home.social

#batloader — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #batloader, aggregated by home.social.

  1. Malicious advertisement spoofing zooms website⚠️ ​

    Redirects the user to a fake site:
    zoomus.onelink[.]me ->
    zoonn.virtual-meetings.cn[.]com

    Downloads .msix payload and launches it with ms-appinstaller:
    ms-appinstaller:?source=https[:]//scheta[.]site/apps.store/ZoomInstaller.msix

    Drops digitally signed malware "install.exe" (GlobalSign Code Signin)

    Delivers #Batloader payload

    #IOCs
    🔗​ virustotal.com/gui/file/462df2
    🔗​ virustotal.com/gui/file/48aa23

    #malvertising #CTI

  2. Malicious advertisement spoofing zooms website⚠️ ​

    Redirects the user to a fake site:
    zoomus.onelink[.]me ->
    zoonn.virtual-meetings.cn[.]com

    Downloads .msix payload and launches it with ms-appinstaller:
    ms-appinstaller:?source=https[:]//scheta[.]site/apps.store/ZoomInstaller.msix

    Drops digitally signed malware "install.exe" (GlobalSign Code Signin)

    Delivers #Batloader payload

    #IOCs
    🔗​ virustotal.com/gui/file/462df2
    🔗​ virustotal.com/gui/file/48aa23

    #malvertising #CTI

  3. Malicious advertisement spoofing zooms website⚠️ ​

    Redirects the user to a fake site:
    zoomus.onelink[.]me ->
    zoonn.virtual-meetings.cn[.]com

    Downloads .msix payload and launches it with ms-appinstaller:
    ms-appinstaller:?source=https[:]//scheta[.]site/apps.store/ZoomInstaller.msix

    Drops digitally signed malware "install.exe" (GlobalSign Code Signin)

    Delivers #Batloader payload

    #IOCs
    🔗​ virustotal.com/gui/file/462df2
    🔗​ virustotal.com/gui/file/48aa23

    #malvertising #CTI

  4. Malicious advertisement spoofing zooms website⚠️ ​

    Redirects the user to a fake site:
    zoomus.onelink[.]me ->
    zoonn.virtual-meetings.cn[.]com

    Downloads .msix payload and launches it with ms-appinstaller:
    ms-appinstaller:?source=https[:]//scheta[.]site/apps.store/ZoomInstaller.msix

    Drops digitally signed malware "install.exe" (GlobalSign Code Signin)

    Delivers #Batloader payload

    #IOCs
    🔗​ virustotal.com/gui/file/462df2
    🔗​ virustotal.com/gui/file/48aa23

    #malvertising #CTI

  5. Malicious advertisement spoofing zooms website⚠️ ​

    Redirects the user to a fake site:
    zoomus.onelink[.]me ->
    zoonn.virtual-meetings.cn[.]com

    Downloads .msix payload and launches it with ms-appinstaller:
    ms-appinstaller:?source=https[:]//scheta[.]site/apps.store/ZoomInstaller.msix

    Drops digitally signed malware "install.exe" (GlobalSign Code Signin)

    Delivers #Batloader payload

    #IOCs
    🔗​ virustotal.com/gui/file/462df2
    🔗​ virustotal.com/gui/file/48aa23

    #malvertising #CTI

  6. Как вредоносы распространялись через поддельный менеджер паролей KeePass: AsyncRAT, BATLoader

