18.167.68.53:443/eVk7
15.152.54.8:443/ZBKv

[Marcus @Nameksei_jin]

@cybereason @ashimmy @csoandy @anton_chuvakin @EvanKirstel @Raj_Samani @jwgoerlich @benrothke @stiennon @jack_daniel @MrJeffMan Cobalt with same PubicKey
101.132.251.212
121.43.140.54
171.91.196.166
185.10.68.203
161.35.76.1
8.210.83.18
45.199.181.34
asismdnu.asisdns[.]space
cymkpuadkduz[.]xyz
aliyunspeedtest[.]com
cloud-fer[.]com
cservices[.]click
wmjdvu.limyonly[.]me
sogouinput[.]com

[Marcus @Nameksei_jin]

@ShadowChasing1 spivy

[Marcus @Nameksei_jin]

@Sebdraven @aRtAGGI 3rd 8T variant of this kind to hit VT. Previous was Cobalt payload

[Marcus @Nameksei_jin]

@Sebdraven https://t.co/pGW3YlBGTB

[Marcus @Nameksei_jin]

@r0ny_123 @Sebdraven @IntezerLabs its not apt27, they are targeting a different region with their typical malware and infrastructure

[Marcus @Nameksei_jin]

@lazyactivist192 @JRoosen thank you