CIPProject

The Cyber Intelligence and Policy Project is dedicated to examining global cyber conflict through the lens of threat intelligence and legal/policy analysis

[Hybrid Analysis @HybridAnalysis]

[UPDATE] We added improved detection and extraction of OLE Compound File (e.g. MSI) overlays and certificate information. Here's a recent sample as showcased in @VirusTotal @markrussinovich security vuln disclosure: https://t.co/ELtUgLgc6T

[ClearSky Cyber Security @ClearskySec]

Why #WeNeedWHOIS 1:
We use WHOIS data to discover targeted phishing set up by threat actors. Example:
Iranian threat group Charming Kitten used [email protected] as registrant of 12 domains used for phishing against human rights activists.¹
¹https://t.co/m2a730fiMQ

[Unit 42 @Unit42_Intel]

#Unit42 examines the Reaper Group’s updated mobile arsenal, including a Bitcoin Ticker Widget and a PyeongChang Winter Games application https://t.co/QrosqH0GRr

[@blu3_team @blu3_team]

"High-Level Political Forum" themed #malware
Advice about HLPF 2018.doc
2dcdd254fd72e49b7b212cbeb430e792

C2 unnews\.freetcp\.com 159.89.56\.126

[CyberWar - 싸워 @cyberwar_15]

https://t.co/PDhWzq0CWJ

[Florian Roth ⚡️ @cyb3rops]

Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries | @FireEye
https://t.co/VptsHO3Ru8

[Florian Roth ⚡️ @cyb3rops]

OceanLotus ships new backdoor using old tricks | @ESET
https://t.co/omsRFDpjtW

[CIPProject @cyberintproject]

Really interesting stuff here:

China Altered Public Vulnerability Data to Conceal MSS Influence https://t.co/4lbBI6v4CF via @RecordedFuture

[ANY.RUN @anyrun_app]

Here the full analysis of the #MuddyWater attack.
Contains heavy anti-evasion features, also requires OS reboot.
https://t.co/Ym2KjU5Ru5
Source: https://t.co/eFvaLsmhqs

[ClearSky Cyber Security @ClearskySec]

#MuddyWater targeting Pakistan, sample: "https://t.co/sHewqFPK1y.doc" (https://t.co/Cwu449NUNz)

Worth reading MuddyWater analysis:
https://t.co/VncXNfV4LD

[CyberWar - 싸워 @cyberwar_15]

#Lazarus #NorthKorea
https://t.co/Lr4viM9xSj

[ClearSky Cyber Security @ClearskySec]

We've published an new report: #AyatollahBBC – An Iranian #Disinformation Operation Against Western Media Outlets
https://t.co/1PyfES0m6A

[Jay Healey @Jason_Healey]

At Cyber Command, they are angry & ready, moving from the Billy Mitchell phase of development, to the Curtis Lemay. Getting in close to grapple w/ adversary cyber forces is almost certainly the right move, but incredibly risky... https://t.co/AcS9YKW42w

[John Hultquist @JohnHultquist]

If it’s Sandworm, as suggested here, they were swinging for the fences just as they were being publicly blamed for the most economically damaging cyberattack in history. https://t.co/Ln2h131F9w

[CyberWar - 싸워 @cyberwar_15]

Attempt to hack the South Korean government official certificate #Phishing #RGB #NorthKorea #Reconnaissance_General_Bureau #Lazarus

[CyberWar - 싸워 @cyberwar_15]

Attacker uses a hacked Korean e-mail account in secret connection with a kakao. #NorthKorea #RGB #Reconnaissance_General_Bureau #Kimsuky #RSH #Lazarus #KakaoTalk

[CyberWar - 싸워 @cyberwar_15]

Attackers are constantly accessing certain services in Korea, and access logs and traces remain. (Korean translation: 북한 -> North Korea) #RGB #NorthKorea #Reconnaissance_General_Bureau #Lazarus

[CyberWar - 싸워 @cyberwar_15]

Bureau 121 is a North Korean cyberwarfare agency, which is part of the Reconnaissance General Bureau of North Korea's military. #RGB #NorthKorea #Group123 #APT37 #Scarcruft #CVE_2018_4878 #Lazarus

[Unit 42 @Unit42_Intel]

OopsIE! OilRig uses ThreeDollars to deliver new trojan. Get the findings from #Unit42: https://t.co/c9x6A685AK