Roy Halevi

CTO at @IntezerLabs

[Nicole @NicoleFishi19]

[1/] In joint research with @crimevader from @Solis Security, we uncovered two zero-day exploits in the VeraCore application actively used by XE Group: an Upload Validation Bypass and an SQL Injection flaw.

[Nicole @NicoleFishi19]

This week, I investigated an active campaign targeting Chinese-speaking users. Seeing China, Taiwan, and Hong Kong as targets instantly piqued my curiosity. The attack has been attributed to the Silver Fox APT.

Several things in this campaign caught my attention. 🧵

[Nicole @NicoleFishi19]

1/2 The IMEEX framework is a newly discovered malware targeting Windows systems, specifically aimed at Djibouti. Delivered as a 64-bit DLL, it enables file manipulation, process control, registry changes, and remote command execution.

[Nicole @NicoleFishi19]

Thanks to the @virusbtn Conference for a great event! It was an honor to present with @juanandres_gs and @MhicRoibin
and share insights about reversing Rust and uncovering APTs with everyone.

[Intezer @IntezerLabs]

🚀 Big News from Intezer! 🚀
We’ve raised $33M in new funding (led by @norwestvp) to continue transforming security operations with our AI-powered Autonomous SOC platform! Check out our blog post: https://t.co/lHiBhc2L3I

[Intezer @IntezerLabs]

🔍 MSI files are often exploited by threat actors. Our new blog breaks down the MSI format and shows you how to detect and extract malicious payloads. For more details: https://t.co/TCrWGSRMmC

[Intezer @IntezerLabs]

Unpacking SSLoad: A #Rust loader with diverse delivery methods, new elusive loaders, implementation of dead-drop sites, multiple string decryption, and anti-debugging techniques.

Dive into our detailed analysis of its loaders and payloads:
https://t.co/kEKywWAPsm

[Nicole @NicoleFishi19]

Dissecting a new #Rust loader - SSLoad. Initially reported by @Unit42_Intel. The infection chain begins with a phishing email, consists of multiple stages, and implements various techniques. A technical analysis 🧵 [1/]

[Intezer @IntezerLabs]

In this #new blog, our research team unpacks the complexities of .NET executables, offering insights into its architecture and framework.
https://t.co/Fa0gpFje2o [1]

[Intezer @IntezerLabs]

New blog about Operation HamsaUpdate from our research team:

A sophisticated campaign involving a social engineering phishing scheme that delivers novel wipers, targeting Linux and Windows and a multi-stage loader.

Full blog for details here 👇 https://t.co/vQybSASX1x

[Intezer @IntezerLabs]

Our researchers have uncovered an APT we dubbed "WildCard." Originating from the #SysJoker lineage, the novel RustDown malware showcases sophisticated methodologies and is linked to Operation ElectricPowder, signaling a targeted offensive against Israel's critical infrastructures

[Nicole @NicoleFishi19]

Unveiling APT WildCard. Emerging from SysJoker shadows, this APT now wields complex Rust malware - RustDown. Its link to Operation ElectricPowder signifies ~7 years of adaptive and persistent targeting of Israel's critical systems
🧵Technical deep-dive on WildCard [1/9]:

[0xor0ne @0xor0ne]

Quick series on malware reverse engineering for beginners by @IntezerLabs

Part 1: https://t.co/tBYUcvO57g
Part 2: https://t.co/dbs4yVr2L5

#malware #infosec

[Intezer @IntezerLabs]

[1/3] A document with macros has surfaced, seemingly targeting residents in Nagorno-Karabakh. The ultimate payload is AsyncRAT. The lure employs the theme of the ongoing tensions between Armenia and Azerbaijan, posing as if sent by the National Security Service of Armenia.

[Intezer @IntezerLabs]

1/6 ⚡📨 A Much Less Annoying Way to Manage Reported Phishing Emails 🧵

So you need to monitor a phishing inbox or other user-reported phishing pipeline? You want a way to automatically investigate attachments, URLs, metadata, and the email content itself.

[Intezer @IntezerLabs]

ICYMI: Intezer's researchers, Nicole Fishbein and Ryan Robinson, have released their latest blog post which delves into the world of encryption and malware. The post discusses how to detect and protect yourself and your organization. Read more about it: https://t.co/HCoGX1vk56

[Nicole @NicoleFishi19]

#phishing
@bookingcom's chat (connecting clients and property owners) is exploited by scammers. Disguised as the property, they weave convincing messages urging victims to click a link. The outcome? Exposing additional card info.

https://booking.guest-approve[.]info/reservation

[Roy Halevi @royhalevi]

Diving into the core concepts of encryption and its role in malware. Big shoutout to @MhicRoibin & @NicoleFishi19!

[Intezer @IntezerLabs]

New blog on malware reverse engineering, spotlighting encryption usage in malicious software.
Learn the core concepts of encryption and how to identify common algorithms (RC4, AES, etc.).
Check out the blog by researchers @MhicRoibin & @NicoleFishi19
https://t.co/HCoGX1vk56

[Intezer @IntezerLabs]

Exciting news: We're opening up a waitlist for our upcoming AI Insights!

This further expands Intezer's capabilities for alert triage, using generative AI to analyze text-based threats like scripts, macros, and phishing threats.

Join the waitlist here: https://t.co/Jlx4CyGi8R

[Intezer @IntezerLabs]

We uncovered new samples and techniques used by CryptoClippy, a trojan targeting Brazilian financial services evolving fast. This threat has evolved with new stealing capabilities. Check out our blog by @NicoleFishi19 for its technical analysis. https://t.co/sCyeZ1BkS6