    Приветствую, и снова я начну с вопроса. И достаточно непростого. Пользуетесь ли вы менеджерами паролей и считаете ли вы их полностью безопасными? Скорее всего, мнения читателей на этом моменте разделятся. Кто-то ответит, мол, пользуется блокнотом и ручкой, а кто-то ответит утвердительным «‎да»‎. А к чему этот вопрос? Во-первых, замечу, что абсолютно ничто в нашем мире не может быть полностью безопасным: будь то программное обеспечение, какой-то ресурс или вовсе ваш телефон с тысячей защитных приложений. А во-вторых, менеджеры паролей в последнее время очень и очень часто стали подводить своих клиентов. Об одном таком инциденте и пойдет сегодня речь. Так совсем недавно специалистами из MalwareBytes была обнаружена целая схема фейковых ресурсов , через которые распространялись инфицированные версии приложения KeePass. И совсем не удивительным является тот факт, что эта кампания продвигалась посредством использования GoogleAds (да, это та самая надоедливая реклама, которая появляется при посещении различных сайтов) и SEO Poisoning. Казалось бы, удивительного здесь ничего нет, ведь это далеко не первый случай, когда вредонос распространяется подобным образом. Google, естественно, с этим борется, исправляет уязвимости, но пока что все без толку. Чего, кстати, не скажешь о человеческом факторе, ведь за последние несколько лет большинство пользователей сообразили, что поисковые системы не всегда выдают безопасные результаты из-за чего эффективность подобного метода атаки заметно поубавилась. Но в случае с KeePass произошло кое-что другое. Злоумышленники прибегли к использованию метода Punycode, чтобы сделать вредоносный домен практически идентичным оригинальному. В данном случае хакеры использовали Punycode «xn—eepass-vbb.info», что транслируется в адресной строке, как «ķeepass.info».

    habr.com/ru/companies/first/ar

    #keepass #AsyncRAT #batloader #вредоносы #анализ #дроппер

  7. Как вредоносы распространялись через поддельный менеджер паролей KeePass: AsyncRAT, BATLoader

    Приветствую, и снова я начну с вопроса. И достаточно непростого. Пользуетесь ли вы менеджерами паролей и считаете ли вы их полностью безопасными? Скорее всего, мнения читателей на этом моменте разделятся. Кто-то ответит, мол, пользуется блокнотом и ручкой, а кто-то ответит утвердительным «‎да»‎. А к чему этот вопрос? Во-первых, замечу, что абсолютно ничто в нашем мире не может быть полностью безопасным: будь то программное обеспечение, какой-то ресурс или вовсе ваш телефон с тысячей защитных приложений. А во-вторых, менеджеры паролей в последнее время очень и очень часто стали подводить своих клиентов. Об одном таком инциденте и пойдет сегодня речь. Так совсем недавно специалистами из MalwareBytes была обнаружена целая схема фейковых ресурсов , через которые распространялись инфицированные версии приложения KeePass. И совсем не удивительным является тот факт, что эта кампания продвигалась посредством использования GoogleAds (да, это та самая надоедливая реклама, которая появляется при посещении различных сайтов) и SEO Poisoning. Казалось бы, удивительного здесь ничего нет, ведь это далеко не первый случай, когда вредонос распространяется подобным образом. Google, естественно, с этим борется, исправляет уязвимости, но пока что все без толку. Чего, кстати, не скажешь о человеческом факторе, ведь за последние несколько лет большинство пользователей сообразили, что поисковые системы не всегда выдают безопасные результаты из-за чего эффективность подобного метода атаки заметно поубавилась. Но в случае с KeePass произошло кое-что другое. Злоумышленники прибегли к использованию метода Punycode, чтобы сделать вредоносный домен практически идентичным оригинальному. В данном случае хакеры использовали Punycode «xn—eepass-vbb.info», что транслируется в адресной строке, как «ķeepass.info».

    habr.com/ru/companies/first/ar

    #keepass #AsyncRAT #batloader #вредоносы #анализ #дроппер

  8. 🤖 DanaBot Strikes: Threat actors are misusing Google Ads 🩸

    🦠🔍 Webex Google Ads Malware Alert

    Threat actors are misusing Google Ads to create fake Webex ads that lead users to malware-infested sites. Malwarebytes discovered this scheme, with the perpetrators likely based in Mexico. These deceptive ads, appearing genuine with the official Webex logo and URL, exploit a Google Ad platform loophole to redirect users.

    Clicking the ad takes users to a site that screens out researchers. Targeted users are then led to a malware site. If they download from this site, they get the BatLoader malware, which subsequently installs the DanaBot trojan. DanaBot can steal passwords and provide attackers direct system access.

    For safety, avoid promoted Google Search results and always download from trusted sources.

