ConfiantIntel

@WeAreConfiant Threat Intelligence feeds account, fighting malvertisers since 2013 ⚔️

[ConfiantIntel @ConfiantIntel]

Our Security Researcher Michael Steele @crimewaretech delved deeply into ScamClub landing pages and the platforms with which ScamClub is affiliated!

https://t.co/9gKT2yv8hP

[ConfiantIntel @ConfiantIntel]

Proud to have our Kaileigh M. as a BlackHat speaker this year !

[Amy James @acurrydish]

UP NEXT! @DarkReading is streaming LIVE from @MandalayBay #blackhatusa2023
Josh Grossman @BounceSecurity
Kaileigh M. @ConfiantIntel
John Shier @Sophos
Abby Strong @cribl_io Chris Cesio @exabeam
Dr. Renée Burton @Infoblox
Kelly Shortridge @fastly
https://t.co/81iSH6Khh0

[ConfiantIntel @ConfiantIntel]

🚨 Security Alert 🚨: DCCBoost Forced redirects

Impacted SSPs: MediaGrid, AdYouLike, Minute Media, Smile, Wanted, YieldMo, IQZone
Impacted DSPs: LoopMe, SmartyAds, Taipei Digital, BuckSense
Targeted countries: US (87%), UK (9%), Canada (4%)
More at: https://t.co/X6cKNP9STH

[ConfiantIntel @ConfiantIntel]

Fake "Monkey Drainer" leak on @github targets wannabe #Web3 Scammers with a Raccoon Stealer!

https://t.co/AQzwfo5ads

c2: 193.37.213.23

As crypto-drainers gain popularity, we see more and more backdoored or malicious codebases targeting would-be thieves.

[ConfiantIntel @ConfiantIntel]

Malvertisers love to abuse low-impact browser bugs. They're often slow to get patched and make a significant impact on the efficacy of their malicious campaigns.

https://t.co/JQmhrjHQIW

[Eliya Stein @eliyastein]

In late September '22 we found a fun little browser bug impacting WebKit that was being abused by a malvertiser. Write up coming soon™️ on the @ConfiantIntel blog.

[ConfiantIntel @ConfiantIntel]

This campaign was identified targeting Brazil.

The .msi installer drops the following files inside %APPDATA% in a directory named “xxasd” that have the following structure. The extension is side loaded in it’s unpacked form below, into chrome via the --load-extension= switch.

[ConfiantIntel @ConfiantIntel]

Warning 🚨: Google Search Ads delivering Malicious Chrome Extension 👾

Teamviewer search ads results pointing to a malicious domain: website-montppio24[.]buzz enabling drive-by downloads delivering an .MSI installer which in turn installs the extension 🧵

[ConfiantIntel @ConfiantIntel]

The extension monitors this list of domains in order to steal user credentials, sessions or hijack the transmitted data between the victims and the monitored domains.
The extension exchanges the stolen data encrypted, with a C2 server -> mudg4rzhrmbjdcg0.ads798ad[.]top

[Confiant @WeAreConfiant]

Here’s a great write-up by Billy Hurley in IT Brew on Daniel Fonseca Yarochewsky, Confiant security software engineer’s article uncovering how CashRewindo threat actors use aged domains to serve malicious ads.
https://t.co/Vx46xFTYAL

[ConfiantIntel @ConfiantIntel]

This domain could be originating from multiple sources: Google search ads (highly likely since the malware delivery 100% overlaps with multiple malicious domains delivered via Google search ads), but could be also phishing or email etc.

[ConfiantIntel @ConfiantIntel]

[CONFIRMED] Warning 🚨: Brand Hijacking -> delivering malware 👾

Malwarebytes brand themed domain: malwarebytes-premium[.]com is enabling drive-by downloads delivering malware #Vidar #Stealer:

Botnet: 645
DD: https://t.co/9giZ9RVxlc
C2: 65.109.208.140:80

Originally found by

[Artilllerie ☣ @Artilllerie]

This new domain:
/MALWAREBYTES-PREMIUM[.]COM
Creation Date: 2023-01-18T09:37:43Z

🧩Distributes a file:
>zip with a ~800Mo exe
>Fake cert

☣️Probably a stealer (#Vidar or #Mars)

/65.109.208[.]140/pack[.]zip
/116.203.30[.]135/qthw6l/rpilag[.]exe

@malwrhunterteam
@hasherezade

[ConfiantIntel @ConfiantIntel]

Adding IOC’s missing from the original tweet:

SHA-256: 0a7c453531634b33a0dbe4d7c6aec8b60c70024616a096c360a016912b9ae481

[ConfiantIntel @ConfiantIntel]

SHA-256: 39c54b5663f827d97686822873db1be415f491b4342365a886a11bb306dcb4a4

Downloaded via: https://www.dropbox[.]com/s/kjepjlrs874nxwu/Brave.br.zip?dl=1

[ConfiantIntel @ConfiantIntel]

Warning 🚨: Google Search Ads delivering malware 👾

Brave search ads results pointing to malicious domain: braven-go[.]site

Windows binaries downloaded delivers malware #Vidar #Stealer

Botnet: 651
DD: https://t.co/tY5KuIbBHD | https://t.co/qumhYIK8E2
C2: 78.47.228.65

[ConfiantIntel @ConfiantIntel]

Tweeted again (as the previous Tweet was suspended/censored)

[ConfiantIntel @ConfiantIntel]

Warning 🚨: Google Search Ads delivering malware 👾

7zip search ads results pointing to malicious domain: 7zip-app[.]org see attached screenshot.
Windows binaries downloaded delivers malware #Vidar #Stealer

Botnet: 841
C2: https://t.co/9giZ9RVxlc | 65.109.208.140:80

[ConfiantIntel @ConfiantIntel]

SHA-256: 524c945de64dc40d514cf4801c1ed9e41d892648023d26c4a9ac60f40d2852de