Paul Burbage

Co-Founder @MalBeacon | Board Member @BSidesCHS. Tweets are mine & should be dismissed as bourbon-fueled ramblings.

[MalBeacon @malbeacon]

New Op Report: a live DPRK linked operator ran a full "PolinRider" supply chain intrusion inside it. Package lure → JS C2 → Python stealer → persistence disguised as a .NET service.

Not a signature feed. The operator, captured live.

[MalBeacon @malbeacon]

New Op Report with @proofpoint PackClient, a new C2 framework from Chinese speaking actor TA4922, detonated in a live DeceptionPro honeynet.

The RAT was just the doorman. 4.5 hours in, the operator enrolled the victim into an attacker owned ManageEngine Endpoint Central server.

[MalBeacon @malbeacon]

New Op Report: an operator took the bait on one of our honeynets and ran the whole chain.

Phishing lure to batch script to silent ScreenConnect install, hands-on-keyboard then XLoader / FormBook.

Interactive RMM + automated stealer in one op. Not a pairing we'd seen before.

[Paul Burbage @hexlax]

check out the full https://t.co/GJqTh0gNGE operation report:

https://t.co/DoROeDOgNj

[Paul Burbage @hexlax]

New blog: EDR telemetry links a ClickFix-style lure to Velvet Tempest → hands-on-keyboard activity consistent w/ Termite ransomware tradecraft.

Timeline + IOCs + defender takeaways (hunts/detections/hardening).

(link in thread)

[Threat Insight @threatinsight]

Remote Monitoring and Management (RMM) tooling is taking over the cybercrime landscape. And it keeps growing. 🤖

In partnership with DeceptionPro, we observed follow-on activity from a Bluetrait campaign in an environment built to resemble a travel company.

The result? Even more RMMs. https://t.co/E9od2hjbU3

[Fred HK @fr3dhk]

Indtroducing: What is this stealer?

A new repository that allows for you to identify Stealer malware by the system information text file format commonly included in stealer malware exfiltration.

We encourage everyone to check it out and contribute!

https://t.co/PWvlGIXJpi

[Paul Burbage @hexlax]

@ChasWaterSystem Then why are we getting official mailings from HomeServe with CWS endorsement?

[Paul Burbage @hexlax]

Some major feature additions coming to #MalBeacon portal this weekend thanks to @fr3dhk!

For now, here's a little teaser:

[Paul Burbage @hexlax]

@EDNYnews @DOJNatSec @NewYorkFBI @FBIWFO about to start
https://t.co/C7orGWMGYy

[Paul Burbage @hexlax]

YouTube continued to be used to load malware.

Take a look at this #StealC and #Laplas campaign:

https://t.co/CNvL0kiXke

[Katie Nickels @likethecoins]

If you use 3CX software, I highly recommend looking for these indicators and also looking for suspicious activity from any 3CX processes. If you aren't sure if you use this software, check! https://t.co/B03ftjmVgo

[Paul Burbage @hexlax]

Quick writeup on some recent #MalBeacon activity..

https://t.co/20yo356m1L

[Code Munky @C0deMunky]

Free tickets for the Malware & Reverse Engineering Conference 2023. This is great, and special thanks to @oceania_cyber for their generosity. DM OCSC for your free ticket. https://t.co/QuysYf5grE @fancy_4n6 @GyledC @awsn_au @hexlax @DefenceScience @DSI_VIC @MattTett @push_pnx

[Paul Burbage @hexlax]

@James_inthe_box @0xToxin @malbeacon checking..

[Paul Burbage @hexlax]

@USCGSoutheast RIP @VK_Intel - may all the folks in the industry that you inspired continue to carry the torch in your honor.

Miss you bro

[Paul Burbage @hexlax]

Over 1 MILLION beacons from threat actors received!

#MalBeacon

[Paul Burbage @hexlax]

brace yo self!
#Emotet

[Cryptolaemus @Cryptolaemus1]

We have been following this situation since the module first showed up on Monday at 0745UTC on E4. As of today at 1330UTC, the module is now being deployed to bots on the E5 botnet as well. This looks to be a new development for Emotet and maybe soon a reawakening. Stay tuned.

[Paul Burbage @hexlax]

@apeachypanda @r_ffin can only hope they bury these power lines with the road widening.. 🤦‍♂️

[Paul Burbage @hexlax]

100% this!

[Kostas @Kostastsale]

2/2

If you are an org that is using AteraAgent for remote administration, you should consider alerting on all emails that don't match your org's domain.

Here is the Emotet report:
https://t.co/DkvV8pdABI