    📌 Indicators of Compromise

    Cloaking infrastructure

    monoo3at[.]com
    206.71.149[.]46

    Decoy site

    webexadvertisingoffer[.]com
    31.31.196[.]208

    BatLoader

    fugas[.]site/debug/Installer90.2.msi
    2727a418f31e8c0841f8c3e79455067798a1c11c2b83b5c74d2de4fb3476b654

    BatLoader C2

    updatecorporatenetworks[.]ru
    91.199.147[.]226

    DanaBot

    7a1245584c0a12186aa7228c75a319ca7f57e7b0db55c1bd9b8d7f9b397bfac8

    👉 Read the Full Article

    #Cybersecurity #MalwareAnalysis #DanaBot #BatLoader #Infosec #ThreatIntel #Webex

  9. 🤖 DanaBot Strikes: Threat actors are misusing Google Ads 🩸

    🦠🔍 Webex Google Ads Malware Alert

    Threat actors are misusing Google Ads to create fake Webex ads that lead users to malware-infested sites. Malwarebytes discovered this scheme, with the perpetrators likely based in Mexico. These deceptive ads, appearing genuine with the official Webex logo and URL, exploit a Google Ad platform loophole to redirect users.

    Clicking the ad takes users to a site that screens out researchers. Targeted users are then led to a malware site. If they download from this site, they get the BatLoader malware, which subsequently installs the DanaBot trojan. DanaBot can steal passwords and provide attackers direct system access.

    For safety, avoid promoted Google Search results and always download from trusted sources.

    📌 Indicators of Compromise

    Cloaking infrastructure

    monoo3at[.]com
    206.71.149[.]46

    Decoy site

    webexadvertisingoffer[.]com
    31.31.196[.]208

    BatLoader

    fugas[.]site/debug/Installer90.2.msi
    2727a418f31e8c0841f8c3e79455067798a1c11c2b83b5c74d2de4fb3476b654

    BatLoader C2

    updatecorporatenetworks[.]ru
    91.199.147[.]226

    DanaBot

    7a1245584c0a12186aa7228c75a319ca7f57e7b0db55c1bd9b8d7f9b397bfac8

    👉 Read the Full Article

    #Cybersecurity #MalwareAnalysis #DanaBot #BatLoader #Infosec #ThreatIntel #Webex

  10. 🤖 DanaBot Strikes: Threat actors are misusing Google Ads 🩸

    🦠🔍 Webex Google Ads Malware Alert

    Threat actors are misusing Google Ads to create fake Webex ads that lead users to malware-infested sites. Malwarebytes discovered this scheme, with the perpetrators likely based in Mexico. These deceptive ads, appearing genuine with the official Webex logo and URL, exploit a Google Ad platform loophole to redirect users.

    Clicking the ad takes users to a site that screens out researchers. Targeted users are then led to a malware site. If they download from this site, they get the BatLoader malware, which subsequently installs the DanaBot trojan. DanaBot can steal passwords and provide attackers direct system access.

    For safety, avoid promoted Google Search results and always download from trusted sources.

    📌 Indicators of Compromise

    Cloaking infrastructure

    monoo3at[.]com
    206.71.149[.]46

    Decoy site

    webexadvertisingoffer[.]com
    31.31.196[.]208

    BatLoader

    fugas[.]site/debug/Installer90.2.msi
    2727a418f31e8c0841f8c3e79455067798a1c11c2b83b5c74d2de4fb3476b654

    BatLoader C2

    updatecorporatenetworks[.]ru
    91.199.147[.]226

    DanaBot

    7a1245584c0a12186aa7228c75a319ca7f57e7b0db55c1bd9b8d7f9b397bfac8

    👉 Read the Full Article

    #Cybersecurity #MalwareAnalysis #DanaBot #BatLoader #Infosec #ThreatIntel #Webex

  11. 🤖 DanaBot Strikes: Threat actors are misusing Google Ads 🩸

    🦠🔍 Webex Google Ads Malware Alert

    Threat actors are misusing Google Ads to create fake Webex ads that lead users to malware-infested sites. Malwarebytes discovered this scheme, with the perpetrators likely based in Mexico. These deceptive ads, appearing genuine with the official Webex logo and URL, exploit a Google Ad platform loophole to redirect users.

