John Ferrell

Cofounder @huntresslabs

[Huntress @HuntressLabs]

.@HuntressLabs has validated the vulnerabilities referred to in the latest February 19th #ConnectWise ScreenConnect advisory. For on-premise users, it is our strongest recommendation to patch and update to #ScreenConnect version 23.9.8 immediately.

[Jamie Levy🦉 @gleeda]

What we currently know about the #MOVEit Transfer Critical #Vulnerability

https://t.co/pTnPflIEvJ

Great work by @_JohnHammond @nosecurething @Purp1eW0lf @jfslowik Anthony Smith, Sharon Martin and others here at @HuntressLabs

#DFIR #ThreatIntel

[Huntress @HuntressLabs]

Excited to kick off #ITNSecure22 today in Orlando, FL! Our own @MaxRogers5 will be presenting on defense evasion this Wednesday starting at 1:30pm. See you there!

[Caleb Stewart @calebjstewart]

I implemented a PoC replicating the exploitation of the #kaseya VSA server as seen in the recent MSP #ransomwareattack.

Can't release more details until the software is fully patched, but this research has helped a lot in understanding the attack.

@HuntressLabs

[John Ferrell @jdferrell3]

Persistent web shell! (outlook.vbs runs outlook.bat which replaces the web shell disguised as log.txt)

[John Ferrell @jdferrell3]

We haven't confirmed lateral movement, but interesting to see scheduled tasks similar to the "Sapphire Pigeon" tasks on non-Exchange hosts on the same network as a compromised Exchange server.

[John Ferrell @jdferrell3]

Based on Microsoft Defender detections, it appears the attackers using the Exchange vuln are trying to clean up some shells and hide others.

[John Ferrell @jdferrell3]

Not sure what the "Microsoft-Windows-DiskDiagnostic Resolver" scheduled task has to do with TeamViewer, but it was nice enough to clean up all event logs after stopping the service! #CyberSecurity

[John Ferrell @jdferrell3]

That's not a log file!

[John Ferrell @jdferrell3]

In the past two months, we've noticed more non-localized Trickbot file names. Anyone know what has changed?

[John Ferrell @jdferrell3]

Attackers used to call PowerShell (in)directly with a single command (using wmic, rundll32, etc.), now they use mshta.exe to read a registry value that contains the PowerShell command. Still looks just as suspicious.

[John Ferrell @jdferrell3]

@Ledtech3 @KyleHanslovan @HuntressLabs In this case, WMI was another way of persisting the payload discussed here: https://t.co/74ilGS835K (both found on the same host). The encoded data in the Google Sheet decoded to a request very similar to the "stage 2" request from the blog.

[John Ferrell @jdferrell3]

What I expected to be a simple payload appended to the end of a LNK file turned out to be much more. https://t.co/74ilGS835K

[John Ferrell @jdferrell3]

I noticed a few odd looking scheduled tasks where the command was something like "c:\users\john". Combining the task's command and args gives a full path, which Windows will run (on 2 of 3 versions I tested). Unfortunately Autoruns only shows the command. https://t.co/Dtn6y6Cl9A

[John Ferrell @jdferrell3]

Interesting variation on the normal PowerShell...RegRead() commands we normally see. Unfortunately the LNK file wasn't present.

[Amna @AmnaKMoon]

Wanna know how to take a malicious .NET application apart? Check out this blog written by @jdferrell3 from @HuntressLabs. Great read specifically for those who love to see how layers upon layers of obfuscated malware can be torn apart.
https://t.co/wVXiZhNaaU

[Chris Bisnett @chrisbisnett]

Look out for this one. Luckily it's pretty easy to find. #malware #huntress https://t.co/cfiZGcBShE

[Huntress @HuntressLabs]

Demo day, game on. @MACH37cyber

[Huntress @HuntressLabs]

When executed w/elevated privileges, GlassRAT hijacks binary path of "unused" Services for #persistence. #DFIR

[John Ferrell @jdferrell3]

@focusatwill The Oct Beta is great!