#NotepadPlusPlusCompromise - Twitter Hashtag

4 months ago

More reports regarding the Notepad++ compromise @Securelist https://t.co/3s5G3asUkP @kucher1n https://t.co/7ZZpQ7pY2J @ValidinLLC https://t.co/EYEEOoXUbK #NotepadPlusPlusCompromise

Florian Roth ⚡️

@cyb3rops

4 months ago

Rapid7 dropped a write-up on the Notepad++ update-chain abuse and - finally - it comes with real IOCs - update.exe downloaded from 95.179.213[.]0 after notepad++.exe -> GUP.exe - file hashes for update.exe / log.dll / BluetoothService.exe / conf.c / libtcc.dll - network IOCs incl. api[.]skycloudcenter[.]com (-> 61.4.102[.]97), api[.]wiresguard[.]com, 59.110.7[.]32, 124.222.137[.]114 by @rapid7 https://t.co/rrespJ9Ju0

cyb3rops's tweet photo. Rapid7 dropped a write-up on the Notepad++ update-chain abuse and - finally - it comes with real IOCs

- update.exe downloaded from 95.179.213[.]0 after notepad++.exe -> GUP.exe
- file hashes for update.exe / log.dll / BluetoothService.exe / conf.c / libtcc.dll
- network IOCs incl. api[.]skycloudcenter[.]com (-> 61.4.102[.]97), api[.]wiresguard[.]com, 59.110.7[.]32, 124.222.137[.]114

by @rapid7
https://t.co/rrespJ9Ju0

33

2K

538

1K

420K

3

267

67

166

29K

Validin

@ValidinLLC

4 months ago

The #NotepadPlusPlusCompromise @rapid7 report included network indicators. 💪 We uncover additional related infrastructure to look out for including a possible additional initial access IP, C2 IPs, and C2 domain names. Follow our analysis + indicators: https://t.co/qu5yb4pxyK

1

14

7

4

3K