    Clicking the ad takes users to a site that screens out researchers. Targeted users are then led to a malware site. If they download from this site, they get the BatLoader malware, which subsequently installs the DanaBot trojan. DanaBot can steal passwords and provide attackers direct system access.

    For safety, avoid promoted Google Search results and always download from trusted sources.

    📌 Indicators of Compromise

    Cloaking infrastructure

    monoo3at[.]com
    206.71.149[.]46

    Decoy site

    webexadvertisingoffer[.]com
    31.31.196[.]208

    BatLoader

    fugas[.]site/debug/Installer90.2.msi
    2727a418f31e8c0841f8c3e79455067798a1c11c2b83b5c74d2de4fb3476b654

    BatLoader C2

    updatecorporatenetworks[.]ru
    91.199.147[.]226

    DanaBot

    7a1245584c0a12186aa7228c75a319ca7f57e7b0db55c1bd9b8d7f9b397bfac8

    👉 Read the Full Article

    #Cybersecurity #MalwareAnalysis #DanaBot #BatLoader #Infosec #ThreatIntel #Webex

  12. 🤖 DanaBot Strikes: Threat actors are misusing Google Ads 🩸

    🦠🔍 Webex Google Ads Malware Alert

    Threat actors are misusing Google Ads to create fake Webex ads that lead users to malware-infested sites. Malwarebytes discovered this scheme, with the perpetrators likely based in Mexico. These deceptive ads, appearing genuine with the official Webex logo and URL, exploit a Google Ad platform loophole to redirect users.

    Clicking the ad takes users to a site that screens out researchers. Targeted users are then led to a malware site. If they download from this site, they get the BatLoader malware, which subsequently installs the DanaBot trojan. DanaBot can steal passwords and provide attackers direct system access.

    For safety, avoid promoted Google Search results and always download from trusted sources.

    📌 Indicators of Compromise

    Cloaking infrastructure

    monoo3at[.]com
    206.71.149[.]46

    Decoy site

    webexadvertisingoffer[.]com
    31.31.196[.]208

    BatLoader

    fugas[.]site/debug/Installer90.2.msi
    2727a418f31e8c0841f8c3e79455067798a1c11c2b83b5c74d2de4fb3476b654

    BatLoader C2

    updatecorporatenetworks[.]ru
    91.199.147[.]226

    DanaBot

    7a1245584c0a12186aa7228c75a319ca7f57e7b0db55c1bd9b8d7f9b397bfac8

    👉 Read the Full Article

    #Cybersecurity #MalwareAnalysis #DanaBot #BatLoader #Infosec #ThreatIntel #Webex

  13. A malvertising campaign targeting corporate users looking to download Webex has been running for almost a week.

    This blog shares the details: malwarebytes.com/blog/threat-i

    #malvertising #BatLoader #DanaBot

  14. A malvertising campaign targeting corporate users looking to download Webex has been running for almost a week.

    This blog shares the details: malwarebytes.com/blog/threat-i

    #malvertising #BatLoader #DanaBot

  15. A malvertising campaign targeting corporate users looking to download Webex has been running for almost a week.

    This blog shares the details: malwarebytes.com/blog/threat-i

    #malvertising #BatLoader #DanaBot

  16. A malvertising campaign targeting corporate users looking to download Webex has been running for almost a week.

    This blog shares the details: malwarebytes.com/blog/threat-i

    #malvertising #BatLoader #DanaBot

  17. A malvertising campaign targeting corporate users looking to download Webex has been running for almost a week.

    This blog shares the details: malwarebytes.com/blog/threat-i

    #malvertising #BatLoader #DanaBot

  18. Happy Monday folks, I hope you had a restful weekend and managed to take a breather from all things cyber! Time to get back into it though, so let me give you hand - catch up on the week’s infosec news with the latest issue of our newsletter:

    opalsec.substack.com/p/soc-gou

    #Emotet are back and are using…OneNote lures? ISO disk images? Malvertising? Nah – they’re sticking with tier tried and true TTPs – their Red Dawn maldoc template from last year; macro-enabled documents as lures, and null-byte padding to evade automated scanners.

