ErrantCyber

Research | Identify | Disrupt
Malicious Cyber Activity

[ErrantCyber @ErrantCyber]

#APT Earth Krahang group likely compromised the Thailand Secretariat of House of the Representative in early April 2024.

C2: 23.106.122[.]5

@Thenationth @MFAThai

[ErrantCyber @ErrantCyber]

Appears that @Sisense is experiencing a significant security event.

Initial reports that both customer data and additional downstream customers may be impacted. Anticipate creds for Fortune 500 and G2K companies may be exposed.

@BBCBreaking @Reuters

[ErrantCyber @ErrantCyber]

APT #Sidewinder #India #Myanmar

Late Jan - Early Feb
C2: 103.199.16[.]60
Domain: myanmar-gov-mm.direct888[.]com

[ErrantCyber @ErrantCyber]

#APT #MustangPanda

Early March Campaign
Target: Myanmar
File: Note PSO.scr
C2: 146.70.149[.]36

[ErrantCyber @ErrantCyber]

Great Find - if this was #APT 41, this sample was used to target Taiwan's Ministry of Foreign Affairs in late December

#Taiwanelection #China

[Cuser @Cuser07]

#CobaltStrike #Malware 🤔
998c18cef6f79bab58b78b390a518c3a7c8e48da37b0953e72cbe04c1287d85d
7Z -> LNK -> JS -> CAB -> EXE and decoy PPT
"Sina-Africa_relations"
C2: www.cybereason[.xyz
@malwrhunterteam @1ZRR4H

[Cuser @Cuser07]

#CobaltStrike #Malware 🤔
998c18cef6f79bab58b78b390a518c3a7c8e48da37b0953e72cbe04c1287d85d
7Z -> LNK -> JS -> CAB -> EXE and decoy PPT
"Sina-Africa_relations"
C2: www.cybereason[.xyz
@malwrhunterteam @1ZRR4H

[ErrantCyber @ErrantCyber]

@Cuser07 @malwrhunterteam @1ZRR4H Great find - sample used in a campaign targeting the Taiwan Ministry of Foreign Affairs.

[ErrantCyber @ErrantCyber]

#APT

Roshan Telco likely compromised by Chinese APT.

Outbound traffic daily throughout November 2023: 203.174.27[.]8 -> 178.128.55[.]84

@unafghanistan @ReutersPakistan

[ErrantCyber @ErrantCyber]

#SouthAfrica #APT15

Malicious C2: 38.54.63[.]120 adfcloud[.]org
Victim: South Africa Office of the President (164.151.130[.]90) seen beaconing continuously throughout November 2023. Network compromised.

@SATodayNews
@DailyMaverick
@PresidencyZA

[ErrantCyber @ErrantCyber]

#APT
Russian Ministry of Foreign Affairs beaconing to Chinese APT Infra daily throughout October 2023

2.63.170[.]75 -> 38.54.85[.]35

[ErrantCyber @ErrantCyber]

#APT #MustangPanda
e79180380997a855c8d19be02d035b7f
C2: ivibers[.]com & meetvibersapi[.]com
Date: Sep 23, 2023

Likely targeted Taiwan
Decoy Document: PDF discussing Terry Gou campaign for Taiwan Presidency.

[ErrantCyber @ErrantCyber]

#china #APT

9/26/23
167.99.72[.]117 -> ftp1.nrsc[.]gov[.]in
Pulling data out of India's National Remote Sensing Center.

@the_hindu @IndianExpress

[ErrantCyber @ErrantCyber]

#China #APT

9/14/23
38.60.203[.]131 -> 203.17.216[.]177

Connecting to a Citrix VPN login page for the Australian Trade and Investment Commission.

@Austrade

[ErrantCyber @ErrantCyber]

It's a good thing that governments and global 2k companies removed all Solarwinds software from their environments after Russia compromised 18,000 customers in 2020...... oh wait...

[BleepingComputer @BleepinComputer]

Critical RCE flaws found in SolarWinds access audit solution - @billtoulas
https://t.co/Drn6YxHwu0

https://t.co/Drn6YxHwu0

[Kim Zetter @KimZetter]

Worth highlighting that Okta discovered this only because Beyond Trust reported to them that someone was trying to hack BT using a session cookie stolen from Okta - Okta didn't believe BT, and it took them two weeks to confirm that, yes ,they had been breached

[ErrantCyber @ErrantCyber]

@KimZetter Zing...

[ErrantCyber @ErrantCyber]

1b97637fd83abfb7ecab040a4cda2d52
config: https://t.co/0TnVaPldsf

@deloitte buys #BruteRatel...
helps fund development...
#BRc4 is sold to Ransomware & APT actors
Deloitte then bills victims for Incident Response...

[ErrantCyber @ErrantCyber]

#BruteRatel #BRc4

C2 IP Address: 161.35.73.220

Beaconing originating from:
185.24.155[.]148
vpn.trigano[.]fr
(9/1/23-9/26/23)
French Leisure Equipment Manufacturer

@lemondefr @FRANCE24

[ErrantCyber @ErrantCyber]

#BruteRatel #BRc4

Red Team Tool or Malicious Attack Tool?

[ErrantCyber @ErrantCyber]

#BruteRatel #BRc4

Malware used by:
-Pentesters
-Ransomware Actors
-APTs

Default infra certs impersonate @Microsoft
#BRc4 Sales/Training/Support hosted on @awscloud
3.110.200[.]137

@amazon Ethics?