I'd like to share a project I've been working recently related to the #Bumblebee#loader. This #Python script allows you to quickly extract the C&C server configuration from the #Bumblebee process through PE-Sieve by @hasherezade
https://t.co/QJ1gZRK6hK
@cluster25_io
#CISA updated its #BRICKSTORM advisory with an additional #Yara rule to detect the Rust variant of the backdoor.
Since referenced samples weren’t on VT, with @jvrrascon we hunted down for others founding out https://t.co/inff6GzSwd
Still zero detections on VT! Happy hunting 🍷
#Pryx v2: latest backdoor version adding new functionalities ('/' for dir. listing and '/screenshot' for screenshots) through external libraries like https://t.co/1PFO0C0dwW
IoCs:
e6a6bc09bac69d6a2445d1cf54c7bffc
hxxps://pryx[.]cc/tor.tar.gz
hxxp://apijfsjnvsl.pato[.]pw/api.php
#Pryx group actively distributing a Golang RAT against #UAE gov.
The backdoor purpose is to download a Tor package to setup a Tor hidden service on the victim that act as a stealthy HTTP listener for backdoor-related activities.
Backdoor versions & IoCs discussed in thread 🧵👇
#Pryx v1.2: upgrade to the #Pryx v1 that, in addition to the Tor channel, integrate a communication with a Telegram bot for backdoor-related activities.
IoCs:
72d7ce9c6d6bfdea2181e68fdcb2b179
cd20969ea9746011a306822531bdeb27
7424064398:AAHjgmRy1V5fm4HKSbzaw_hFSNqVippnTyc
Our latest post has just gone live! In this one, we're looking at using Capstone Disassembler, Unicorn Emulation Framework, and Python to defeat encrypted stack strings within a Conti ransomware sample
https://t.co/FzV9jfC1SE
As showed by Zscaler, almost one year later, APT29 used same TTPs to distribute a wine-tasting invitation (ring a bell?) to European diplomats by impersonating the Indian ambassador.
As usual, the questionnaire link downloads a zipped HTA that starts the infection chain.
3/3
The #threatintel#attribution puzzle: a look into the past. A thread 🧵👇.
#APT29 (also known as #CozyBear and #BlueBravo) between the first half of 2023 pursued multiple #phishing campaign based on their espionage objectives against European diplomats.
1/3
🚨New threat actor, SPIKEDWINE, impersonates Indian government officials to deliver WINELOADER malware in a #phishing campaign that targets European diplomats. Check out our technical analysis here: https://t.co/fXObDUNxCb
A specific campaign spoofed the Czechia Embassy inviting them to a wine tasting event.
This campaign showed an important change in the APT29 TTP's saying goodbye to HTTP smuggling and giving place to malicious ISO/ZIP delivered directly to victims through PDF-based lures.
2/3
As P2PInfect raises #cybersecurity concerns, our Labs team identified a strain of #P2Pinfect that targets a new #IoT architecture – ARM.
Read this blog to learn about recent P2PInfect worm operations & behavior, and the implications for digital #security: https://t.co/TfPhUOQm1R
Today, the pro-Palestinian hacker group "Islamic Cyber Team Indonesian" claims to have hacked the #FBI. Two compressed archives, referring to FBI data, totaling about 7GB were shared on their telegram channel. In the message, numerous pro Palestinian collectives have been quoted
Good news for #obfuscator/#packer researchers, the complete #VMProtect (v3.5.1) source code has just been leaked! 🔥
e41e4c6048abddeb5f3652bfb5036927f3e49b4a02b558d72839c9ebcf2c7e98
First submission: 2023-12-07 08:38:30 UTC
Fortinet researchers detail the Apache ActiveMQ CVE-2023-46604 exploitation and provide insights into the malware associated with these recent attacks, such as the newly discovered Golang-based botnet named GoTitan and a .NET program called PrCtrl Rat. https://t.co/VyZfhBTlqB
Yesterday, the pro-Rus hacker group #XakNet Team claims to have "hacked #NATO." They shared an Excel containing personal information about natoschool students (https://t.co/HiIwsc1o0S). In addition, they shared a series of accounts on the said platform.
Screenshots:
#Honeypots are essential tools for threat hunting, primarily used to lure #cyberattackers. They can also help warn that an intrusion attempt is happening, and improve our understanding of #threats.
Learn how to set up & use an #IoT#honeypot: https://t.co/3nCuJvQLMx
OK, this morning I'm doing to go cruising with #Censys
############################
You all have very specific custom config
#############################
"Very Secure FTP Daemon"
HTML Fingerprint
HTML Title: "404 That's an Error"
8.130.12.120
47.251.45.4
86.57.172.226
92.38.132.181
92.38.169.180
95.168.191.172
108.177.235.177
121.5.125.242
123.57.194.99
154.53.63.93
192.3.101.111
192.109.119.29
192.227.196.186
205.185.123.17
209.141.34.83
It’s very common for us to see offensive tooling enable SeDebugPrivilege so that they may bypass certain OS checks. However, what does this mean? Which OS checks are skipped? I dove into this and decided to write a blog on it. Check it out!
https://t.co/c7pEs48zTF
We're pleased to announce the launch of our new website
Access resources, documentation, and community projects to enhance your experience with the Sigma Rule Standard
Special thx to @sifex for the hard work!
Blog: https://t.co/O5Ewz0oHKL
Explore now: https://t.co/hg6AgdBS3Y