For those with access to a SIEM with email headers, things to watch with email campaigns like emotet:
Patterns in:
Message-ID
X-Mailer
URLs in message body
Filenames
Sender host IP/Domain
Obvious sender spoof attempts
@Kostastsale https://t.co/r7o2ArPMg0 has also been helpful knowing which specific RMMs are being actively abused is really helpful when lolrmm has ~200 RMMs
@redcanary I am seeing similar activity to your https://t.co/7WMo924gqt from last May.
Changed from support.onli-ne[.]com to support.dwnload[.]online
Then: ps.c-0[.]uk/in.mp3
This is taking screenshots of the user's device and sending to dll[.]lat. I am seeing 502 right now.
Another active campaign by Vietnamese 🇻🇳 threat actors targeting content creators and advertisers among others.
⛓️ @Facebook Ad > @Google Sites > @Dropbox download > protected .zip > .msi > .bat > load Chrome extension with ai[.]google > steal data from Facebook +Business accounts 💵
Exfiltration to: managedkv[.]com
FB profile: /web.facebook.com/Marketing.GoogleAI
Google Site: /sites.google.com/view/g-aimarketing/ad
Apparently someone monitors connections as they take down profiles and websites when they detect something suspicious 😏
H/T @milannshrestga
[+] Setup.msi: https://t.co/4EEhnhxGeJ
[+] background.js: https://t.co/F2dP0IlJEv
[+] setup.bat: https://t.co/J1ajYXaNnm
REF: https://t.co/j6yiNsvzGx
#TA505 really does not care too much. Their domain hxxps://binance-cloud[.]com is delivering payloads for months now and it's still up.
hxxps://binance-cloud[.]com/pload/ => HVNC variant
hxxps://binance-cloud[.]com/ldr/ => Their Loader
🧵1/4
@killamjr from @redcanary is gonna talk about the basics of "thrunting" otherwise known as threat hunting, or the process of searching for "unknown evil" that your existing alerts may be missing at #hackspacecon
Get your tix now!
https://t.co/EQZUVCxmAs
https://t.co/KmdQ6xC6GH
Well, I didn't expect to be greeted like this by a C2, this gets fun.
Hashes
- SHA-1: 54d9da90371592843a59917a17be59cd9b961ae1
- SHA-256: 8fce1d24cf952528169f473b9462724482511615ed31165710e5e3a74cefdd02
C2 URIs
- /registrauser.php
- /license.txt