Dan

[Sophos X-Ops @SophosXOps]

In late January, Sophos MDR Incident Response responded to a cluster of simultaneous Qilin ransomware attacks on customers of a managed service provider. The attacks were enabled by the MFA phishing of an MSP administrator's ScreenConnect login. /1

[eSentire Threat Intel @esthreat]

Active widespread exploitation observed over the weekend via Fortinet's SQL server - please see our advisory from the 14th:

https://t.co/Z9EiRltoCC

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Just before 2024, I am releasing another blog addressing the new #MetaStealer version, talking about some stealer's drama, and I also included something on the Google cookie refresher "feature" ...

https://t.co/vuNrNye0As

Happy New Year, folks! 🎇

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

#SolarMarker ☀️ has been active since 2020 and continually changes its tactics, delivering additional payloads in the form of stealers and hVNC backdoors. In this write-up, I will explore some of the past findings related to SolarMarker, with more to come...

The link to the write-up: https://t.co/s6Aur6vWjU

@esthreat

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

The new #Nitrogen 2.0 campaign comes back with some juicy stuff...🤿

✅ AMSI, WLDP bypass, ETW patching, AntiHook, and the implementation of KrakenMask

✅ Usage of transacted hollowing

✅ Obfuscated Python scripts delivering Sliver C2 and Cobalt Strike payloads

✅ Usage of Restic for data exfiltration

✅ Deployment of ALPHV/BlackCat in the final phase

Check out our blog for more details:

https://t.co/ZdzKtenfFx

@esthreat

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Some #StealC this week https://t.co/PhGB1eLFxH

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Wild #RogueRaticate appeared 🐀 Similar infection chain as described in this thread https://t.co/6g7ANLZIya

▶️ The infected WP website: hxxps://glenpharmer[.]com/restaurant/

▶️ Did a little more digging. The same web inject is used to deliver SocGholish here (hxxps://msgroup[.]space/most-funny-sports-moments-you-have-ever-seen/, where the initial C2 is mta.timeline.transversallearning[.]com)

▶️ opendir hosting both NetSupport RAT binaries and the hta file (hxxps://www.monroefmc[.]com/wp-content/uploads/2014/)

▶️ NetSupport RAT is dropped under C:\Users\<username>\AppData\Roaming\SquirellApp. Gateway IP is 185.225.75[.]33

▶️ Persistence via scheduled task "BackgroundCheck"

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Some #Ducktail fun investigation written by one of our badass researchers, Spence 😎

@esthreat

https://t.co/sTKjylQCsT

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

I am naming this #RogueRaticate campaign that leverages URL shortcuts to drop #NetSupportRAT 🐀
1/

➡️ The user is getting infected via a drive-by download with the fake update screen (similar to SocGholish behavior). The initial payload is hosted on compromised WordPress websites.

➡️ The downloaded payload is a URL shortcut, also known as an Internet shortcut file (detection bypass).
💡 The URL shortcut file can be used to access and execute the payload stored on the website (hxxps://ishahcouture.com/wp-content/uploads/2021/01/Install%20Updater%20(v102.22.145)[.]url).

➡️ The HTA file spawns the decoded PowerShell command that is responsible for downloading and extracting NetSupportRAT, creating CMSTP.inf (UAC bypass) under the %TEMP% folder.

➡️ The URL where the NetSupportRAT is retrieved from hxxps://ishahcouture.com/wp-content/uploads/2020/03/ActiveGlucol[.]zip (the same website where the URL shortcut is hosted on)

➡️ After executing the HTA file, the user gets a creepy pop-up image...

➡️ The decrypted URL where the creepy image is retrieved from hxxps://cdn.mos.cms.futurecdn.net/PPrspXcTaapLpEHjBQ7CJc-970-80[.]jpg

➡️ CMSTP.inf file contains the command to create a scheduled task to run NetSupportRAT under %AppData%\ActiveGlucol\client32.exe (task name: BackgroundCheck, runs at a log on)

➡️ NetSupportRAT C2: 94.158.244[.]26:5051

Thank you @DanInglis_ and @bohansec for identifying the initial execution and malware content
@esthreat

[eSentire Threat Intel @esthreat]

#gootloader unloaded
https://t.co/xRZ6YpPJGf

[eSentire Threat Intel @esthreat]

#qakbot not letting off
https://t.co/9ZedButM1L

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Fake Sky Go installer within an ISO image distributing #redline ? 🤔 and #magnatbackdoor via the AutoIT obfuscated script. The UPX-packed payload is injected into ftp.exe process.
URL hosting the initial ISO image: www2.ejercicios-para-personas-mayores[.]com/
C2: gjiidv[.]com
Sandbox: https://t.co/FhFdefHYUv

@esthreat

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

#Emotet E4: https://t.co/BUSh6SLnqj
URL: hxxps[://]esentai-gourmet[.]kz/404/EDt0f/?221133&amp;c=1

[eSentire Threat Intel @esthreat]

#redline stealer
https://t.co/H1z8rGiX3l

[NASA @NASA]

It's here–the deepest, sharpest infrared view of the universe to date: Webb's First Deep Field.

Previewed by @POTUS on July 11, it shows galaxies once invisible to us. The full set of @NASAWebb's first full-color images &amp; data will be revealed July 12: https://t.co/63zxpNDi4I

[Cloudflare Radar @CloudflareRadar]

An outage at one of the largest ISPs in Canada, @Rogers Communications, started earlier today, July 8, 2022, and is ongoing after more than 12 hours.

In this blog post, we explain what we've been seeing, including some non-successful attempts:

https://t.co/Mb49tw5IRJ

[Squiblydoo @SquiblydooBlog]

New Solarmarker
New persistence script; same persistence methods: drops file in Startup to call newly registered file extensions. Samples on VT and MalwareBazaar
Dropper/Loader EXE: https://t.co/6EjuYWs7aj
Backdoor DLL: https://t.co/vSS1HLKnL4
C2: 92.204.160.114
@th3_protoCOL

[eSentire Threat Intel @esthreat]

the latest #squirrelwaffle sample seems to be writing to c:\rimta\mse*.ocx where * is numerical in this case. Similar to previous conventions.

Full list:
c:\datop\test*.test
c:\datop\good*.good
C:\Datop\best*.ocx
C:\Jambo\xrv*.ocx
c:\rimta\mse*.ocx