Joe Morales

Threat Intel | Threat Hunting | DFIR |

[Joe Morales @mojoesec]

@jamieantisocial @matthewdunwoody @ItsReallyNick Same here!

[Joe Morales @mojoesec]

#SocGholish/#FakeUpdates C2:

147.45.78[.]168
*.location[.]oysterfloats[.]us

[Joe Morales @mojoesec]

#SocGholish/#FakeUpdates C2:

45.88.186[.]159
*.demo[.]betterbuiltdogs[.]com 🐶

[Joe Morales @mojoesec]

#SocGholish/#FakeUpdates C2:

23.137.253[.]76
*.pool[.]hjdeboer[.]com

[The DFIR Report @TheDFIRReport]

From OneNote to RansomNote: An Ice Cold Intrusion

🌟Analysis & reporting completed by @iiamaleks, @IrishD34TH, and @Miixxedup

🎵Audio (New Voice!): Available on Spotify, Apple, YouTube and more!

🏹Services: https://t.co/k8UVEOdKTQ

📚Report: https://t.co/Ll3pwfh9fp

[Joe Morales @mojoesec]

#SocGholish/#FakeUpdates C2:

193.26.115[.]181
*.schedule[.]golfballnutz[.]com

[Joe Morales @mojoesec]

another #Darkgate c2
madeyourbackup[.]com

[Cryptolaemus @Cryptolaemus1]

distro
file://170.130.55.]130/share
https://ingatecsus.]com.]br
http://backupitfirst.]com
http://withupdate.]com

c2's
158.220.95.214:5243
64.23.199.206:1194
172.232.208.90:2223
213.199.41.33:13721
194.233.91.144:5000
158.220.95.215:5242
84.247.157.112:13783

[Joe Morales @mojoesec]

BLOCK IT #SocGholish/#FakeUpdates C2:

23.184.48[.]90
*.round[.]fishingreelinvestment[.]com

[The DFIR Report @TheDFIRReport]

SEO Poisoning to Domain Control: The Gootloader Saga Continues

🌟Analysis and reporting completed by @_pete_0, @malforsec & @r3nzsec

🎵Audio: Available on Spotify, Apple, YouTube and more!

🏹Services: https://t.co/k8UVEOdKTQ

📚Report: https://t.co/Jk1LFE046i

[Joe Morales @mojoesec]

Additional infrastructure we suspect to be related to C2 address 92.118.112[.]208, used by the proxy client dropped following #SocGholish infection:

173.44.141[.]226
23.227.193[.]172
194.36.209[.]227
92.118.112[.]143

[ReliaQuest @ReliaQuest]

ReliaQuest #ThreatResearch has uncovered a new twist in SocGholish malware attacks. Now using Python for persistence, this threat signifies a tactical shift for attackers. Read the blog to protect your systems with the latest intelligence.
https://t.co/6teRrZiE9N

[Joe Morales @mojoesec]

#SocGholish/#FakeUpdates C2:

66.135.17[.]87
*.novelty[.]akibacreative[.]com

[Joe Morales @mojoesec]

#SocGholish/#FakeUpdates C2:

23.146.184[.]23
*.result[.]garrettcountygranfondo[.]org

[Joe Morales @mojoesec]

#CobaltStrike likely tied to the same actor

frentred[.]com
45.155.249.224

[Unit 42 @Unit42_Intel]

2023-10-17 (Tuesday): #TA577 #Pikabot infection with HTTPS #CobaltStrike traffic on 45.155.249[.]171:443 using ponturded[.]com. Thanks to the @Cryptolaemus1 group for their initial post on today's Pikabot activity! IOCs from our infection run available at https://t.co/G56aXbifCR

[The DFIR Report @TheDFIRReport]

From ScreenConnect to Hive Ransomware in 61 hours

➡️Initial Access: ScreenConnect
➡️Defense Evasion: BITS Jobs, Embedded Payloads
➡️Lateral Movement: Impacket, RDP, SMB
➡️C2: ScreenConnect, Atera, Splashtop, Cobalt Strike, Metasploit
➡️Exfil: Rclone

https://t.co/0rOKnoHnbR

1/X

[Caroline @kirbytypes]

Another lil blog by yours truly about a handful of macOS infostealers https://t.co/RCKTBLqdlS

[The DFIR Report @TheDFIRReport]

HTML Smuggling Leads to Domain Wide Ransomware

➡️Initial Access: Thread-Hijacked Email > HTML Attachment
➡️Credentials: LSASS Access, SessionGopher
➡️Lateral Movement: RDP, PsExec
➡️C2: IcedID, Cobalt Strike
➡️Impact: Nokoyawa Ransomware

https://t.co/ncnD7VdKDI

1/X

[Caroline @kirbytypes]

Check out my first blog contribution here where we discuss a recent intrusion my team investigated, from an initial access Gootloader infection, 2nd stage payloads, and lateral movement to credential access. Super proud of this! https://t.co/aIcctOQpW3

[The DFIR Report @TheDFIRReport]

A Truly Graceful Wipe Out

➡️Initial Access: Email > TDS > Truebot download
➡️Credentials: LSASS & Registry Dump
➡️Persistence: Scheduled Task
➡️C2: Truebot, FlawedGrace, Cobalt Strike
➡️Exfiltration: FlawedGrace
➡️Impact: MBR Killer

https://t.co/qcAYmPmSPB

1/X

[Joe Morales @mojoesec]

#SocGholish/#FakeUpdates C2:

89.208.107[.]39
*.accounting[.]bridgemastersllc[.]com

[The DFIR Report @TheDFIRReport]

IcedID Macro Ends in Nokoyawa Ransomware

➡️Initial Access: IcedID XLS Macro
➡️Credentials: LSASS, Creds in Files
➡️Persistence: Scheduled Task
➡️Lateral: RDP, SMB, WMI, WinRM, Psexec
➡️C2: IcedID, Cobalt Strike, VNC
➡️Impact: Nokoyawa Ransomware

https://t.co/mcUEFopyvu

1/X