efflux.io

Know Now

[efflux.io @efflux_io]

@RakeshKrish12 https://t.co/saMjCPlRJ6

[efflux.io @efflux_io]

@Cyberteam008 @500mk500 @MichalKoczwara @embee_research @Gi7w0rm @1ZRR4H https://t.co/5tOQksctLt
https://t.co/VfoLEj7Ivi

[efflux.io @efflux_io]

https://t.co/plH3azcdKI

[0xBurgers @0xBurgers]

Seen many different threat actors trying a magnitude of tactics with the ConnectWise ScreenConnect vulnerability. Not just limited to cobalt strike but also crypto miners.

Patch your environments and save an analyst today. 🧑‍💻👩‍💻

23[.]26[.]137[.]225

[efflux.io @efflux_io]

https://t.co/2ujDe1jAHk

[Fox_threatintel @banthisguy9349]

Guys who has the possiblity to help me? Please help me get this ip suspended evidence on picture 3.

ip : 107.189.7.133 is main ip being used by a large botnet.

https://t.co/UTwtb4IIRH

[efflux.io @efflux_io]

https://t.co/lKoY9HHEjG

[Fox_threatintel @banthisguy9349]

#opendir 79.124.59.34 with bunch of series/movies in there although there is portal called ''stalker_portal"
😬😬😬😬

found on a ASN that hosts malicious activity.

[efflux.io @efflux_io]

https://t.co/iBmYOTlwbj

[Dee @ViriBack]

#malware #atlantida #stealer

New C2 Panel : http://5.42.64.]32/login.php

see: https://t.co/n0x8FrAnm1

[efflux.io @efflux_io]

https://t.co/5PVIYVnYSg

[Dee @ViriBack]

#observer #Stealer #malware

C2: 5.42.66[.]25:3000

Ref:
https://t.co/EU4dSBx1qV

Same IP host a never seen login page at root on port 80.

[efflux.io @efflux_io]

https://t.co/Ms2jfPPAEV

[Karol Paciorek @karol_paciorek]

PowerStealer / NTStealer🕵️‍♂️

🌐 Domain: ntstealer[.]com

🖥️ IP Panels:
📍 20.79.179[.]111
📍 172.206.90[.]104

🔌 Login from IP panels communicates through API to the domain. The logo is fetched from Discord.

🤔 Does anyone have more insights on this stealer?

[efflux.io @efflux_io]

https://t.co/QXJZj37Xat

[Aaron Meese @ajmeese7]

#mirai #opendir being hosted on 192.227.231[.]5, not sure if anyone has reported on it yet:

[efflux.io @efflux_io]

https://t.co/JvXUucoBbX

[Fox_threatintel @banthisguy9349]

#malware found from the fake #mcafee phishing campaign that spreads malware:

Hash:
4b99657495dbb6b32c7161b24f769a8e276a95b48bb71060d068c613b2968a1f

ioc: 65.21.133.187

[efflux.io @efflux_io]

https://t.co/zPj56YUbAc

[Fox_threatintel @banthisguy9349]

#amadey c2 discovered on

hxxp://193.233.132.73/gjvjlS3jd2V/Login.php

hash:
560aba847a47f07ccaaeded06dd799b134ef537d3b5239ae60df9c340d60ee33

[efflux.io @efflux_io]

https://t.co/sacN5qLycy

[Dee @ViriBack]

#malware bunch of #Godzilla loader C2 have appeared on ip: 91.215.85[.]223

see: https://t.co/fvGdqCwLY5

[efflux.io @efflux_io]

https://t.co/sacN5qLycy

[Fox_threatintel @banthisguy9349]

http://91.215.85.223/ #opendir full of malware.

my Virustotal is not running in VM :(.

who can check this out and put into triage/vt/@abuse_ch ?

[efflux.io @efflux_io]

https://t.co/9Tva91rCJs

[Germán Fernández @1ZRR4H]

#opendir https://91.92.254.14/

"XFiltr8.exe" appears to be an exfiltration tool (written in Go) that uses MEGA services for storage via g.api.mega.]co.]nz.
[+] https://t.co/ilHEQJOYFn

▪ "C:/Users/187ir/Golang-Projects/XFiltr8/Builder/XFiltr8.go"

"Helpertask.exe" is #AsyncRAT
C2: 91.92.254.14:4412
[+] https://t.co/EhvM5Wl3U2.

[efflux.io @efflux_io]

https://t.co/tqV4pe6toD

[Germán Fernández @1ZRR4H]

#opendir http://91.92.245.88/

- http://91.92.245.88/Neptune/
Neptune loader admin panel files exposed.

- http://91.92.245.88/u/
"ei.exe" https://t.co/igQAZ3gvNc #XMRig
"einstall.exe" https://t.co/bhyDJh0hjh 🤔

🔎 The last binary deactivates and uninstalls MRT with "cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart".

[F5 Labs @F5Labs]

We added six CVEs to our set this month and discuss the top talkers for 2023. Read on: https://t.co/FvyNEELzs8

[F5 Labs @F5Labs]

What do we see besides CVE? Plenty. We’ve got some data. https://t.co/OHhwDcnEIT

[efflux.io @efflux_io]

https://t.co/7QgpOTFjBU

[Malpulse CTI @malpulse]

#Mirai #malware #threat

147.78.103.10:80

Source: https://t.co/Ishoy2u38S

[Josh Woodbury @jw00dbury]

Microsoft breach via a test tenant? Makes one wonder when you see a hostname like MRS2-EXCH1[.]mrs2[.]msftofetesttenant1002[.]com

https://t.co/2oLP890D3g

[efflux.io @efflux_io]

Great work here by @GreyNoiseIO!

Efflux checked out these IPs and here's what we found:

https://t.co/UxgN53csGo
https://t.co/PLOwizLt8A

[Andrew Morris (afk) @Andrew___Morris]

GreyNoise blog on ongoing Ivanti exploitation

https://t.co/O8tUmQ08xl