#PhantomNet - Twitter Hashtag

about 3 years ago

Susp #APT #TA428 activity. Our team has discovered a #PhantomNet (#SManager), which was uploaded to VT from Singapore: https://t.co/AcPBRHxoA5 C2: associate[.]feedfoodconcerning[.]info:443 associate[.]freeonlinelearningtech[.]com:443 associate[.]freeonlinelearningtech[.]com:8443

GroupIB_TI's tweet photo. Susp #APT #TA428 activity. Our team has discovered a #PhantomNet (#SManager), which was uploaded to VT from Singapore: https://t.co/AcPBRHxoA5

C2: associate[.]feedfoodconcerning[.]info:443
associate[.]freeonlinelearningtech[.]com:443
associate[.]freeonlinelearningtech[.]com:8443 https://t.co/00VI0DYym2

2

59

16

9

10K

nao_sec @nao_sec

about 4 years ago

#Smanager/#PhantomNet Builder🤔?? https://t.co/S5Ir91YsQL

0

27

11

4

0

nao_sec @nao_sec

about 4 years ago

#Smanager #PhantomNet new sample (C2: ny.nsd-gov-pk[.]com) https://t.co/CHlZErx1ut

0

10

4

0

PT ESC @TI_ESC

over 4 years ago

We discovered another variant of the #smanager (#phantomnet) backdoor used by #ta428. The main difference is the use of OpenSSL for communication and more complex architecture. Examples of RTTI object names in the old and new versions

TI_ESC's tweet photo. We discovered another variant of the #smanager (#phantomnet) backdoor used by #ta428. The main difference is the use of OpenSSL for communication and more complex architecture. Examples of RTTI object names in the old and new versions https://t.co/6YIB9yTBui

1

15

5

0

nao_sec @nao_sec

over 5 years ago

Maybe #Smanager #PhantomNet module "SuperShellC_x86.dll" https://t.co/XKmbuMTGau

1

16

5

1

0

nao_sec @nao_sec

over 5 years ago

Nice blog! #Smanager #PhantomNet https://t.co/pycUW2oFHS

ESET Research

@ESETresearch

over 5 years ago

#ESETresearch discovered a new supply-chain attack against a certification authority in Southeast Asia. Installers of the GCA software, distributed on https://t.co/25L6p9gmyW, were modified to deliver #PhantomNet (aka #SMananger) @ulexec @matthieu_faou https://t.co/X8MMibdhRH 1/4

1

139

80

19

0

2

0

ESET Research

@ESETresearch

over 5 years ago

The malicious installers were hosted on https://t.co/25L6p9gmyW in July and August 2020. Though we didn’t reach a conclusive attribution, we noticed that the #PhantomNet instance shows similarities with #TManger samples that were previously used by TA428. 2/4

ESETresearch's tweet photo. The malicious installers were hosted on https://t.co/25L6p9gmyW in July and August 2020. Though we didn’t reach a conclusive attribution, we noticed that the #PhantomNet instance shows similarities with #TManger samples that were previously used by TA428. 2/4 https://t.co/Ax1YFCNruX

1

8

4

0

ESET Research

@ESETresearch

over 5 years ago

#ESETresearch discovered a new supply-chain attack against a certification authority in Southeast Asia. Installers of the GCA software, distributed on https://t.co/25L6p9gmyW, were modified to deliver #PhantomNet (aka #SMananger) @ulexec @matthieu_faou https://t.co/X8MMibdhRH 1/4

1

139

80

19

0