mcb

Cyber Security Specialist | DFIR | Malware Analysis | Threat Hunting | Threat Intel
#GREM #GCFE #GNFA #GCFA #GPCS

[Unit 42 @Unit42_Intel]

Attackers are leveraging over 500 newly registered .shop domains, likely generated via DGA, to launch #phishing campaigns impersonating Microsoft login pages. Domain infrastructure changes post-registration. Details at: https://t.co/l7uL1n0BgQ

[ANY.RUN @anyrun_app]

Phishing activity in the past 7 days 🐟
Track latest #phishing threats in TI Lookup:
https://t.co/R9q4sx8dFZ

[Microsoft Threat Intelligence @MsftSecIntel]

Silk Typhoon is an espionage-focused Chinese state actor whose activities indicate that they are a well-resourced and technically efficient group with the ability to quickly operationalize exploits for zero-day vulnerabilities in edge devices. https://t.co/1DT3NfRi2O

[SANS DFIR @sansforensics]

🚨 THIS JUST IN: The ultimate #Linux guide is here!

Created by @4enzikat0r & @tazwake this must-have forensic poster is your go-to resource for detecting rootkits, tracking attacker persistence, & analyzing timestamps.

📄 Get your FREE copy! https://t.co/ej87CYkYc7

#DFIR

[David das Neves @david_das_neves]

This is a brilliant repository that demonstrates typical PowerShell Obfuscation techniques.
It should be a #mustKnow reference for every blue teamer.

[Repo] PowerShell Obfuscation Bible
🔗 https://t.co/FKAKHtM4Oa

#CyberSecurity #BlueTeaming #PowerShell

[Will @BushidoToken]

Scottish man linked to hacking group 'Scattered Spider' among five charged in US https://t.co/eS04J02oxC

[Cryptolaemus @Cryptolaemus1]

#BruteRatel - #Latrodectus - .pdf > url > .js > .msi > .dll

wscript.exe Document-v20-19-06.js

msiexec.exe /V

rundll32.exe C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface

(1/3)👇

IOC's
https://t.co/MMBsF4kTqK

[JAMESWT @JAMESWT_WT]

ZIP>SVG>URL>ZIP>PW LOP852>#AsyncRat
⛔️C2
powerupsnew.]dynuddns].com
Drop
⛔️https://i0004.clarodrive.]com/s/siEsdDALjZ665wE/
Samples
❇️https://t.co/lxtwCNzqtD
AnyRun
🔱https://t.co/dp6wLeVJsN

[Josh Kamdjou @jkamdjou]

we're seeing so much docusign abuse @sublime_sec

https://t.co/PCjlppsMIB

[Cybersecurity and Infrastructure Security Agency @CISAgov]

🚀 Big News! We launched CISA Learning, a centralized platform for all things #CyberTraining! With classroom courses, virtual sessions, and self-paced modules, CISA Learning supports our evolving cybersecurity workforce. Learn more: https://t.co/mapQOypTv7

[TrendAI @trendaisecurity]

#INCRansomware evolves rapidly by leveraging vulnerabilities in Netscaler ADC & Gateway for initial access.

Our latest #RansomwareSpotlight provides valuable insights into this evolving threat: https://t.co/Nbobv4W3k6

[Red Canary, a Zscaler company @redcanary]

⚛️ https://t.co/cZhrIXPqRm got a facelift! Our new #AtomicRedTeam testing interface features improved search and filtering, easier test execution, and more!

📽️ Here's a guided tour: https://t.co/hgdLbFOGFZ

[Red Canary, a Zscaler company @redcanary]

NEW: Google Chrome's new application-bound encryption has shifted the stealer landscape, forcing malware authors to implement new features to bypass the control and steal cookies. https://t.co/AHsvhwNlt7

[FalconFeeds.io @FalconFeedsio]

🚨 RansomHub Ransomware Alert 🚨

RansomHub #ransomware group has added 9 new victims to their #darkweb portal.

- Lighthouse Electric Inc 🇺🇸
- TETCO Group 🇱🇧
- Oldcastle BuildingEnvelope 🇺🇸
- Rosito Bisani Imports 🇺🇸
- Tigre Municipality 🇦🇷
- Urban Alternatives 🇺🇸
- Fat Boys Fleet & Auto 🇺🇸
- SYM Motor Global 🇹🇼
- Federico Santa Maria Technical University 🇨🇱

#USA #Lebanon
#Argentina #Taiwan #Chile
#RansomHub #cti #cyberattack #databreach #Infosec

[The Hacker News @TheHackersNews]

🚨 SaaS Misconfigurations Are a Major Threat!

With so many apps and integrations, the risk of data breaches has never been higher. Here are 5 common misconfigurations you need to address NOW!

Read: https://t.co/fas5A5eljq

#SaaSSecurity #DataProtection

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

Sophos detailed to me its 5-year cat-and-mouse game with Chinese hackers repeatedly exploiting its firewalls. The company resorted to installing spy "implants" on devices the hackers were testing on—tracing them to a university and contractor in Chengdu. https://t.co/L75jQS71dN

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

A new piece of information I came across in this reporting: @zachxbt and other investigators were able to recover $12 million of the $15 million Caesar's paid to the Scattered Spider ransomware group last year.

That's very likely the biggest-ever clawback of a ransom payment.

[Red Canary, a Zscaler company @redcanary]

ChromeLoader and SocGholish remained our top threats in September, but a new technique stood out, tricking users into copying a PowerShell script, pasting it into Windows Run, and executing malicious code that leads to LummaC2: https://t.co/4yJGznAsBR

[Hackmanac @H4ckmanac]

🚨Cyberattack Alert ‼️

🇲🇽Mexico - Grupo Aeroportuario del Centro Norte (OMA)

RansomHub ransomware group claims responsibility for the attack on Grupo Aeroportuario del Centro Norte (OMA).

Allegedly, exfiltrated data includes investment reports, financial documents, sales and accounting data, and shareholder information. Personal information of investors, client lists, assessments, agreements, and personal data of employees and customers—such as addresses, contacts, passport scans, confidential internal correspondence, passwords, credentials, and SQL databases—were also compromised.

Additionally, the group makes bold claims, stating they have evidence of some employees collaborating with cartels.

Ransom deadline: 2nd Nov 2024.

[The Hacker News @TheHackersNews]

A new advanced Qilin #ransomware variant, Qilin.B, features enhanced AES-256-CTR and RSA-4096 encryption, making recovery nearly impossible without the attackers' keys.

Read → https://t.co/ljA8lZfTRG

#malware #infosec