B3rt0

#Cyber hunter with my navigation on and trying to find my next thrill (views expressed are my own) #threatintel #OSINT #malware #infosec #phishing

[GopherCon Europe @gopherconeu]

Spotlight on @joakimkennedy and his talk: The Dark Side of Go: A 2020 Go Malware Round-Up

https://t.co/XUIRrEWVEe
#gopherconEU #golang

[Gage @Circuitous__]

Looks like #PrimitiveBear #Gamaredon using remote template injection

протокол макарони.docx
0db02addc704c71e0260a1132697208c
http://83.166.246[.]59/SGZ2/sought.dot
83.166.246.59

@cyber__sloth @c3rb3ru5d3d53c @h2jazi @JAMESWT_MHT

[Gage @Circuitous__]

#PrimitiveBear #Gamaredon group campaign IOCs. Timely mal docx files with template injection TTPs

Thanks to @cyberyp and @t0001100000
IOCs - https://t.co/9zgNtS9lhF

@Arkbird_SOLG @500mk500 @jorgemieres @h2jazi @ShadowChasing1 @JAMESWT_MHT @c3rb3ru5d3d53c @joakimkennedy

[Gage @Circuitous__]

Possible #Bahamut #APT campaign IOCs. docx dropping rtf containing sct file that modifies tmp file to drop VB exe.
one domain reported on previously by @BlackBerry
thanks to @cyberyp @t0001100000 @iamwinstonm

https://t.co/qQLOltXbvn

@cyber__sloth @Arkbird_SOLG @c3rb3ru5d3d53c

[B3rt0 @rpsanch]

@urlscanio @ely_sec I would recommend using https://t.co/r4tjcfCIYQ{SHA-256} minus brackets for the anyrun search

[Anomali @Anomali]

Today, Anomali Threat Research published a blog detailing how it detected an #Iran-backed #cyber #espionage campaign being conducted by Static Kitten against #Kuwait and the #UAE; with a list of associated #IOC's: https://t.co/FyoREZxulp #threatintelligence #cybersecurity

[ᴘᴀʀᴛʜɪ @cyber__sloth]

#APT #sidewinder gearing up for their campaign with newly registered domains.
gov-pbs[.]net
gov-nadra[.]net
gov-af[.]net
gov-crt[.]net
gov-pmo[.]net. Registered on Late December. @ShadowChasing1 @Arkbird_SOLG @Rmy_Reserve @James_inthe_box @markus_neis

[ᴘᴀʀᴛʜɪ @cyber__sloth]

goglestorage[.]com
gdocshare[.]com
cloud[.]optvers[.]net
gsuiteshare[.]com
cloud-sheet[.]net #APT #dangerouspassword @Arkbird_SOLG @ShadowChasing1 @_re_fox @Rmy_Reserve

[ᴘᴀʀᴛʜɪ @cyber__sloth]

#dangerouspassword #APT C2 & delivery domains. official[.]googleproduct[.]org
addrcheck[.]corecheckmailsrv[.]com
sharesvr[.]net
down[.]privatework[.]buzz
google-clouds[.]com
digitalcurencygroup[.]co
presentonline[.]xyz
msftoffice[.]com
myemail[.]works
fidelitydigitalsassets[.]com

[B3rt0 @rpsanch]

I’ve uploaded some unreported #sunburst #supernova samples I found on VirusTotal to https://t.co/UPJykPswBU and for those interested I’ve also submitted other samples (minus size limited ones) from the IOC list to @mal_share

[B3rt0 @rpsanch]

Checkout and download our latest aggregated, curated list of IOCs from a variety of public sources such as vendor reporting and malware repos
#sunburst #SolarWinds #threatintel

[Anomali @Anomali]

To contribute to the overall effort in response to the #SolarWinds compromise, @Anomali Threat Research has published a publicly-available Threat Bulletin of known #IOCs to help organizations defend against the attack. Visit our blog: https://t.co/ZngPgtfpWa

[B3rt0 @rpsanch]

@likethecoins One of my favs is what else do you about X...it’s in the report! if I had more info I would have included it or wrote a follow-on report

[Gage @Circuitous__]

DocuSign-themed #malxls delivering #ursnif / #gozi #malware

h113198x9.xlsm
bd8e543c53506ca06c085efdb937854a
http://premiumstatics[.]co/con3cti0n.dll
con3cti0n.dll
c8392d93a1f064a53abb61887cad409b
@JAMESWT_MHT
#ThreatIntel #ThreatHunting

[Gage @Circuitous__]

#formbook #malware distributed via #maldoc that exploits #CVE-2017-11882.
INV#2020-000185.docx
6e16c996ef12946d1453ed39b1d71e17
www.reem[.]pro
www.digitalcashteam[.]com
http://103.207.38.170/document.doc
coo.exe
161034a13945eac6eccc0cf5b4f2effc

[Gage @Circuitous__]

#malXLSX exploiting #CVE-2017-11882 to drop what appears to be #agenttesla

MRKRFQPD-1682020.xlsx
cb57e8bab6e835b5c8a41db0429fb9d4
pars-science[.]ir
INTERIORRAWFILE.exe
3fb45dffb8a667262be92cee09cf5311
#malware #ThreatIntel #ThreatHunting

[Joakim Kennedy @joakimkennedy]

#RobbinHood #golang #ransomware: 3ad2dfa916d473848df470bdd0b18968
VT: 7/72
"pdb": C:/Users/User/go/src/Robbinhood7

CC: @VK_Intel, @demonslay335, @malwrhunterteam, @JAMESWT_MHT

[Saudi Incident Responders @SaudiDFIR]

استكمالاً لتغريداتنا القديمة المتعلقة بحملة Bad Tidings والتي تم التغريد عنها مسبقاً في حسابنا ، نرفع لكم ملف تحليلي لأهم المستجدات المتعلقه بها.

https://t.co/nZyVAX0cjO

[Gage @Circuitous__]

Appears to be #AgentTesla delivered via #maldoc exploiting #CVE-2017-11882. #opendir: savemodificationgloballyfromthepinaltypo[.]duckdns[.]org

NEW ORDER NO. SVLG075904.docx
551077ebeb5bc105ffd4b433ed89358a
rb[.]gy
vbc.exe-3a38731d63fc1d7397ea3b7c4bc2c73d

@joakimkennedy @rpsanch

[Joakim Kennedy @joakimkennedy]

#REvil/#Sodinokibi moved to #golang for their #ransomware...? 6eb69acd2ac82be838c8b3d8910b0d70

CC: @malwrhunterteam @demonslay335 @JAMESWT_MHT @VK_Intel

[ᴘᴀʀᴛʜɪ @cyber__sloth]

Possible new #mustangpanda or #reddelta #APT activity. Possibly related to the campaign against Vatican
Hash : cc233b9f02903b91d57ff3b6625c6719
Name: Catholic Bishops call for urgent Cameroon peace talks.exe

@Arkbird_SOLG @cyb3rops @RedDrip7 @ShadowChasing1 @Circuitous__