    We’ve highlighted a report on the Xenomorph #Android Banking Trojan, which added support for targeting accounts of over 400 banks; automated bypassing of MFA-protected app logins, and a Session Token stealer module. With capabilities like these becoming the norm, is it time to take a closer look at the threat Mobile Malware could pose to enterprise networks?

    North Korean hackers have demonstrated yet again that they’re tracking and integrating the latest techniques, and investing in malware development. A recent campaign saw eight new pieces of malware distributed throughout the kill chain, leveraging #Microsoft #InTune to deliver payloads and an in-memory dropper to abuse the #BYOVD technique and evade EDR solutions.

    A joint investigation by #Mandiant and #SonicWall has unearthed a two-year campaign by Chinese actors, enabled through exploitation of unpatched SMA100 appliances and delivery of tailored payloads. A critical vulnerability reported by #Fortinet this week helps reinforce the point that perimeter devices need to be patched with urgency, as it’s a well-documented target for Chinese-affiliated actors.

    #HiatusRAT is a novel malware targeting #DrayTek routers, sniffing network traffic and proxying C2 traffic to forward-deployed implants. TTPs employed in recent #BatLoader and #Qakbot campaigns are also worth taking note of, as is #GoBruteforcer, a new malware family targeting specific web server applications to brute force logins and deploy an IRC bot for C2.

    Those in Vulnerability Management should take particular note of the #Veeam vulnerability, which appears trivial to exploit and actually delivers plaintext credentials to the attacker. CISA have also taken note of nearly 40k exploit attempts of a 2 year old code-exec-as-root vulnerability in the #VMWare Cloud Foundation product in the last two months, so make sure you’re patched against it.

    #Redteam members have some excellent reading to look forward to, looking at HTTP request smuggling to harvest AD credentials and persisting with a MitM Exchange server, as well as a detailed post that examines #CobaltStrike’s reflective loading capability;

    The #blueteam has some great tradecraft tips from @inversecos on #Azure DFIR, as well as tools to help scan websites for malicious objects, and to combat the new #Stealc #infostealer and well-established Raccoon Stealer.

    Catch all this and much more in this week's newsletter:

    opalsec.substack.com/p/soc-gou

    #infosec #cyber #news #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #newsletter #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #soc #threatintel #threatintelligence #DarkWeb #mdm #dprk #FortiOS #FortiProxy

  19. Happy Monday folks, I hope you had a restful weekend and managed to take a breather from all things cyber! Time to get back into it though, so let me give you hand - catch up on the week’s infosec news with the latest issue of our newsletter:

    opalsec.substack.com/p/soc-gou

    #Emotet are back and are using…OneNote lures? ISO disk images? Malvertising? Nah – they’re sticking with tier tried and true TTPs – their Red Dawn maldoc template from last year; macro-enabled documents as lures, and null-byte padding to evade automated scanners.

    We’ve highlighted a report on the Xenomorph #Android Banking Trojan, which added support for targeting accounts of over 400 banks; automated bypassing of MFA-protected app logins, and a Session Token stealer module. With capabilities like these becoming the norm, is it time to take a closer look at the threat Mobile Malware could pose to enterprise networks?

    North Korean hackers have demonstrated yet again that they’re tracking and integrating the latest techniques, and investing in malware development. A recent campaign saw eight new pieces of malware distributed throughout the kill chain, leveraging #Microsoft #InTune to deliver payloads and an in-memory dropper to abuse the #BYOVD technique and evade EDR solutions.

    A joint investigation by #Mandiant and #SonicWall has unearthed a two-year campaign by Chinese actors, enabled through exploitation of unpatched SMA100 appliances and delivery of tailored payloads. A critical vulnerability reported by #Fortinet this week helps reinforce the point that perimeter devices need to be patched with urgency, as it’s a well-documented target for Chinese-affiliated actors.

    #HiatusRAT is a novel malware targeting #DrayTek routers, sniffing network traffic and proxying C2 traffic to forward-deployed implants. TTPs employed in recent #BatLoader and #Qakbot campaigns are also worth taking note of, as is #GoBruteforcer, a new malware family targeting specific web server applications to brute force logins and deploy an IRC bot for C2.

