Remote Monitoring and Management (RMM) tooling is taking over the cybercrime landscape. And it keeps growing. 🤖
In partnership with DeceptionPro, we observed follow-on activity from a Bluetrait campaign in an environment built to resemble a travel company.
The result? Even more RMMs. https://t.co/E9od2hjbU3
Indtroducing: What is this stealer?
A new repository that allows for you to identify Stealer malware by the system information text file format commonly included in stealer malware exfiltration.
We encourage everyone to check it out and contribute!
https://t.co/PWvlGIXJpi
If you use 3CX software, I highly recommend looking for these indicators and also looking for suspicious activity from any 3CX processes. If you aren't sure if you use this software, check! https://t.co/B03ftjmVgo
We have been following this situation since the module first showed up on Monday at 0745UTC on E4. As of today at 1330UTC, the module is now being deployed to bots on the E5 botnet as well. This looks to be a new development for Emotet and maybe soon a reawakening. Stay tuned.
2/2
If you are an org that is using AteraAgent for remote administration, you should consider alerting on all emails that don't match your org's domain.
Here is the Emotet report:
https://t.co/DkvV8pdABI