Top Tweets for #ABCSync

4 months ago

Recently, @GroupIB reported on #MuddyWater’s Operation Olalampo, which introduced a new downloader named #GhostFetch. While analyzing GhostFetch, our code similarity engine identified strong overlaps with a tool called #ABCSync. This tool was used in a previously unattributed 2024 #APT cluster dubbed #Actor240524 (reported by @NSFOCUS_Intl). The shared code includes the screen resolution detection routine. Further analysis revealed additional overlaps, particularly in their string decryption logic and dynamic API resolving functions. Beyond the code similarities, their operational TTPs strongly align: - Execution: Both use malicious macros to drop payloads directly into C:\Users\Public\Documents\. - Evasion: Both disguise their executables by using a .LOG extension to evade basic detection mechanisms. Taken together, the shared codebase and overlapping TTPs suggest that the 2024 Actor240524 cluster is likely linked to MuddyWater.

$ThreatrayLabs's tweet photo. Recently, @GroupIB reported on #MuddyWater’s Operation Olalampo, which introduced a new downloader named #GhostFetch. While analyzing GhostFetch, our code similarity engine identified strong overlaps with a tool called #ABCSync. This tool was used in a previously unattributed 2024 #APT cluster dubbed #Actor240524 (reported by @NSFOCUS_Intl). The shared code includes the screen resolution detection routine. Further analysis revealed additional overlaps, particularly in their string decryption logic and dynamic API resolving functions. Beyond the code similarities, their operational TTPs strongly align: - Execution: Both use malicious macros to drop payloads directly into C:\Users\Public\Documents\. - Evasion: Both disguise their executables by using a .LOG extension to evade basic detection mechanisms. Taken together, the shared codebase and overlapping TTPs suggest that the 2024 Actor240524 cluster is likely linked to MuddyWater.$

$ThreatrayLabs's tweet photo. Recently, @GroupIB reported on #MuddyWater’s Operation Olalampo, which introduced a new downloader named #GhostFetch. While analyzing GhostFetch, our code similarity engine identified strong overlaps with a tool called #ABCSync. This tool was used in a previously unattributed 2024 #APT cluster dubbed #Actor240524 (reported by @NSFOCUS_Intl). The shared code includes the screen resolution detection routine. Further analysis revealed additional overlaps, particularly in their string decryption logic and dynamic API resolving functions. Beyond the code similarities, their operational TTPs strongly align: - Execution: Both use malicious macros to drop payloads directly into C:\Users\Public\Documents\. - Evasion: Both disguise their executables by using a .LOG extension to evade basic detection mechanisms. Taken together, the shared codebase and overlapping TTPs suggest that the 2024 Actor240524 cluster is likely linked to MuddyWater.$

$ThreatrayLabs's tweet photo. Recently, @GroupIB reported on #MuddyWater’s Operation Olalampo, which introduced a new downloader named #GhostFetch. While analyzing GhostFetch, our code similarity engine identified strong overlaps with a tool called #ABCSync. This tool was used in a previously unattributed 2024 #APT cluster dubbed #Actor240524 (reported by @NSFOCUS_Intl). The shared code includes the screen resolution detection routine. Further analysis revealed additional overlaps, particularly in their string decryption logic and dynamic API resolving functions. Beyond the code similarities, their operational TTPs strongly align: - Execution: Both use malicious macros to drop payloads directly into C:\Users\Public\Documents\. - Evasion: Both disguise their executables by using a .LOG extension to evade basic detection mechanisms. Taken together, the shared codebase and overlapping TTPs suggest that the 2024 Actor240524 cluster is likely linked to MuddyWater.$

$ThreatrayLabs's tweet photo. Recently, @GroupIB reported on #MuddyWater’s Operation Olalampo, which introduced a new downloader named #GhostFetch. While analyzing GhostFetch, our code similarity engine identified strong overlaps with a tool called #ABCSync. This tool was used in a previously unattributed 2024 #APT cluster dubbed #Actor240524 (reported by @NSFOCUS_Intl). The shared code includes the screen resolution detection routine. Further analysis revealed additional overlaps, particularly in their string decryption logic and dynamic API resolving functions. Beyond the code similarities, their operational TTPs strongly align: - Execution: Both use malicious macros to drop payloads directly into C:\Users\Public\Documents\. - Evasion: Both disguise their executables by using a .LOG extension to evade basic detection mechanisms. Taken together, the shared codebase and overlapping TTPs suggest that the 2024 Actor240524 cluster is likely linked to MuddyWater.$

0

33

6

11

3K

almost 2 years ago

New #APT #Actor240524 #ABCloader #ABCsync #Threat #malware 📍🏴 💥🇦🇿🇮🇱 ⛓️ #Phishing > Doc Macro (VBA) > #ABCloader (MicrosoftWordUpdater.log) > Load Dll (#ABCsync) > #C2 > Commands to Steal & modify files/data 🔗NSFOCUS report: https://t.co/PY8AgHS892

RexorVc0's tweet photo. New #APT #Actor240524 #ABCloader #ABCsync #Threat #malware

📍🏴
💥🇦🇿🇮🇱

⛓️ #Phishing > Doc Macro (VBA) > #ABCloader (MicrosoftWordUpdater.log) > Load Dll (#ABCsync) > #C2 > Commands to Steal & modify files/data

🔗NSFOCUS report: https://t.co/PY8AgHS892 https://t.co/I20VWuk6XS

2

75

36

32

8K

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users