A link with 0 VT detection ,dropping a payload with 0 VT detection is an attackers' dream.
Here they achieve it by using Syncro, a legit tool used for MSP for running scripts.
One can get a subdomain on syncro to monitor their specific instance. Syncro has also been used in past by Muddywaters APT because of their unfortunate suitability.
Live stage 1 : livepanel[.]info
Syncro custom subdomain:
mysergiosanz[.]syncroapi[.]com
Sample https://t.co/VBhE22Ayim
URL live link https://t.co/0BGS3xjEOX
#malware #paintsync #cybersecurity
sometimes in hardened AD env they disable (actually remove) SeDebugPrivilege globally (via GPO) in order to prevent malicious things targeting process memory (like token stealing, etc.) even as local admin. good (or bad) news is that the bypass is easy: https://t.co/IhhHQXLLXV
HTTP-Shell
Multiplatform Reverse Shell. This tool helps you to obtain a shell-like interface on a reverse connection over HTTP. Unlike other reverse shells...
https://t.co/eCgvvdupO6
#infosec#pentesting#redteam
🚨 1/ Ongoing campaign primarily targeting security researchers here on Twitter.
Possibly they are trying to exploit some vulnerability in Internet Explorer and database tools like Navicat. I haven't been able to get the malicious payload yet, but something fishy is going on 🤔
Certipy reached 1k stars on GitHub. Let’s celebrate with a brand new version, new research, a forked BloodHound GUI with ADCS support, and many new features, for instance Schannel authentication via LDAPS, SSPI authentication, and much more!
https://t.co/h85p3cCO1N