Jack

incident response, digital forensics & security research mainly ransomware & crypto

[Jack @hackjalstead]

3/ IOCs
nft-coinbase[.]net / 104.21.78.163 / 172.67.223.194

0xe3de02fC19a211C73A6596dB5E41F5d0E9FA24B9

Moralis.Web3.account,address1:21181de7c4311e4g15d2a91bf11b1a11aff71112d1ca11911144c6b1c221d134e531313fbe1

Moralis serverUrl = https://turkey[.]strong:2053/server

[Jack @hackjalstead]

1/ Scammers are still active, abusing Moralis functionality to transfer NFTs & ETH from connected wallets

The site was only registered 4 days ago & is using (thought to be disbanded) InfinityBlack API infrastructure

[PeckShieldAlert @PeckShieldAlert]

#PeckShieldAlert #phishing PeckShield has detected @NavjotK97745377 is forged Coinbase NFT #twitter account, not the real @Coinbase_NFT.
nft-coinbase[.]net is a phishing site. Do *NOT* connect your wallet. #NFT community share to spread awareness.

[Jack @hackjalstead]

2/ They're rotating new wallet addresses every couple days.

Today's already contains ~50k of fake mints of 0.33 eth from 4 victims & numerous NFTs some of which are for sale

https://t.co/spEmwnhsnQ

[Jack @hackjalstead]

@sogonsec @ippsec Crazy timeframe, well deserved man Congrats 🎉

[Jack @hackjalstead]

@FuzzingLabs @adrianhetman Your output is always top notch Patrick thank you 🙌🏼

[Jack @hackjalstead]

@ANeilan Sen frase to dm pour flavour

[Jack @hackjalstead]

@PhantomMedalli1 @ABTestingAlpha I’d say they’re more proactive than post but Education is the strongest form of defence. Orgs spend 6 figs on defence to get pwned by a fleshware error

[Jack @hackjalstead]

@cybercdh I was wondering the same thing. Deffo Ransomware, not many attacks would stop production

[Jack @hackjalstead]

@lordx64 @BoredApeYC

[Jack @hackjalstead]

@bmcder02 This is great! 🙌🏼

[Jack @hackjalstead]

@PhantomMedalli1 @ABTestingAlpha Use of EDR/MDR is essential to tracking spawned parent/child process trees, threat intelligence of any inbound IPs, web filtering or Intrusion Detection

[Jack @hackjalstead]

@lordx64 @MITREattack Lmao yeah Every IOC you map to MITRE gets you airdrop access

[Jack @hackjalstead]

Need to investigate a Phishing link full of redirects & obfuscation?

The unfurl tool by @_RyanBenson is great for expanding & graphing links to provide a true visualisation of the URI

https://t.co/TY2T12bVSM
#dfir #infosec

[Jack @hackjalstead]

@j_opdenakker Following the breadcrumbs on an IR case & mapping out the entire attack vector

[Jack @hackjalstead]

@malmoeb https://t.co/dzUGark42q has been quite useful in the past & has great filtering capabilities. I seem to remember they offer trial accounts too

[Jack @hackjalstead]

@vxunderground That’s Incident Responders weekend fukt

[Jack @hackjalstead]

@bneiluj

[Jack @hackjalstead]

@DoomsdayGoth Keep going! It can seem like a lot but We are all learning every single day, you got this 👊🏼

[Jack @hackjalstead]

@vysecurity Store it as a .txt and it’s platform agnostic + you don’t need an Office license

[Jack @hackjalstead]

@adrianhetman @CNBC @Ronin_Network Hell Yeah dude 🤘🏽🤘🏽🤘🏽🤘🏽