Top Tweets for #rigek
#RigEK #LummaStealer #Exploit #C2
cryptotdsinc[.]xyz - Redirect
popmag[.]xyz - Redirect
popwertcrypt[.]xyz -Redirect
78.111.88[.]94 - RigEK C2
82.117.255[.]127 - Lumma Stealer C2
https://t.co/L3z32ZcfHi
![BroadAnalysis's tweet photo. #RigEK #LummaStealer #Exploit #C2
cryptotdsinc[.]xyz - Redirect
popmag[.]xyz - Redirect
popwertcrypt[.]xyz -Redirect
78.111.88[.]94 - RigEK C2
82.117.255[.]127 - Lumma Stealer C2
https://t.co/L3z32ZcfHi https://t.co/77gw64VRsQ](https://pbs.twimg.com/media/Fu45CJqXsAQYFRc.jpg)
![BroadAnalysis's tweet photo. #RigEK #LummaStealer #Exploit #C2
cryptotdsinc[.]xyz - Redirect
popmag[.]xyz - Redirect
popwertcrypt[.]xyz -Redirect
78.111.88[.]94 - RigEK C2
82.117.255[.]127 - Lumma Stealer C2
https://t.co/L3z32ZcfHi https://t.co/77gw64VRsQ](https://pbs.twimg.com/media/Fu45A3WXoAAgvhu.jpg)
![BroadAnalysis's tweet photo. #RigEK #LummaStealer #Exploit #C2
cryptotdsinc[.]xyz - Redirect
popmag[.]xyz - Redirect
popwertcrypt[.]xyz -Redirect
78.111.88[.]94 - RigEK C2
82.117.255[.]127 - Lumma Stealer C2
https://t.co/L3z32ZcfHi https://t.co/77gw64VRsQ](https://pbs.twimg.com/media/Fu44_ntWIAEQmMu.jpg)
![BroadAnalysis's tweet photo. #RigEK #LummaStealer #Exploit #C2
cryptotdsinc[.]xyz - Redirect
popmag[.]xyz - Redirect
popwertcrypt[.]xyz -Redirect
78.111.88[.]94 - RigEK C2
82.117.255[.]127 - Lumma Stealer C2
https://t.co/L3z32ZcfHi https://t.co/77gw64VRsQ](https://pbs.twimg.com/media/Fu445H0WAAAAuSt.jpg)
Interesting Observation:
Sample Hash:
72813522a065e106ac10aa96e835c47aa9f34e981db20fa46a8f36c4543bb85d
was mentioned in 2 articles about recent #TrueBot activity. However, I am now seeing the same sample in an Article as dropped by #RIGEK.
So it seems #SilenceGroup or #TA505 are using #RIG Exploit Kit as an initial access vector?
Sample:
https://t.co/IlF63DFGSG
Articles mentioning the sample as Truebot:
https://t.co/xPw68thqfi
https://t.co/HWxA8XMD1I
An article referring to it as dropped by RigEK:
https://t.co/xp7B5HLaAr
#rigek #EvilCorp #SilenceGroup #TA505 #Truebot
#ln -s :malware_traffic: 2023-03-02 (Thursday) - #RigEK pushes loader that retrieves #RedlineStealer malware. #pcap, malware/artifacts, and IOCs available at https://t.co/6nHtldqlxi https://t.co/YRVrADODET
![BroadAnalysis's tweet photo. #RigEK #Exploit is still a thing. Exploit's IE 11. Dropped something or other.
188.227.58[.]76
https://t.co/OilnPFj3TB https://t.co/3ZNgzPuJI5](https://pbs.twimg.com/media/FqFW3NLWcAkwonn.jpg)
![BroadAnalysis's tweet photo. #RigEK #Exploit is still a thing. Exploit's IE 11. Dropped something or other.
188.227.58[.]76
https://t.co/OilnPFj3TB https://t.co/3ZNgzPuJI5](https://pbs.twimg.com/media/FqFW3NKXsAUlI8l.jpg)
Et Tu, RIG Exploit Kit? 👀
➡️ Malvertising referer
hgoawa[.]xyz/cryptotime
➡️ #RIGEK
45.138.27[.]78
➡️ #RaccoonStealer
60009a057bc8cbf7bf6577f516a26e23487909791ddda210687236af448224f9
![Threat_Down's tweet photo. Et Tu, RIG Exploit Kit? 👀
➡️ Malvertising referer
hgoawa[.]xyz/cryptotime
➡️ #RIGEK
45.138.27[.]78
➡️ #RaccoonStealer
60009a057bc8cbf7bf6577f516a26e23487909791ddda210687236af448224f9 https://t.co/CjM03mcD9p](https://pbs.twimg.com/media/FdWup-3aUAA6yAE.jpg)
ℹ️ #RIGEK via malvertising
Gate: hilwertcrypt[.]xyz/os3mf
RIG: 188.227.58[.]9
Payload: BrowserAssistant
![Threat_Down's tweet photo. ℹ️ #RIGEK via malvertising
Gate: hilwertcrypt[.]xyz/os3mf
RIG: 188.227.58[.]9
Payload: BrowserAssistant https://t.co/l6BsziDFWP](https://pbs.twimg.com/media/FYDGe7xVEAAz6ah.png)
ℹ️ Malvertising on adult sites leading to #RIGEK
Gate: zerwertcrypt[.]xyz
Exploit landing: 45.138.27[.]69
Payload: Browser Assistant
![Threat_Down's tweet photo. ℹ️ Malvertising on adult sites leading to #RIGEK
Gate: zerwertcrypt[.]xyz
Exploit landing: 45.138.27[.]69
Payload: Browser Assistant https://t.co/7K9hdXqV0J](https://pbs.twimg.com/media/FXfeoJxVUAAB7RJ.png)
One of the last dinosaurs in the Exploit Kit family, #RIGEK, observed via malvertising in the wild pushing what appears to be Dridex.
