Top Tweets for #allintel
Interesting #CobaltStrike server impersonating @nvidia:
➡️static[.]nvidiadrives[.]com
➡️Reg via NameSilo on 05-29
➡️Fronted via Cloudflare
➡️license: 987654321
➡️VT: 0/93 for domain and hosting IP
Interested in our services or want a demo? https://t.co/kgAHuxaxy9 #AllIntel
Source IPs continued:
158.247.248[.]34
31.41.221[.]123
117.188.118[.]53
157.230.218[.]201
103.73.66[.]37
If you work in DFIR/DE/TH and want the POST uri, please contact us - https://t.co/kgAHuxaxy9
This intel and more available @ https://t.co/RXnF6Mx8fB #AllIntel
➡️This is an example of a private report that we make available to our customers on a weekly basis.
If you are not a customer and would like to get access to these reports, please contact us - https://t.co/kgAHuxaxy9 #AllIntel
➡ If you are already a customer, more info such as commands, tasks, files, behaviors, IOCs, etc. can be found under eventID 23825.
➡➡If you are not a customer and would like to get access to these reports, please contact us - https://t.co/kgAHuxaxy9 #AllIntel
11/ If you are already a customer, more info such as commands, tasks, files, behaviors, IOCs, etc. can be found under eventID 22967.
If you are not already a customer and would like to get access to these reports, please contact us - https://t.co/kgAHuxaxy9 #AllIntel
We'll be releasing a private report to our #AllIntel customers on Monday 8/7 in relation to #DarkGate, #CobaltStrike, & #BianLian.
https://t.co/k8UVEOdKTQ
If you are not already a customer and would like to get access to these private reports, please contact us - https://t.co/kgAHuxaxy9
IOCs and report were made available to our #AllIntel customers back in May. Customers can find this information under EventID 21436.
3/X
➡️After installing Level Agent using Havoc, the TA
then proceeded to download AnyDesk, DWagent, Netscan, Putty and Advanced IP Scanner.
➡️After profiling the network, the threat actors started pivoting to hosts using RDP...
https://t.co/k8UVEOdKTQ #AllIntel
2/X
In May, we observed a threat actor (TA) exploit PaperCut NG (CVE-2023-27350) to download/execute a Havoc C2 binary.
➡️The TA then reviewed tasklist before dumping credentials using Mimikatz.
➡️Next, the TA downloaded numerous RMM tools.
https://t.co/k8UVEOdKTQ #AllIntel
1/X
It's been an exciting couple of weeks!
➡️New mini report being published to #AllIntel customers today!
➡️New analysts have joined the team! 🎉
➡️We've seen TAs using Empire, Havoc, Villain, Metasploit, Cobalt Strike, and a few *new to us* RMM tools.
https://t.co/k8UVEOdKTQ
Interesting #CobaltStrike server:
➡ hommyy-ekfvfwcpe7c0g0dk[.]z01[.]azurefd[.]net
➡ Beacon staged on Digital Ocean
➡ ➡ With LE cert for ciscoassists[.]com
➡ Safebrowsing URIs
➡ Sleep: 69000
➡ SpawnTo: WerFault.exe
Full list available @ https://t.co/e7UJSroAGa
#AllIntel
Interesting #CobaltStrike server:
➡️hommyy-ekfvfwcpe7c0g0dk[.]z01[.]azurefd[.]net
➡️Beacon staged on Digital Ocean
➡️➡️With LE cert for ciscoassists[.]com
➡️Safebrowsing URIs
➡️Sleep: 69000
➡️SpawnTo: WerFault.exe
Full list available @ https://t.co/QT6o62nSRr
#AllIntel
We'll have a report out on "Gazprom Locker" in a few months.
➡️Initial Access: Exploit Public-Facing Application
➡️C2: Cobalt Strike + AnyDesk
➡️Impact: Domain wide ransomware
More context in EID 21169 https://t.co/k8UVEOdKTQ #AllIntel
So, a ransomware gang that is
- using the codes of Conti
- using the name of Gazprom (you know, the big Russian company)
- using Putin ASCII art
started to pwn at least around the middle of April.
(1/2)
Some long running #CobaltStrike servers:
➡️cuphq[.]com
➡️www[.]micrcscft-store[.]com
➡️cdn1[.]lcdn348v89328gcuhb[.]ga
➡️qianxing[.]rocks
➡️updatelink[.]firefoxokt[.]top
➡️api[.]niskqnasqw[.]xyz
Full list available @ https://t.co/QT6o62oqGZ #AllIntel
Interesting #CobaltStrike server:
➡️tributepower[.]com
➡️➡️5.188.86[.]227
➡️URI: /Forge/columnists/JK3IZADWJSJD
➡️URI: /Build/v6.44/5R2H58RHU6
➡️Sleep: 94782
➡️Spawn86: dns-sd.exe
➡️Spawn64: w32tm.exe
Full list available @ https://t.co/QT6o62nSRr
#AllIntel
Interesting #CobaltStrike server:
➡️https-proxy-phxf3piyqa-uc[.]a[.]run[.]app
➡️➡️161.35.59[.]97
➡️Amazon Profile
➡️kill date: 2023-04-01
➡️Sleep: 5000
➡️Spawn: rundll32
Full list available @ https://t.co/QT6o62oqGZ
#AllIntel
Interesting #CobaltStrike server:
➡️dash[.]cloudflareo[.]club
➡️➡️45.92.158.220
➡️Trevor profile (#trevorforget)
➡️URI: us/ky/louisville/312-s-fourth-st.html
➡️URI: OrderEntryService.asmx/AddOrderLine
➡️Spawn: gpupdate.exe
Full list available @ https://t.co/QT6o62oqGZ
#AllIntel
Here's some newer #CobaltStrike servers we're tracking with Freenom domains:
➡️lemon[.]mmmllkps[.]tk
➡️searchme[.]360niubiclass[.]tk
➡️www[.]tercent[.]tk
➡️no-cs[.]cf
➡️www[.]qax666[.]tk
Full list @ https://t.co/QT6o62nSRr
#AllIntel
Some newer #CobaltStrike servers with Freenom domains:
➡️no-cs[.]cf
➡️cs[.]dimples7331[.]ml
➡️lin[.]buyshipping[.]ml
➡️www[.]qax666[.]tk
➡️n3w[.]n3wf1nd3r[.]ga
➡️managers[.]pabotelidely[.]tk
Full list available @ https://t.co/QT6o62nSRr
#AllIntel
Interesting #CobaltStrike server:
➡️uknewsmedia[.]pro
➡️➡️193.149.185[.]101
➡️URI: /remove
➡️URI: /lt.html
➡️Sleep: 63729
➡️Spawn: WUAUCLT.exe
➡️License: 426352781
Full list available @ https://t.co/QT6o626hsR
#AllIntel
Last Seen Hashtags on Sotwe
TrumpliesPeopleDies
Seen from United States
Unexpected
Seen from Puerto Rico
連絡幹部
Seen from United States
top #vietnam #gay
Seen from Vietnam
porn()*** +filter:native_video
Seen from Canada
DrippingForYou
Seen from Malaysia
ulluwebseries
Seen from India
顔画像解析ai
Seen from United States
issoésde
Seen from United States
gizliçekim
Seen from Turkey
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.6M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90.1M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers