Top Tweets for #GhostFetch

4 months ago

Recently, @GroupIB reported on #MuddyWater’s Operation Olalampo, which introduced a new downloader named #GhostFetch. While analyzing GhostFetch, our code similarity engine identified strong overlaps with a tool called #ABCSync. This tool was used in a previously unattributed 2024 #APT cluster dubbed #Actor240524 (reported by @NSFOCUS_Intl). The shared code includes the screen resolution detection routine. Further analysis revealed additional overlaps, particularly in their string decryption logic and dynamic API resolving functions. Beyond the code similarities, their operational TTPs strongly align: - Execution: Both use malicious macros to drop payloads directly into C:\Users\Public\Documents\. - Evasion: Both disguise their executables by using a .LOG extension to evade basic detection mechanisms. Taken together, the shared codebase and overlapping TTPs suggest that the 2024 Actor240524 cluster is likely linked to MuddyWater.

$ThreatrayLabs's tweet photo. Recently, @GroupIB reported on #MuddyWater’s Operation Olalampo, which introduced a new downloader named #GhostFetch. While analyzing GhostFetch, our code similarity engine identified strong overlaps with a tool called #ABCSync. This tool was used in a previously unattributed 2024 #APT cluster dubbed #Actor240524 (reported by @NSFOCUS_Intl). The shared code includes the screen resolution detection routine. Further analysis revealed additional overlaps, particularly in their string decryption logic and dynamic API resolving functions. Beyond the code similarities, their operational TTPs strongly align: - Execution: Both use malicious macros to drop payloads directly into C:\Users\Public\Documents\. - Evasion: Both disguise their executables by using a .LOG extension to evade basic detection mechanisms. Taken together, the shared codebase and overlapping TTPs suggest that the 2024 Actor240524 cluster is likely linked to MuddyWater.$

$ThreatrayLabs's tweet photo. Recently, @GroupIB reported on #MuddyWater’s Operation Olalampo, which introduced a new downloader named #GhostFetch. While analyzing GhostFetch, our code similarity engine identified strong overlaps with a tool called #ABCSync. This tool was used in a previously unattributed 2024 #APT cluster dubbed #Actor240524 (reported by @NSFOCUS_Intl). The shared code includes the screen resolution detection routine. Further analysis revealed additional overlaps, particularly in their string decryption logic and dynamic API resolving functions. Beyond the code similarities, their operational TTPs strongly align: - Execution: Both use malicious macros to drop payloads directly into C:\Users\Public\Documents\. - Evasion: Both disguise their executables by using a .LOG extension to evade basic detection mechanisms. Taken together, the shared codebase and overlapping TTPs suggest that the 2024 Actor240524 cluster is likely linked to MuddyWater.$

$ThreatrayLabs's tweet photo. Recently, @GroupIB reported on #MuddyWater’s Operation Olalampo, which introduced a new downloader named #GhostFetch. While analyzing GhostFetch, our code similarity engine identified strong overlaps with a tool called #ABCSync. This tool was used in a previously unattributed 2024 #APT cluster dubbed #Actor240524 (reported by @NSFOCUS_Intl). The shared code includes the screen resolution detection routine. Further analysis revealed additional overlaps, particularly in their string decryption logic and dynamic API resolving functions. Beyond the code similarities, their operational TTPs strongly align: - Execution: Both use malicious macros to drop payloads directly into C:\Users\Public\Documents\. - Evasion: Both disguise their executables by using a .LOG extension to evade basic detection mechanisms. Taken together, the shared codebase and overlapping TTPs suggest that the 2024 Actor240524 cluster is likely linked to MuddyWater.$

$ThreatrayLabs's tweet photo. Recently, @GroupIB reported on #MuddyWater’s Operation Olalampo, which introduced a new downloader named #GhostFetch. While analyzing GhostFetch, our code similarity engine identified strong overlaps with a tool called #ABCSync. This tool was used in a previously unattributed 2024 #APT cluster dubbed #Actor240524 (reported by @NSFOCUS_Intl). The shared code includes the screen resolution detection routine. Further analysis revealed additional overlaps, particularly in their string decryption logic and dynamic API resolving functions. Beyond the code similarities, their operational TTPs strongly align: - Execution: Both use malicious macros to drop payloads directly into C:\Users\Public\Documents\. - Evasion: Both disguise their executables by using a .LOG extension to evade basic detection mechanisms. Taken together, the shared codebase and overlapping TTPs suggest that the 2024 Actor240524 cluster is likely linked to MuddyWater.$

0

33

6

11

3K

Red Secure Tech Ltd. @redsecuretech

4 months ago

MuddyWater (Earth Vetala) launches Operation Olalampo in MENA, deploying GhostFetch, GhostBackDoor, HTTP_VIP, and Rust backdoor CHAR via phishing. https://t.co/VSAmIdVZu8 #Cybersecurity #MuddyWater #GhostFetch #GhostBackDoor #IranAPT #MENAThreats #ThreatIntel #Malware #APT

redsecuretech's tweet photo. MuddyWater (Earth Vetala) launches Operation Olalampo in MENA, deploying GhostFetch, GhostBackDoor, HTTP_VIP, and Rust backdoor CHAR via phishing.

https://t.co/VSAmIdVZu8

#Cybersecurity #MuddyWater #GhostFetch #GhostBackDoor #IranAPT #MENAThreats #ThreatIntel #Malware #APT https://t.co/iy0CvotTTF

1

2

1

0

55

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users