    Those in Vulnerability Management should take particular note of the #Veeam vulnerability, which appears trivial to exploit and actually delivers plaintext credentials to the attacker. CISA have also taken note of nearly 40k exploit attempts of a 2 year old code-exec-as-root vulnerability in the #VMWare Cloud Foundation product in the last two months, so make sure you’re patched against it.

    #Redteam members have some excellent reading to look forward to, looking at HTTP request smuggling to harvest AD credentials and persisting with a MitM Exchange server, as well as a detailed post that examines #CobaltStrike’s reflective loading capability;

    The #blueteam has some great tradecraft tips from @inversecos on #Azure DFIR, as well as tools to help scan websites for malicious objects, and to combat the new #Stealc #infostealer and well-established Raccoon Stealer.

    Catch all this and much more in this week's newsletter:

    opalsec.substack.com/p/soc-gou

    #infosec #cyber #news #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #newsletter #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #soc #threatintel #threatintelligence #DarkWeb #mdm #dprk #FortiOS #FortiProxy

  20. Happy Monday folks, I hope you had a restful weekend and managed to take a breather from all things cyber! Time to get back into it though, so let me give you hand - catch up on the week’s infosec news with the latest issue of our newsletter:

    opalsec.substack.com/p/soc-gou

    #Emotet are back and are using…OneNote lures? ISO disk images? Malvertising? Nah – they’re sticking with tier tried and true TTPs – their Red Dawn maldoc template from last year; macro-enabled documents as lures, and null-byte padding to evade automated scanners.

    We’ve highlighted a report on the Xenomorph #Android Banking Trojan, which added support for targeting accounts of over 400 banks; automated bypassing of MFA-protected app logins, and a Session Token stealer module. With capabilities like these becoming the norm, is it time to take a closer look at the threat Mobile Malware could pose to enterprise networks?

    North Korean hackers have demonstrated yet again that they’re tracking and integrating the latest techniques, and investing in malware development. A recent campaign saw eight new pieces of malware distributed throughout the kill chain, leveraging #Microsoft #InTune to deliver payloads and an in-memory dropper to abuse the #BYOVD technique and evade EDR solutions.

    A joint investigation by #Mandiant and #SonicWall has unearthed a two-year campaign by Chinese actors, enabled through exploitation of unpatched SMA100 appliances and delivery of tailored payloads. A critical vulnerability reported by #Fortinet this week helps reinforce the point that perimeter devices need to be patched with urgency, as it’s a well-documented target for Chinese-affiliated actors.

    #HiatusRAT is a novel malware targeting #DrayTek routers, sniffing network traffic and proxying C2 traffic to forward-deployed implants. TTPs employed in recent #BatLoader and #Qakbot campaigns are also worth taking note of, as is #GoBruteforcer, a new malware family targeting specific web server applications to brute force logins and deploy an IRC bot for C2.

    Those in Vulnerability Management should take particular note of the #Veeam vulnerability, which appears trivial to exploit and actually delivers plaintext credentials to the attacker. CISA have also taken note of nearly 40k exploit attempts of a 2 year old code-exec-as-root vulnerability in the #VMWare Cloud Foundation product in the last two months, so make sure you’re patched against it.

    #Redteam members have some excellent reading to look forward to, looking at HTTP request smuggling to harvest AD credentials and persisting with a MitM Exchange server, as well as a detailed post that examines #CobaltStrike’s reflective loading capability;

    The #blueteam has some great tradecraft tips from @inversecos on #Azure DFIR, as well as tools to help scan websites for malicious objects, and to combat the new #Stealc #infostealer and well-established Raccoon Stealer.

    Catch all this and much more in this week's newsletter:

    opalsec.substack.com/p/soc-gou

    #infosec #cyber #news #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #newsletter #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #soc #threatintel #threatintelligence #DarkWeb #mdm #dprk #FortiOS #FortiProxy

  21. Happy Monday folks, I hope you had a restful weekend and managed to take a breather from all things cyber! Time to get back into it though, so let me give you hand - catch up on the week’s infosec news with the latest issue of our newsletter:

    opalsec.substack.com/p/soc-gou

    #Emotet are back and are using…OneNote lures? ISO disk images? Malvertising? Nah – they’re sticking with tier tried and true TTPs – their Red Dawn maldoc template from last year; macro-enabled documents as lures, and null-byte padding to evade automated scanners.

