New IPs related to the TA exploiting #CVE_2022_42475:
139.99.35[.116
139.99.37[.119
194.62.42[.105
45.86.231[.71
45.86.229[.220
185.250.149[.32
137.175.30[.138
146.70.157[.133
155.138.220[.254
#JA3:
bf2b95ac267823f6588b2436bc537b26
TA was less careful with the windows samples - left us some clues:
- GBK (Chinese) encoding of the computer info (later changed to utf-8)
- UTC+8 compile time string inside sample (exactly 8 hours ahead of PE compile time)
Advisory of #CVE_2022_42475 (FortiOS SSL-VPN RCE) updated with additional IPs of the threat actor exploiting it:
139.180.184[.]197
66.42.91[.]32
158.247.221[.]101
107.148.27[.]117
139.180.128[.]142
155.138.224[.]122
185.174.136[.]20
https://t.co/OggXyn5Rj7
So yesterday was open #threatintel season on the Russia-based Callisto/SEABORGIUM crew, with a triple whammy of blogs from us and a couple of industry friends:
PwC: https://t.co/VGDNOmyZMK
Recorded Future: https://t.co/8azTZKeyO0
Sekoia: https://t.co/rM7w5sPQ1y
New rebranded #Conti#Ransomeware Linux & ESXi locker surfaced on VT as #Monti.
Almost identical to previous versions of Conti.
Added cmdline argumens --detach --size, --file (latter unused).
We wrote about previous campaign on September (YARA included):
https://t.co/Q0r5hO9iEB
#ESETresearch discovered an active #Android campaign conducted by the hack-for-hire group #Bahamut. The campaign has been active since January 2022, with malicious apps are distributed through a fake #SecureVPN website
@LukasStefanko https://t.co/Kdfc7hdJQT 1/6
#ESETResearch discovered that #LuckyMouse/#APT27 used a code-signing certificate belonging to VMPsoft, the developer of the VMProtect packer. The signed file is a loader for the SysUpdate backdoor (aka Soldier). We notified VMPSoft of this compromise 1/4
https://t.co/iCC221bwxw
NEW: Cybersecurity startup Corellium gave trials to NSO Group and DarkMatter.
It also sold to cellphone cracking firms Cellebrite and Elcomsoft in Russia, as well as Pwnzen, a hacking firm with ties to China's government, according to a leaked document.
https://t.co/Sc9SJhQTPK