Tal Darsan

[Cato CTRL @CatoCTRL]

🚨 Cato CTRL threat alert: our MDR team has detected new Havoc C2 infrastructure.
IOCs
Domains:
alfmarcussen[.]com
aboutdolcera[.]com
amaswellybmi[.]com
dyg465g[.]com
images[.]shopby[.]jp
bowless[.]com
belecoins[.]com
handicraftai[.]com
adventent[.]com
allowcentral[.]com
betropol337[.]com
#C2 #ThreatIntel #Havoc

[Cato CTRL @CatoCTRL]

🚨Cato CTRL threat alert: our MDR team has detected Linux XMRig sample.
IOCs
URL: http://154[.]46[.]30[.]57/f/.b0s
Hash: c9bf07fc4b9b23e1471204067f110d6cf959471a590f69a36bb7737cf7b2996c
#XMRig #c2 #Miner #Crypto

[Cato CTRL @CatoCTRL]

🚨 Cato CTRL threat alert: our MDR team has detected new JSCEAL C2 domains.
IOCs
Domains: unitedgroupvision[.]com, brightlinenord[.]net
More info: https://t.co/AW9qBuYI5H
#JSCEAL #C2 #ThreatIntel

[Cato CTRL @CatoCTRL]

🚨Cato CTRL threat alert: our MDR team has detected new EvilAI samples.
IOCs
Domains: myeditorpdf[.]com, docflares[.]com, cleareditpdf[.]com
#EvilAI #C2 #ThreatIntel #FakePDF #SparkOnSoft

[Cato CTRL @CatoCTRL]

🚨Cato CTRL threat alert: our MDR team has detected ValleyRAT targeting Vietnamese victims.

IOCs
URL: https://fg41[.]dlfl[.]vn/44c1fb6bfbda5a8403cb/6135615923956141674
Hash: 8033e6603938a1167ef28a84f39d63ee16b5620bf979f6fc950fd69fef275783

#ValleyRAT #c2 #SilverFox #APT

[Cato CTRL @CatoCTRL]

🚨 Cato MDR Alert: We’ve detected a malicious domain being used to download the Oyster backdoor disguised as Putty.

Below are the IoCs. 👇🧵

#ThreatIntel #Oyster #Putty #backdoor

[Cato CTRL @CatoCTRL]

🚨 Cato MDR Alert: We’ve detected malicious IP addresses being used to download AdaptixC2 and Mirai.

Below are the IoCs. 👇🧵

#ThreatIntel #AdaptixC2 #Mirai

[Cato CTRL @CatoCTRL]

We’ve uncovered an evolving #LummaStealer campaign leveraging Tigris, Oracle Cloud Infrastructure, and Scaleway – with activity linked to suspected Russian threat actors.
Full details: https://t.co/S2m6MvXgJU
#ThreatResearch

[Cato CTRL @CatoCTRL]

🚨 Cato MDR Alert: We’ve spotted an Office 365 #phishing campaign fronted by Cloudflare.

Key IoCs :

▪️ Phishing landing page: https://t.co/Nna7uEZ5nd (VT 0/94)

▪️ Drop zone: https://t.co/mxtKWLrufs (VT 0/94)

#ThreatIntel #O365

[Cato CTRL @CatoCTRL]

🚨 Cato MDR Alert: We’ve detected a malicious IP address being used to download Quasar RAT, MeshAgent, and Defender Control via cURL.

Key IoCs, URLs and hashes in the thread below. 🧵👇

#ThreatIntel #QuasarRAT #MeshAgent #DefenderControl

[Cato CTRL @CatoCTRL]

🚨 Cato MDR Alert: We’ve observed an Office 365 #phishing campaign using Cloudflare.

Key IoCs:

▪️Phishing landing page: https://t.co/fUcDiqZ639 (VT: 1/97)

▪️Drop zone: https://t.co/hlMRng9xzs (VT: 0/94)

Stay alert!

#ThreatIntel #O365

[Limor Kessem, CISM, C|ISO @iCyberFighter]

Want some technical details on #GozNym? Check out the full blog post: https://t.co/fxCy2ykCT1 | #Nymaim #malware #Trojan #GoziISFB

[abuse.ch @abuse_ch]

Busy coding weekend, get ready for a new tracker!

[Tal Darsan @taldars]

Thanks @assolini! I'll answer on PM

[IBM Security @IBMSecurity]

Attending @RSAConference in Singapore this week? See @georgetubin & @taldars discuss the migration of #malware 7/23 http://t.co/ppe3qu0LXK

[Tal Darsan @taldars]

@taldars

[Tal Darsan @taldars]

seem that #Kovter adopted the same persistence technique as #Gootkit and #Poweliks using mshta.exe and powershell | #Trojan #Malware

[Denis Laskov 🇮🇱 @it4sec]

[BLOG] "Tsukuba: Banking Trojan Phishing in Japanese Waters" http://t.co/0dSlibwSpA by @daniav09 and @iCyberFighter
#cybercrime

[Limor Kessem, CISM, C|ISO @iCyberFighter]

New POS Trojan #LogPOS uses Microsoft Mailslots to exfiltrate payment card numbers: http://t.co/q3iB3Senhc | #cybercrime #cardfraud #malware

[Tal Darsan @taldars]

Tsukuba: Banking Trojan Phishing in Japanese Waters: http://t.co/RkAaz3bmrF via @ibmsecurity