#BadHatch - Twitter Hashtag

almost 5 years ago

My last 6 I hatched this morning was this - as individuals nothing remarcable, not to mention shinies… But I try to take this in a mature way 👵 but must say I am a bit disappointed… #BadHatch #PokemonGo

mrsbongobong's tweet photo. My last 6 I hatched this morning was this - as individuals nothing remarcable, not to mention shinies… But I try to take this in a mature way 👵 but must say I am a bit disappointed…

#BadHatch #PokemonGo https://t.co/3GATOcAOBp

0

11

0

🇺🇸 Trip Elix 🇺🇸

@trip_elix

about 5 years ago

"The latest refinement of the #FIN8 #APT’s #BadHatch #backdoor can leverage new #malware on the fly without redeployment, making it potent and nimble. #cybersecurity research via @Bitdefender https://t.co/YSmo0FB3og"

1

2

0

Threatpost

@threatpost

about 5 years ago

The latest refinement of the #FIN8 #APT’s #BadHatch #backdoor can leverage new #malware on the fly without redeployment, making it potent and nimble. #cybersecurity research via @Bitdefender https://t.co/Pq8PIH8sVo

0

7

4

0

Bitdefender_Ent

@Bitdefender_Ent

about 5 years ago

Our researchers recently encountered a new version of the #BADHATCH malware used by the well-known threat actor, #FIN8. Read our blog about an attempted attack by FIN8 on one of our customers, and how we managed to thwart it before it could fully develop: https://t.co/Kyrd1lK2ru

0

2

0

TEAM CYMRU @teamcymru

over 5 years ago

Did you miss the new research from #TeamCymru! #FIN8: #BADHATCH Threat Indicator Enrichment FIN8 research identifies ongoing campaigns against entities in Germany, Sweden and the US. #puresignal #RECON #infosec #threatintel https://t.co/a41xk1uN39

teamcymru's tweet photo. Did you miss the new research from #TeamCymru!
#FIN8: #BADHATCH Threat Indicator Enrichment
FIN8 research identifies ongoing campaigns against entities in Germany, Sweden and the US. #puresignal #RECON #infosec #threatintel
https://t.co/a41xk1uN39 https://t.co/nrs9FLIKsH

0

1

2

0

Arkbird @Arkbird_SOLG

over 5 years ago

Like previously mentioned #BADHATCH backdoor of #FIN8 group, inject himself in explorer for be in memory only, launch the shellcode, the pass the hash (from mimikatz source code), take screenshots (but not the available commands), exec commands and send the results to the C2.

Arkbird_SOLG's tweet photo. Like previously mentioned #BADHATCH backdoor of #FIN8 group, inject himself in explorer for be in memory only, launch the shellcode, the pass the hash (from mimikatz source code), take screenshots (but not the available commands), exec commands and send the results to the C2. https://t.co/evN8kh22VY

1

49

17

3

0

Arkbird @Arkbird_SOLG

over 5 years ago

#FIN8 continue to use their powershell loader (+ csharp template as reflection method) for load #BADHATCH in memory. Have some improvements in theirs options (Configurable HTTP request, Pass-the-hash (x64 version) ...) Samples : https://t.co/7ErZBYqKq8

Arkbird_SOLG's tweet photo. #FIN8 continue to use their powershell loader (+ csharp template as reflection method) for load #BADHATCH in memory. Have some improvements in theirs options (Configurable HTTP request, Pass-the-hash (x64 version) ...)
Samples :
https://t.co/7ErZBYqKq8 https://t.co/6ApbXLzfAe

3

70

36

8

0

Frank Boldewin

@r3c0nst

over 5 years ago

#FIN8 shellcode for #BADHatch deployment uses an interesting APIHashing algorithm I haven't seen before. It's derived from a fasthash implementation in OpenCPN using seeds. https://t.co/SAx2FqDRkI #DFIR #Malware

r3c0nst's tweet photo. #FIN8 shellcode for #BADHatch deployment uses an interesting APIHashing algorithm I haven't seen before. It's derived from a fasthash implementation in OpenCPN using seeds. https://t.co/SAx2FqDRkI #DFIR #Malware https://t.co/tAdqusgR81

