Suspicious Link

I'm just here for the malware and the memes

[Suspicious Link @killamjr]

For those with access to a SIEM with email headers, things to watch with email campaigns like emotet:
Patterns in:
Message-ID
X-Mailer
URLs in message body
Filenames
Sender host IP/Domain
Obvious sender spoof attempts

[Suspicious Link @killamjr]

@Kostastsale https://t.co/r7o2ArPMg0 has also been helpful knowing which specific RMMs are being actively abused is really helpful when lolrmm has ~200 RMMs

[Suspicious Link @killamjr]

@R4ck4tt4ck @UK_Daniel_Card unfortunately the only options are yes/no/maybe

[SealTeamSecurity @SealTeamSecs]

@redcanary I am seeing similar activity to your https://t.co/7WMo924gqt from last May.
Changed from support.onli-ne[.]com to support.dwnload[.]online
Then: ps.c-0[.]uk/in.mp3
This is taking screenshots of the user's device and sending to dll[.]lat. I am seeing 502 right now.

[Aura @SecurityAura]

[REPOST, TYPO IN IOC]

#MineBridge #IOC

88.119.169.193 (SSH)
194.15.112.147 (SSH) hxxps://virtualsecretaryservices[.]com/online/tunupd.php (SSH config)
2baserec[.]xyz
2baserec2[.]guru

If anyone knows anything about that campaign and/or stealer component, feel free to share :)

[Joe Słowik 🌻 @jfslowik]

#CTI #ThreatIntelligence #Infosec

[Germán Fernández @1ZRR4H]

Another active campaign by Vietnamese 🇻🇳 threat actors targeting content creators and advertisers among others.

⛓️ @Facebook Ad > @Google Sites > @Dropbox download > protected .zip > .msi > .bat > load Chrome extension with ai[.]google > steal data from Facebook +Business accounts 💵

Exfiltration to: managedkv[.]com
FB profile: /web.facebook.com/Marketing.GoogleAI
Google Site: /sites.google.com/view/g-aimarketing/ad

Apparently someone monitors connections as they take down profiles and websites when they detect something suspicious 😏

H/T @milannshrestga

[+] Setup.msi: https://t.co/4EEhnhxGeJ
[+] background.js: https://t.co/F2dP0IlJEv
[+] setup.bat: https://t.co/J1ajYXaNnm
REF: https://t.co/j6yiNsvzGx

[Tony Lambert @ForensicITGuy]

@_JohnHammond I'm absolutely advocating for the name "reMOVEit" based on remediation advice from @killamjr

[BSides Springfield @bsidesspfd]

we have started!! First up is @charlesherring.

[Suspicious Link @killamjr]

Just got through presenting on #thrunting @HackSpaceCon such a great conference
https://t.co/l310gmznqu

[Robert Giczewski @lazy_daemon]

#TA505 really does not care too much. Their domain hxxps://binance-cloud[.]com is delivering payloads for months now and it's still up.
hxxps://binance-cloud[.]com/pload/ => HVNC variant
hxxps://binance-cloud[.]com/ldr/ => Their Loader
🧵1/4

[Suspicious Link @killamjr]

@HackSpaceCon @redcanary

[HackSpaceCon @HackSpaceCon]

@killamjr from @redcanary is gonna talk about the basics of "thrunting" otherwise known as threat hunting, or the process of searching for "unknown evil" that your existing alerts may be missing at #hackspacecon
Get your tix now!
https://t.co/EQZUVCxmAs
https://t.co/KmdQ6xC6GH

[Squiblydoo @SquiblydooBlog]

@0xToxin @ankit_anubhav @Iamdeadlyz @executemalware @pr0xylife @Ledtech3 @JAMESWT_MHT @James_inthe_box @Max_Mal_ @Gi7w0rm @tosscoinwitcher We saw the same TTP behavior yesterday with an American victim but payloads were hosted elsewhere:
hxxps://www.basejumper[.io/info.txt
hxxps://www.basejumper[.io/b.png

C2: nasori.ddnsfree[.com:6666
#3LOSH

https://t.co/8M8xo2SQ6Z

[ps66uk @ps66uk]

@UK_Daniel_Card Always click @killamjr SuspiciousLink

[Suspicious Link @killamjr]

@MicahBabinski Awesome blog, great read

[Suspicious Link @killamjr]

@0xshellc0de did you ever figure out what this was?

[Shell @0xshellc0de]

Well, I didn't expect to be greeted like this by a C2, this gets fun.

Hashes

- SHA-1: 54d9da90371592843a59917a17be59cd9b961ae1
- SHA-256: 8fce1d24cf952528169f473b9462724482511615ed31165710e5e3a74cefdd02

C2 URIs

- /registrauser.php
- /license.txt

[Suspicious Link @killamjr]

@0xCARNAGE

[idclickthat @idclickthat]

Malware @SlackHQ 🤖

/slack-download.net

file here:
/bitbucket.org/slack-files/windows/downloads/SIackSetupWin.iso

https://t.co/12fx6K1iCe

https://t.co/lAlETfOdlx

[Bryce @bryceabdo]

this how ransomware works