    We’ve highlighted a report on the Xenomorph #Android Banking Trojan, which added support for targeting accounts of over 400 banks; automated bypassing of MFA-protected app logins, and a Session Token stealer module. With capabilities like these becoming the norm, is it time to take a closer look at the threat Mobile Malware could pose to enterprise networks?

    North Korean hackers have demonstrated yet again that they’re tracking and integrating the latest techniques, and investing in malware development. A recent campaign saw eight new pieces of malware distributed throughout the kill chain, leveraging #Microsoft #InTune to deliver payloads and an in-memory dropper to abuse the #BYOVD technique and evade EDR solutions.

    A joint investigation by #Mandiant and #SonicWall has unearthed a two-year campaign by Chinese actors, enabled through exploitation of unpatched SMA100 appliances and delivery of tailored payloads. A critical vulnerability reported by #Fortinet this week helps reinforce the point that perimeter devices need to be patched with urgency, as it’s a well-documented target for Chinese-affiliated actors.

    #HiatusRAT is a novel malware targeting #DrayTek routers, sniffing network traffic and proxying C2 traffic to forward-deployed implants. TTPs employed in recent #BatLoader and #Qakbot campaigns are also worth taking note of, as is #GoBruteforcer, a new malware family targeting specific web server applications to brute force logins and deploy an IRC bot for C2.

    Those in Vulnerability Management should take particular note of the #Veeam vulnerability, which appears trivial to exploit and actually delivers plaintext credentials to the attacker. CISA have also taken note of nearly 40k exploit attempts of a 2 year old code-exec-as-root vulnerability in the #VMWare Cloud Foundation product in the last two months, so make sure you’re patched against it.

    #Redteam members have some excellent reading to look forward to, looking at HTTP request smuggling to harvest AD credentials and persisting with a MitM Exchange server, as well as a detailed post that examines #CobaltStrike’s reflective loading capability;

    The #blueteam has some great tradecraft tips from @inversecos on #Azure DFIR, as well as tools to help scan websites for malicious objects, and to combat the new #Stealc #infostealer and well-established Raccoon Stealer.

    Catch all this and much more in this week's newsletter:

    opalsec.substack.com/p/soc-gou

    #infosec #cyber #news #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #newsletter #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #soc #threatintel #threatintelligence #DarkWeb #mdm #dprk #FortiOS #FortiProxy

  22. Happy Monday folks, I hope you had a restful weekend and managed to take a breather from all things cyber! Time to get back into it though, so let me give you hand - catch up on the week’s infosec news with the latest issue of our newsletter:

    opalsec.substack.com/p/soc-gou

    #Emotet are back and are using…OneNote lures? ISO disk images? Malvertising? Nah – they’re sticking with tier tried and true TTPs – their Red Dawn maldoc template from last year; macro-enabled documents as lures, and null-byte padding to evade automated scanners.

    We’ve highlighted a report on the Xenomorph #Android Banking Trojan, which added support for targeting accounts of over 400 banks; automated bypassing of MFA-protected app logins, and a Session Token stealer module. With capabilities like these becoming the norm, is it time to take a closer look at the threat Mobile Malware could pose to enterprise networks?

    North Korean hackers have demonstrated yet again that they’re tracking and integrating the latest techniques, and investing in malware development. A recent campaign saw eight new pieces of malware distributed throughout the kill chain, leveraging #Microsoft #InTune to deliver payloads and an in-memory dropper to abuse the #BYOVD technique and evade EDR solutions.

    A joint investigation by #Mandiant and #SonicWall has unearthed a two-year campaign by Chinese actors, enabled through exploitation of unpatched SMA100 appliances and delivery of tailored payloads. A critical vulnerability reported by #Fortinet this week helps reinforce the point that perimeter devices need to be patched with urgency, as it’s a well-documented target for Chinese-affiliated actors.

