imp0rtp3

Security Researcher, Threat Intelligence And Malware Analysis for fun.
CTI Team Leader in @Fortinet.
Keybase: imp0rtp3
Mastodon: @[email protected]

[imp0rtp3 @imp0rtp3]

Really excited to finally publish my malware research of SoWaT - APT31's router implant.

https://t.co/BPQV7tmdn1

[imp0rtp3 @imp0rtp3]

We just published a new blog regarding a novel low-detected #LockBit campain
https://t.co/KY7cmeigOu

[imp0rtp3 @imp0rtp3]

@WhichbufferArda Nice Find,
5.199.162[.]72
170.64.180[.]66

Related to same infrastructure

[imp0rtp3 @imp0rtp3]

Great Blog by the colleagues @Mandiant
https://t.co/2rjtie9wW1

[imp0rtp3 @imp0rtp3]

https://t.co/vtIpDxQgED

[imp0rtp3 @imp0rtp3]

New IPs related to the TA exploiting #CVE_2022_42475:
139.99.35[.116
139.99.37[.119
194.62.42[.105
45.86.231[.71
45.86.229[.220
185.250.149[.32
137.175.30[.138
146.70.157[.133
155.138.220[.254
#JA3:
bf2b95ac267823f6588b2436bc537b26

[imp0rtp3 @imp0rtp3]

TA was less careful with the windows samples - left us some clues:
- GBK (Chinese) encoding of the computer info (later changed to utf-8)
- UTC+8 compile time string inside sample (exactly 8 hours ahead of PE compile time)

[imp0rtp3 @imp0rtp3]

Advisory of #CVE_2022_42475 (FortiOS SSL-VPN RCE) updated with additional IPs of the threat actor exploiting it:
139.180.184[.]197
66.42.91[.]32
158.247.221[.]101
107.148.27[.]117
139.180.128[.]142
155.138.224[.]122
185.174.136[.]20

https://t.co/OggXyn5Rj7

[Karsten Hahn @struppigel]

Undetected PyInstaller stealers on Virustotal
Search for
behaviour:"mdvksublbpczqluqvvbytfprxdwakuke"

[Kris McConkey @smoothimpact]

So yesterday was open #threatintel season on the Russia-based Callisto/SEABORGIUM crew, with a triple whammy of blogs from us and a couple of industry friends:

PwC: https://t.co/VGDNOmyZMK

Recorded Future: https://t.co/8azTZKeyO0

Sekoia: https://t.co/rM7w5sPQ1y

[imp0rtp3 @imp0rtp3]

@malwrhunterteam @Arkbird_SOLG @JAMESWT_MHT

[imp0rtp3 @imp0rtp3]

New rebranded #Conti #Ransomeware Linux & ESXi locker surfaced on VT as #Monti.
Almost identical to previous versions of Conti.
Added cmdline argumens --detach --size, --file (latter unused).
We wrote about previous campaign on September (YARA included):
https://t.co/Q0r5hO9iEB

[imp0rtp3 @imp0rtp3]

IoCs:
sha256 - edfe81babf50c2506853fd8375f1be0b7bebbefb2e5e9a33eff95ec23e867de1
hxxp://mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid[.]onion
hxxp://monti5o7lvyrpyk26lqofnfvajtyqruwatlfaazgm3zskt3xiktudwid[.]onion/chat/c7c5b8b0703950c40e6614bf957f94c1

[Arkbird @Arkbird_SOLG]

I share yara rules and the samples of the new variant of #blackbasta ransomware.
Samples:
https://t.co/rNYWROjxb0
Yara :
https://t.co/HGerLMS4rR

[ESET Research @ESETresearch]

#ESETresearch discovered an active #Android campaign conducted by the hack-for-hire group #Bahamut. The campaign has been active since January 2022, with malicious apps are distributed through a fake #SecureVPN website
@LukasStefanko https://t.co/Kdfc7hdJQT 1/6

[ESET Research @ESETresearch]

#ESETResearch discovered that #LuckyMouse/#APT27 used a code-signing certificate belonging to VMPsoft, the developer of the VMProtect packer. The signed file is a loader for the SysUpdate backdoor (aka Soldier). We notified VMPSoft of this compromise 1/4
https://t.co/iCC221bwxw

[Lorenzo Franceschi-Bicchierai @lorenzofb]

NEW: Cybersecurity startup Corellium gave trials to NSO Group and DarkMatter.

It also sold to cellphone cracking firms Cellebrite and Elcomsoft in Russia, as well as Pwnzen, a hacking firm with ties to China's government, according to a leaked document.

https://t.co/Sc9SJhQTPK

[imp0rtp3 @imp0rtp3]

Like everyone, I'm also available on Mastodon.
This is my handle:
@[email protected]
https://t.co/8CTWDYEqqH