Cybervrf

cybersecurity enthusiast / analyst

[hithere @asdasd13asbz]

#Kimsuky #Lazarus #APT37 #Konni #APT
We want to share a tool to analyze malware from an APT group associated with the DPRK

https://t.co/doBwVy7Bud

[John Hultquist @JohnHultquist]

APT28 activity is especially disconcerting given their historic involvement in hack and leak ops.

[Cybersecurity and Infrastructure Security Agency @CISAgov]

🌸Spring (cyber) cleaning time! Here’s your checklist:
1. Update passwords
2. Enable multi-factor authentication
3. Back up your data
No technical background required. Visit NICCS for additional online safety tips: https://t.co/nspfhF4IQC

[Kimberly @StopMalvertisin]

Fox-IT | Sifting through the spines: identifying (potential) Cactus ransomware victims https://t.co/qPZq6zBKfy

[Daily CyberSecurity @Daily_CyberSec]

Palo Alto Networks has disclosed a severe zero-day vulnerability (CVE-2024-3400) affecting its market-leading firewall software, PAN-OS. This vulnerability carries a CVSS score of 10.0, indicating its critical severity
https://t.co/KXpW8bmji9

[ThreatCat.ch @threatcat_ch]

A few words about what appears to be a new #SocGholish related TDS: cdn-serveq[.]net currently hosted on 147.78.47[.]83 (ASN209588 FLYSERVERS):

[Intel-Ops @Intel_Ops_io]

🔥New blog!

#Phobos Ransomware: Analysing associated infrastructure used by #8Base

Infrastructure: 45 domains, 22 IPs in 🇩🇪🇪🇪
Capability: #Smokeloader, #SystemBC

https://t.co/Yvh9GEkmFl

Findings below:

[Cybervrf @Cybervrf]

@g0njxa hxxps://31.207.37[.]227/ seems still active downloading from the url you found.

[Cybervrf @Cybervrf]

https://165[.]22[.]54[.]46/ #FAKEUPDATES redirect (Still live) to hxxps[://]my[.]hoqer[.]com/temp/WebModuleBrowser[.]zip

[Soufiane @S0ufi4n3]

Looks like we've got a new name here "Hanlu Network Security Team"

[Cybervrf @Cybervrf]

@whichbuffer @BushidoToken @Gi7w0rm They also talk about sstap
https://t.co/iCMsrzU7Il

SSTap, short for SOCKSTap, is used to “socksify” TCP and UDP connections at the network layer.
In the Trendmicro article they are also talking about SOCKS5 being used.

[Cybervrf @Cybervrf]

Fake Chrome update found at hxxp://159.89.175[.]38/
still live hxxps://paolomorettifurs[.]com/temp/EngineChromium[.]zip

[Cybervrf @Cybervrf]

@banthisguy9349 While at it found also: hxxps[://]170[.]210[.]104[.]31

[Tom Hegel @TomHegel]

New fantastic report -- Chinese APT intrusion into Ministry of Defence (MOD) of the Netherlands.

https://t.co/pKkONS67LI

[Tommy M (TheAnalyst) @ffforward]

We saw new #Qbot #Qakbot "tchk07" from PDF > URLs today. MSI > AdobeAC.dll w/ export EditOwnerInfo.
This is still very low volume and targeted.
Huge shout out to our fantastic @Myrtus0x0 for the RE and config extraction. IOCs in original thread.
Samples:
https://t.co/XiykxirG6T

[Cybervrf @Cybervrf]

@tunnelgre @Cryptolaemus1 They use mail thread hijacking based on earlier send mail.
That way, they try to make users believe it is a valid mail. While this is not the case.

[Will @BushidoToken]

🆕 Top 10 Cyber Threats of 2023!

While you're rockin' around the TTPs 🎄 Grab a mince pie 🥧 and have a look back over the last year before we head into 2024 🎆

🔗 https://t.co/3ruXqhEUgy

#infosec #cybersecurity #cti #threatintel

[Cybervrf @Cybervrf]

hxxp[://]ec2-35-179-8-15[.]eu-west-2[.]compute[.]amazonaws[.]com/
hxxp[://]35[.]179[.]8[.]15/
AND
hxxps[://]app[.]alwasl[.]tn
#FAKEUPDATE Both have redirect to
hxxps[://]my[.]hoqer[.]com/temp/WebModuleBrowser[.]zip

[Chris Duggan @TLP_R3D]

👾Pivoting from the domain reveals an interesting small cluster....

🔓92.240.80.5 0/88 VT Score
🔓81.16.32.65 2/88 VT Score
🔓185.165.40.224 0/88 VT Score
🔓94.74.115.3 0/88 VT Score but Flagged by @Cybervrf
🔓188.165.219.33 2/88 VT Score
🔓161.97.185.178 0/88 VT Score

All hosting the update page on their active ports!
https://t.co/mwwYdum6kA
https://t.co/SmIzioABSC

#FAKEUPDATE #KryptoCTI #KryptoKloud #C2Engine