MalwareIntelligence

...

[Pistus @jorgemieres]

🤚#Chronus Team ya no es solo amenaza pública en Argentina. La materialización de presuntas filtraciones vinculadas a organismos argentinos no valida todos los claims, pero sí... 👇

https://t.co/KK4BFeq7UQ

#ThreatIntelligence #Hacktivism #CyberRisk #Argentina #iQBlack

[Pistus @jorgemieres]

🤚Chronus Team is no longer just a public threat narrative in Argentina.

The materialization of alleged leaks tied to Argentine institutions does not validate every claim, but... 👇

https://t.co/pgWr7oFrMG

#ThreatIntelligence #Hacktivism #CyberRisk #OSINT #Argentina #iQBlack

[Pistus @jorgemieres]

✅ #Moloch
#Automated #VersionControl #Library for #Python

I'm currently using it internally but I have decided to release it. It's a pre-release version but maybe it can be useful for you too, as it's for me. 😉

https://t.co/HVUQL2zS7q

[Pistus @jorgemieres]

Modern Asian #APT groups: #tactics, #techniques and #procedures (#TTPs) ↔️ https://t.co/UaCLHlj1dp ⬇️

"The #samples observed in the described #incidents were also observed by us in other countries, including #Canada, #Vietnam, #SouthAfrica, and #Japan..."

[Pistus @jorgemieres]

➡️ #Chinese #APT Targeting #Cambodian Government ↔️ https://t.co/munridMsMF

➡️ "...total of 24 Cambodian government organizations regularly communicating with this infrastructure between September and October 2023."

[Pistus @jorgemieres]

🪝Mysterious #Werewolf #Attacks #Russian Electronic Industry Through #Vulnerability in #WinRAR⬇️

"...impersonated the #MinistryOfIndustry & Trade of the #Russian..."

➡️ #Spearphishing
➡️ Pismo_izveshcanie_2023_10_16.rar
➡️ CVE-2023-38831

in Russian ➡️ https://t.co/ceoMiVtgD7

[Pistus @jorgemieres]

🙋‍♂️ According to the #hacking group #Threatsec, are responsible for #unauthorized #intrusion (2 days ago) of https://t.co/02ttIqCCfs. An #Argentina province.

➡️ 810 #leaked files in 2 parts of 621.8 mb each.
➡️ #Police documents.
➡️ #Financial data and records.

[Pistus @jorgemieres]

🙋‍♂️ Update! The cyber part of #Israel #Hamas complict 📷
@Cyberknow20
📷 This is a very good job of monitoring the involved, on one side and the other, in the conflict. #ısraelpalestinewar #Israel #Palestine #hamas #cyberterrorism #terrorism #hacktivism

[Pistus @jorgemieres]

#LDAP authentication in #ActiveDirectory environments by @AlmondOffSec ⬇️

➡️ "Understanding the different types of LDAP authentication methods is fundamental to apprehend subjects such as relay #attacks or #countermeasures."

➡️LDAP #RFC ➡️ https://t.co/55fAPEw8HI

[Pistus @jorgemieres]

➡️ #LateralMovement: Abuse the Power of #DCOM #Excel Application by Raj Patel ➡�� https://t.co/d740DhPHvK

"...we will talk about an interesting lateral movement technique called ActivateMicrosoftApp() method within the..."

#InfoSec #Malware #APT #NetworkSecurity #NetworkProtocol

[Pistus @jorgemieres]

➡️ "Your armies will sink".

This sentence we can read in a new #visualthreat disseminated by the #propaganda medium of the #Islamic group -#Yemen- known as #Houthi (or #AnsarAllah = "#SupportersOfGod"); in the context of the #attack against the #Israel's navy in the Red Sea.

[Pistus @jorgemieres]

New update of #AlQassamMedia, the APP released by #KassamBrigades (#IQB) ⬇️

➡️ D8496E2DB55EAFEB5473613AD7869CF9

[Pistus @jorgemieres]

➡️from compromised legitimate email
➡️to addressed recipient
➡️personalized subject with the name of the potential victim

🪲ARCHIVO_MAIL_PDF.[NUMBER].zip
551464A0ED0289846487EE2E42306DA0
ABA1C2915B2B460A6B06028F08402C19
MAIL_PDF653bd.msi #Mekotio
D134A576D77F33876E5ADB2060A32C5B

[Pistus @jorgemieres]

🙋‍♂️#SpearPhishing campaign targeting users of the Federal Administration of Public Revenue (aka #AFIP) of Argentina. Spreads #banking #trojan #Mekotio

➡️akzkar-otdxzwqz6a-uc[.a.run.app🪝
➡️34.173.253.]92
➡️180.169.136.34.bc[.googleusercontent.com/EMKT_CURSO_775-5693/47940.024665/

[Pistus @jorgemieres]

The current #IslamicState (aka #ISIS) continues the dissemination of "war" #propaganda through its official newspaper #AlNaba. On this occasion the number 413.

Among other things, this edition presents, as usual, an infographic with "results of attacks by Islamic State soldiers"

[Pistus @jorgemieres]

Under the sentence "Our longing has lasted so long that the time for revenge has come", #IQB (Izz al-Din al-#QassamBrigades or simply #KassamBrigades) has disseminated a new #visualthreat focused on a #psychologicalaction strategy through social networks.

#IsraelHamasWar #Hamas

[Pistus @jorgemieres]

Clever malvertising attack uses #Punycode to look like #KeePass's official website ↔️ https://t.co/dGomnXtyRl

➡️"...the destination site uses Punycode, a special encoding to convert Unicode characters to ASCII."

🪝xn--eepass-vbb[]info
🪲 5923a2a196d835bd65f89791c5fbb1d4787d9b8c

[Pistus @jorgemieres]

¿? ➡️ smoke 😜

"#GhostStealer. The #stealer cousin of #GhostLocker" ↔️ "$99.99 USD for a lifetime license"

🙋‍♂️ but another #threat in that poor scenario🤦‍♂️

[Pistus @jorgemieres]

Another #VisualThreat disseminated by the #propaganda apparatus of the Izz al-Din al-#Qassam_Brigades (#IQB), the armed apparatus of #Hamas, that copies the #extremist philosophy spread by #ISIS through the spread of visual #threats like this.

It's not wrong to say #HamasisISIS

[Pistus @jorgemieres]

#IQB (Izz al-Din al-#Qassam Brigades), the armed wing of #Hamas, is disseminating a beta #Android APP called #AlQassamMedia.

➡️md5:aee7b88194144a335088ad3087d176b3

According to a basic #analysis, it's free of #MaliciousCode but #Trojanized variants may spread.