monty

threat hunter | profile art credit @vxunderground @pancak3lullz

[Jeremy Wiedner @JeremyWiedner]

Just released my modified version of the #OpenCTI connector that imports the data from #C2Tracker by @_montysecurity .

Still working on the docker component but the #python script works great.

#ThreatIntel, #HuntingAdversaryInfrastructure

https://t.co/rOrZD5TSyj

[monty @_montysecurity]

C2-Tracker Update ❗️Censys support for C2-Tracker is currently disabled as searches are migrated to the new Platform syntax. Many of the queries will need to be removed in the process. Feel free to contribute new searches by opening an issue at https://t.co/HTAtMoKNFV

[monty @_montysecurity]

Dropped a new tool for malware researchers. It is used to continuously ingest, analyze, and alert on samples given a set of yara rules. Out of the box it works with @abuse_ch MalwareBazaar recent uploads but it's modular so you can add more sources
https://t.co/AUmSl9khhi

[monty @_montysecurity]

@pedrinazziM Nice work! Added these two

[Marco Pedrinazzi @pedrinazziM]

Happy to have contributed to the great C2 tracker by @_montysecurity https://t.co/GXxFsZUYte with a query to hunt Atlandida Stealer on Shodan and Census :)

[monty @_montysecurity]

Big changes to C2 Tracker ‼️

- Added support for Censys searches 🎉
- Updates weekly on Mondays (modeled after Censys/Shodan scanning frequency)
- Added multiple new C2s/malware/botnets

https://t.co/HTAtMoKNFV

[monty @_montysecurity]

Dropped a new blog on hunting APT41 🐼 one of my favorite ones to put together, full of hunts for common TTPs and just things you should probably be hunting for anyway 🎯

https://t.co/scxhTfTzmi

[monty @_montysecurity]

From #OSINT to Disk: Wave Stealer Analysis

https://t.co/VsVUobWUZd

#WaveStealer #MalwareAnalysis #CTI #ThreatIntel

[crep1x @crep1x]

New #WaveStealer spotted in the wild, possibly a variant of bby stealer.

Sold by a French-speaking threat actor "sudry" (aka svvdry) on Telegram/Discord for a few dollars.

C2:
wavebysudryez.]fr
wave-assistant.]com

Files created:
\Temp\wavestealer\

https://t.co/NqCZle5h5U

⬇️

[monty @_montysecurity]

Thank you for the support!! 🤘

[pancak3 @pancak3lullz]

.@_montysecurity with the sole @MITREattack APT5 contribution 👏🤙
https://t.co/tovDug3UkG

[monty @_montysecurity]

Just released a #Python script for interacting with the @abuse_ch Malware Bazaar collection and finding samples that meet multiple criteria

https://t.co/Y77bqtObWZ

I showcase it here hunting #CobaltStrike samples

https://t.co/GgpCfxjH9j

[monty @_montysecurity]

Analyzing a Suspected #AgentTesla Sample with #ChatGPT

https://t.co/Joq6Z485gc

[monty @_montysecurity]

@Cyb3rMonk I spent a lot of time on this question in the past. While limited to process/EDR data, the definition I came up with was "any combination of programs, files, and arguments that achieve some [MITRE] technique". Not perfect but it works for me :)
https://t.co/RD0pOh36lB

[monty @_montysecurity]

Hunting Volt Typhoon TTPs

https://t.co/vunqHLnDkw

[monty @_montysecurity]

Put out a post dissecting this file. Used it as an example to learn the very basics of analyzing APK files and share my process along the way.

https://t.co/mI6OZsFn5p

[MalwareHunterTeam @malwrhunterteam]

"WeChat.apk": 1c80567efb0b4ad10c97247862dd32fc8abc9cbb04f7e1e9c6624745d99dbd8c

[monty @_montysecurity]

Good find! Added this to C2 Tracker 🎯

https://t.co/HTAtMoKNFV

[The Brofessor @Glacius_]

Hey :)

@shodanhq makes the hunting process for Sliver C2 a bit easier than before. You can now search for online servers using the search query product, like so:
https://t.co/QLRGFwmHAo

Happy Hunting 😊

[monty @_montysecurity]

Looks like Shodan added "product:Havoc" as a search - CC @C5pider

https://t.co/bh4VDW3Njo

[monty @_montysecurity]

Hunting Sandworm Team's TTPs - https://t.co/XFvFjPNGKR

Happy Hunting 🎯

[monty @_montysecurity]

@MicahBabinski Thank you!

[monty @_montysecurity]

Posted a write-up on this and, with some luck, we got the source code of the infostealer that it drops

https://t.co/ML2Qotqhw8

#CTI #ThreatIntel #Malware

[MalwareHunterTeam @malwrhunterteam]

"FACTORY PURCHASE LIST AND SPECIFICATIONS\.zip": 3bdefe7cb133e9c7d8f3da4343c09bb3c97f755fe09de01286dc27ba859c1e17

[monty @_montysecurity]

Big update to C2 Tracker 📢 added 17 new tools/malware and retired some lower fidelity ones

https://t.co/HTAtMoKNFV

#CTI #ThreatIntel