    #HiatusRAT is a novel malware targeting #DrayTek routers, sniffing network traffic and proxying C2 traffic to forward-deployed implants. TTPs employed in recent #BatLoader and #Qakbot campaigns are also worth taking note of, as is #GoBruteforcer, a new malware family targeting specific web server applications to brute force logins and deploy an IRC bot for C2.

    Those in Vulnerability Management should take particular note of the #Veeam vulnerability, which appears trivial to exploit and actually delivers plaintext credentials to the attacker. CISA have also taken note of nearly 40k exploit attempts of a 2 year old code-exec-as-root vulnerability in the #VMWare Cloud Foundation product in the last two months, so make sure you’re patched against it.

    #Redteam members have some excellent reading to look forward to, looking at HTTP request smuggling to harvest AD credentials and persisting with a MitM Exchange server, as well as a detailed post that examines #CobaltStrike’s reflective loading capability;

    The #blueteam has some great tradecraft tips from @inversecos on #Azure DFIR, as well as tools to help scan websites for malicious objects, and to combat the new #Stealc #infostealer and well-established Raccoon Stealer.

    Catch all this and much more in this week's newsletter:

    opalsec.substack.com/p/soc-gou

    #infosec #cyber #news #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #newsletter #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #soc #threatintel #threatintelligence #DarkWeb #mdm #dprk #FortiOS #FortiProxy

  23. New blog post! In this one I look at a #BATLoader MSI sample referenced by @malwrhunterteam which resulted in #Ursnif and #Redline execution. Some fun twists and turns in this. forensicitguy.github.io/batloa

    #malware

  24. New blog post! In this one I look at a #BATLoader MSI sample referenced by @malwrhunterteam which resulted in #Ursnif and #Redline execution. Some fun twists and turns in this. forensicitguy.github.io/batloa

    #malware

  25. New blog post! In this one I look at a #BATLoader MSI sample referenced by @malwrhunterteam which resulted in #Ursnif and #Redline execution. Some fun twists and turns in this. forensicitguy.github.io/batloa

    #malware

  26. New blog post! In this one I look at a #BATLoader MSI sample referenced by @malwrhunterteam which resulted in #Ursnif and #Redline execution. Some fun twists and turns in this. forensicitguy.github.io/batloa

    #malware

  27. New blog post! In this one I look at a #BATLoader MSI sample referenced by @malwrhunterteam which resulted in #Ursnif and #Redline execution. Some fun twists and turns in this. forensicitguy.github.io/batloa

    #malware

  28. Day 7️⃣​​ of #100DaysOfYara: Detecting #Batloader JavaScript malware

    🔗​ github.com/colincowie/100DaysO

    Todays rule was created using samples (from november) mentioned in Trend's new blog post:
    📖​ "trendmicro.com/en_us/research/

    I used the yara count module to help out with the detection!

  29. Day 7️⃣​​ of #100DaysOfYara: Detecting #Batloader JavaScript malware

    🔗​ github.com/colincowie/100DaysO

    Todays rule was created using samples (from november) mentioned in Trend's new blog post:
    📖​ "trendmicro.com/en_us/research/

    I used the yara count module to help out with the detection!

  30. Day 7️⃣​​ of #100DaysOfYara: Detecting #Batloader JavaScript malware

    🔗​ github.com/colincowie/100DaysO

    Todays rule was created using samples (from november) mentioned in Trend's new blog post:
    📖​ "trendmicro.com/en_us/research/

    I used the yara count module to help out with the detection!

  31. Day 7️⃣​​ of #100DaysOfYara: Detecting #Batloader JavaScript malware

    🔗​ github.com/colincowie/100DaysO

    Todays rule was created using samples (from november) mentioned in Trend's new blog post:
    📖​ "trendmicro.com/en_us/research/

    I used the yara count module to help out with the detection!

  32. Day 7️⃣​​ of #100DaysOfYara: Detecting #Batloader JavaScript malware

    🔗​ github.com/colincowie/100DaysO

    Todays rule was created using samples (from november) mentioned in Trend's new blog post:
    📖​ "trendmicro.com/en_us/research/

    I used the yara count module to help out with the detection!