Andretti227

Cyber Security x Hacking x OSINT x Malware/Virusses x Malware Analysis/Detection x Malicious IP Addresses x Phishing x Phishing URLS

[Andretti227 @Andr3tti_Ninja]

Compromised sharepoint accounts / environments seen recently in phishing campaign:

https://atgcae-my[.]sharepoint[.]com/:f:/g/personal/...

https://newyorkasianwomenscenter-my[.]sharepoint[.]com/:f:/g/personal/...

#phishingcampaign #sharepoint #onedrive

[Andretti227 @Andr3tti_Ninja]

"Microsoft" phishing URL distributed via forms office. https://ams3[.]digitaloceanspaces[.]com/gracefoundchildrenparty/babyfoxx/attach[.]html

#AiTM #Phishing #FormsOffice

[Andretti227 @Andr3tti_Ninja]

Clicking on the URL will show a DocuSign document page. Clicking on “REVIEW DOCUMENTS” will land on the AiTM Phishing website -> dotfleck[.]shop/…

[Andretti227 @Andr3tti_Ninja]

Recently seen @eventcreateit https://t.co/xtDw0HIXcX being abused for hosting adversary-in-the-middle phishing pages.

Recurring pattern in the URLs:

Https://www[.]eventcreate[.]com/e/….

Involved IP-address:

5[.]230[.]74[.]122

#AiTM #Phishing #Netherlands

[Andretti227 @Andr3tti_Ninja]

@Jan10com @reprise_99 I can help you with that. Since it is a picture/logo you won't be able to detect it. But i saw a (little) solution for that. It is not much but it can help. Just look at the mail subject where it comes from. The query will be:

EmailEvents
| where Subject contains "example"

[Responders.NOW @responders_now]

Together with @Politie we were able to snatch 155 DEADBOLT decryption keys for FREE! Use our website to check if your key is amongst them.

You can do the check via the associated Bitcoin address or upload an encrypted file.

https://t.co/UWOgV7RupT

[Horizon3 Attack Team @Horizon3Attack]

Another appliance vuln down...

CVE-2022-40684, affecting multiple #Fortinet solutions, is an auth bypass that allows remote attackers to interact with all management API endpoints.

Blog post and POC coming later this week. Patch now.

[Andretti227 @Andr3tti_Ninja]

@hnry_nz
@ChartwellStaff

Phishing Campaign ongoing.
#creditcard #phishing

[Andretti227 @Andr3tti_Ninja]

@ponbalaji it will catch scripts and other more simplistic methods of attackers accessing these files. (Much in the same as credential dumping attempts accessing sensitive files)

[Andretti227 @Andr3tti_Ninja]

@ponbalaji DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any (
"\\Microsoft\\Teams\\Cookies",
"\\Microsoft\\Teams\\Local Storage\\leveldb"
)

[Andretti227 @Andr3tti_Ninja]

@BertJanCyber Awesome keep rocking🙌🏽!! I would love to see a query for the PowerPoint “mouseover” Malware and “NullMixer” Dropper😎.

[vx-underground @vxunderground]

Update: A Threat Actor claims to have completely compromised Uber - they have posted screenshots of their AWS instance, HackerOne administration panel, and more.

They are openly taunting and mocking @Uber.

[vx-underground @vxunderground]

LAPSUS$ extortion group, the group responsible for the recent NVIDIA breach and SAMSUNG breach, are actively advertising on Telegram they are looking for insiders to provide them with access to their corporate networks.

tl;dr their TTP is insider threats

Intel via @S0ufi4n3

[vx-underground @vxunderground]

In case you missed it: HermeticWiper, the destructive malware which targeted Ukrainian organizations prior to the invasion of Ukraine, contained meta data containing the words "wHiTeHousE", "403forBiden", "primaryElectionProcess", and more.

Intel via @CSIRT_MON and @lukOlejnik

[vx-underground @vxunderground]

.@xxNB65 is stating they will be leaking the source code to Kaspersky.

We are saving the tweet as an image, instead of retweeting, in the event it is deleted from Twitter and/or the account is banned.

[Andretti227 @Andr3tti_Ninja]

@Nuldettig Ook te horen hier in Leidsche Rijn (Hoge weide)

[Andretti227 @Andr3tti_Ninja]

@lammers_mark Gebruikt ook [email protected]. Altijd handig om ook te melden bij @Fraudehelpdesk.

[Andretti227 @Andr3tti_Ninja]

@Burgernet_UT

[uid.eth | Rickey Gevers ⛵️ @UID_]

"Iranian APT campaign hosted in Dutch data centers" https://t.co/UtpBmeeXpo