Gate: hilwertcrypt[.]xyz
RIG EK landing: 45.138.26[.]8
Payload: 6a68ad83268dd86594c6a5ca6ea893a7f36a00149f4c93f4a79d0d7a787194b8
![Threat_Down's tweet photo. One of the last dinosaurs in the Exploit Kit family, #RIGEK, observed via malvertising in the wild pushing what appears to be Dridex.
Gate: hilwertcrypt[.]xyz
RIG EK landing: 45.138.26[.]8
Payload: 6a68ad83268dd86594c6a5ca6ea893a7f36a00149f4c93f4a79d0d7a787194b8 https://t.co/daVdBU9fTF](https://pbs.twimg.com/media/FXFJ4MkUUAALmwZ.png)
![Threat_Down's tweet photo. MakeMoney drive-by via #RIGEK pushing #BrowserAssistant.
hillex[.]xyz https://t.co/pNKSn8FvqI](https://pbs.twimg.com/media/FVKVFLCUEAAhXs_.png)
ℹ️ The 'MakeMoney' campaign is adopting a #FakeUpdates style in favor of #RIGEK.
https://t.co/5S7MNqMTR2
ℹ️ The 'MakeMoney' campaign is adopting a #FakeUpdates style in favor of #RIGEK.
https://t.co/5S7MNqMTR2
some long-forgotten files with emails codes etc
#globeimposter
#latentbot
#cerber
#rigek
#smokeloader
#trickbot
#hancitor
#RIGEK dropping #RaccoonStealer.
ℹ️ It looks like RIG started to encode their landing page.
🚨 IOCs:
185.163.204[.]24
45.138.26[.]26
5.181.156[.]155
https://t.co/Cjkh3Izhag
![Threat_Down's tweet photo. #RIGEK dropping #RaccoonStealer.
ℹ️ It looks like RIG started to encode their landing page.
🚨 IOCs:
185.163.204[.]24
45.138.26[.]26
5.181.156[.]155
https://t.co/Cjkh3Izhag https://t.co/9D9z473lSd](https://pbs.twimg.com/media/FIcEAdGVEAEwMQt.png)
#RIGEK via malvertising dropping #RaccoonStealer
91.219.236[.]69
2a63c70ac74b722797956505b95252d694cf81ed174e49e59a49ab811ae1ef72
![Threat_Down's tweet photo. #RIGEK via malvertising dropping #RaccoonStealer
91.219.236[.]69
2a63c70ac74b722797956505b95252d694cf81ed174e49e59a49ab811ae1ef72 https://t.co/uhtEerAnoB](https://pbs.twimg.com/media/FFZ1UmkVIAIEu4O.png)
spotted #RIGEK from multiple popcash URLs:
Malvertising: popcash[.]net/world/go/58911/577672/
TDS - hillmag[.]xyz
RIGEK - 45.138.27[.]84
anyrun analysis - https://t.co/lOBDwp4x3F
![david_jursa's tweet photo. spotted #RIGEK from multiple popcash URLs:
Malvertising: popcash[.]net/world/go/58911/577672/
TDS - hillmag[.]xyz
RIGEK - 45.138.27[.]84
anyrun analysis - https://t.co/lOBDwp4x3F https://t.co/6MdkzRwcJA](https://pbs.twimg.com/media/FASywGJUUAY74X2.png)
ICYMI: RiskIQ data illuminates how a #malware campaign referred to as #Gootloader may actually be a continuation of #EITest, an older campaign known for using compromised #WordPress sites to deliver malware such as #GootKit and #RIGEK: https://t.co/m0XjAwPElK
RiskIQ data illuminates how a #malware campaign referred to as #Gootloader may actually be a continuation of #EITest, an older campaign known for using compromised #WordPress sites to deliver malware such as #GootKit and #RIGEK: https://t.co/y1JILHn0W4
Last Seen Hashtags on Sotwe
ensestifşa
Seen from Austria
ثنائي_بدوي
Seen from Oman
裸舞
Seen from Indonesia
incest #nolimit()
Seen from India
momson #nolimit
Seen from Italy
ensestkızkardeş
Seen from Turkey
抖音风
Seen from Indonesia
momson() nolimit()* filter:native_video
Seen from Pakistan
monkeyappwinsFull
Seen from Indonesia
prova
Most Popular Users
Elon Musk 
@elonmusk
241.1M followers
Barack Obama
@barackobama
119.1M followers
Cristiano Ronaldo
@cristiano
112.6M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.2M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.4M followers
KATY PERRY
@katyperry
88.8M followers
Taylor Swift
@taylorswift13
82.7M followers
Lady Gaga
@ladygaga
74.2M followers
Virat Kohli
@imvkohli
71.7M followers
Kim Kardashian
@kimkardashian
70.3M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
64.6M followers
Bill Gates
@billgates
64.5M followers
The Ellen Show
@theellenshow
62.4M followers
Selena Gomez
@selenagomez
61.9M followers
CNN
@cnn
61.8M followers
X
@x
60.8M followers