0

70

35

2

0

𝘚𝘢𝘭𝘷𝘢𝘵𝘰𝘳𝘦 𝘊𝘢𝘮𝘱𝘰𝘭𝘰 ֎ @Totocellux

over 5 years ago

#MalwareAnalysis: #FIN8 Returns With Improved #BADHATCH Toolkit (PDF) https://t.co/tyBumTscxZ @BitdefenderLabs @Bitdefender 𝞝 #Enterprises #Organizations #Malware #Backdoor #CyberThreats #POS #InfoSec #CyberSecurity #Encryption #PowerShell #Employees #TLS #CyberAttacks

Totocellux's tweet photo. #MalwareAnalysis: #FIN8 Returns With Improved #BADHATCH Toolkit (PDF)
https://t.co/tyBumTscxZ
@BitdefenderLabs @Bitdefender
𝞝
#Enterprises #Organizations
#Malware #Backdoor
#CyberThreats #POS
#InfoSec #CyberSecurity
#Encryption #PowerShell
#Employees #TLS
#CyberAttacks https://t.co/sJSk6L1WgM

0

1

2

0

Aiden Technologies, Inc. @meetaidentech

over 5 years ago

FIN8 Hacking Group Resurfaces with Sophistication: Black-hat hackers use TLS encryption, backdoors to evade detection to commit fraud at scale #cybersecurity #BADHATCH #cybercrime #hack #financial #fintech https://t.co/5HFk9ir2hx

meetaidentech's tweet photo. FIN8 Hacking Group Resurfaces with Sophistication: Black-hat hackers use TLS encryption, backdoors to evade detection to commit fraud at scale
#cybersecurity #BADHATCH #cybercrime #hack #financial #fintech
https://t.co/5HFk9ir2hx https://t.co/rZcVkSbxsM

0

2

0

Team Cymru Research

@teamcymru_S2

over 5 years ago

BLOG POST: #FIN8 #BADHATCH C2s identified in the targeting of several entities in Germany, Sweden and the United States. https://t.co/2StLXGjP6F #ThreatIntel

teamcymru_S2's tweet photo. BLOG POST: #FIN8 #BADHATCH C2s identified in the targeting of several entities in Germany, Sweden and the United States.

https://t.co/2StLXGjP6F

#ThreatIntel https://t.co/vU54xcLqLn

Team Cymru Research

@teamcymru_S2

over 5 years ago

THREAT ACTOR TIP: Additional #FIN8 #BADHATCH C2s identified: 89.45.4.192 (🇺🇸) 108.62.118.100 (🇺🇸) Observed in potential compromise of victims in Germany, Sweden and the United States since January 2021. Blog to come next week! #ThreatIntel

0

9

5

1

0

5

1

0

TEAM CYMRU @teamcymru

over 5 years ago

New research from #TeamCymru! #FIN8: #BADHATCH Threat Indicator Enrichment FIN8 research identifies ongoing campaigns against entities in Germany, Sweden and the US. #puresignal #RECON #infosec #threatintel https://t.co/a41xk1uN39

teamcymru's tweet photo. New research from #TeamCymru!
#FIN8: #BADHATCH Threat Indicator Enrichment
FIN8 research identifies ongoing campaigns against entities in Germany, Sweden and the US. #puresignal #RECON #infosec #threatintel
https://t.co/a41xk1uN39 https://t.co/KpagPx8Ffg

0

2

0

TrendAI™ Research

@trendai_RSRCH

about 7 years ago

#Badhatch is a new PoS #malware traced back to #FIN8 , capable of scraping credit card information, scanning for victim networks, and installing a backdoor and other payloads. Details: https://t.co/xeBgZgpPOg

0

3

5

1

0

TrendAI™ Research

@trendai_RSRCH

about 7 years ago

#Badhatch is a new PoS #malware traced back to #FIN8 , capable of scraping credit card information, scanning for victim networks, and installing a backdoor and other payloads. Details: https://t.co/xeBgZgpPOg

0

2

1

0

QuoScient @quoscient

about 7 years ago

This #QuoINT Bulletin covers an analysis of attacks attributed to the #Winnti Group which targeted several🇩🇪 firms, the newly discovered malware #BADHATCH used by #FIN8, & continued #cyberattacks potentially related to ongoing tensions in the Middle East. https://t.co/Vfh2ZRwEHo

0

4

0