ᴘᴀʀᴛʜɪ

Intelligence Analyst @Atlassian

[ᴘᴀʀᴛʜɪ @cyber__sloth]

Recruitment #Phishing for well-known orgs like Google, Meta, YouTube

Full list of IOCs is here https://t.co/LE1byQ4rGx
ytjobsunit[.]com
ytjobspartner[.]com
ytjobsmember[.]com
metaworkrooms-hiring[.]com
metaworkrooms-careers[.]com

[ᴘᴀʀᴛʜɪ @cyber__sloth]

@Antonlovesdnb @HuntressLabs Love to have your thoughts on the macOS IR cases or Linux. How do they compare against Windows environments, how easy is it for TA's to laterally move, and what TTPs do you see in the wild?

[ᴘᴀʀᴛʜɪ @cyber__sloth]

#contagious_interview #DPRK #famous_chollima are spreading a malicious binary named "Uniswap Sniper Bot With GUI.exe" to steal #crypto wallets and browser information using #beavertail & #invisibileferret

cc @Uniswap

C2: 185.153.182[.]241:1224

[ᴘᴀʀᴛʜɪ @cyber__sloth]

@n3tl0kr @AccidentalCISO I second this. It’s been years since I set it up. Hassle free

[ᴘᴀʀᴛʜɪ @cyber__sloth]

@cyb3rops Please try chrome to detect password reuse. This has been super helpful for us. You can also enforce password reset if there’s password reuse.

[ᴘᴀʀᴛʜɪ @cyber__sloth]

Thanks @OrangeCon_nl for having me and @shivarahul_p. Had a good time and lots of learnings from the talks.

[ᴘᴀʀᴛʜɪ @cyber__sloth]

Awesome blog by @shivarahul_p on #microsoft graph API logs.

[Will Harris @parityzero]

With Chrome 127 on Windows, we're introducing enhanced encryption to protect sensitive data, starting with your cookies🍪! This helps protect your personal information and keeps your online accounts secure from hackers. Read more about this protection: https://t.co/cYbftNevzW

[ᴘᴀʀᴛʜɪ @cyber__sloth]

There's one more domain impersonating voov.
voov-meeting[.]site #Lazarus #DPRK

[Michael Koczwara @MichalKoczwara]

Looks like APT38/Lazarus🇰🇵 is impersonating/targeting another crypto-related company SevenX Ventures.

/7xvc.roomconnect.online

[ᴘᴀʀᴛʜɪ @cyber__sloth]

@embee_research This is amazing @embee_research. I wish @ValidinLLC would allow us to perform a filter by the domain name for an ASN. That'd be amazing and time-saving.
Maybe a feature request to the team :)

[ᴘᴀʀᴛʜɪ @cyber__sloth]

Threat actor's continuous campaign against #indian #airforce. The #malware uses Slack as its C2 as mentioned by the existing blog.
MD5: 9f8eee2c2096fd9c78488d71af45e59a
https://t.co/g3q9Ep0T2D
@IndianCERT

[ᴘᴀʀᴛʜɪ @cyber__sloth]

Related malicious URLs to this campaign. IOCs -->
https://t.co/1gLc1SaOy9

https://t.co/ETabXBJLEy

[Arkbird @Arkbird_SOLG]

And from this dropbox link in July 2023 :
https://t.co/tAUsjsdsAz

[Ginkgo @ginkgo_g]

#APT #Sidewinder

e2a3edc708016316477228de885f0c39

The decoy document is information about the itinerary of #Nepali Prime Minister Pushpa Kamal Dahal.

After the macro code is run, multiple VBScript files, batch files, and ZIP files containing the #Nim backdoor will be released.

[ᴘᴀʀᴛʜɪ @cyber__sloth]

Related infrastructure

13.176.179.|41
193.43.72.|11
193.187.172.|73

[The DFIR Report @TheDFIRReport]

🚨Confluence exploit (CVE-2023-22518) Leads to C3RB3R Ransomware🚨

➡️Exploit source: 193.187.172.73
➡️Download & Exec: http://193[.]187[.]172[.]73/tmp[.]1u
➡️Lateral Movement: Attempts to spread over SMB/445
➡️Extension: LOCK3D

h/t @GreyNoiseIO

[ᴘᴀʀᴛʜɪ @cyber__sloth]

#confluence #vulnerability #CVE-2023-22518. If you haven't patched it, please do it ASAP. If you are monitoring confluence logs, please monitor the below endpoints for incoming exploit attempts. https://t.co/r1d3TNgo1Z

[ᴘᴀʀᴛʜɪ @cyber__sloth]

Based on VT intelligence it looks like attackers are targeting HDFC bank users as well.
C2:
owncloud-150509-0[.]https://t.co/wHRZxGhBiz
owncloud-150476-0[.]https://t.co/wHRZxGhBiz
owncloud-148461-0[.]https://t.co/wHRZxGhBiz
roundcube-149741-0[.]https://t.co/wHRZxGhBiz

[ᴘᴀʀᴛʜɪ @cyber__sloth]

#phishing via #SMS, targeting 🇮🇳 #axisbank users. Uses the URL shortener https://t.co/nR3Vrg13yB and the kits are hosted on https://t.co/wHRZxGhBiz CC @cloudclusters @AxisBank 1/n

[ᴘᴀʀᴛʜɪ @cyber__sloth]

@Pepperfry Thank you

[ᴘᴀʀᴛʜɪ @cyber__sloth]

@Pepperfry please help me with the order 309211269. I’ve been trying to reach out to the support via email, but no response.