#happyhunting — Public Fediverse posts

Happy Monday Everyone!

I usually use this space to share workshops, articles, or insights from the community but today is a little different. I was humbled to see my name listed alongside so many amazing professionals as a nominee for the SANS Institute Difference Makers Award.

This recognition isn’t about me, though. It’s about celebrating the people who push our field forward, make an impact, and inspire others. If someone has made a difference in your journey, I encourage you to take a moment to recognize them.

Nomination form:
https://lnkd.in/dNNeTQKJ

Have a wonderful day, and as always Happy Hunting!

Original Post from Rob T. Lee:
https://www.linkedin.com/posts/leerob_our-core-mission-in-sans-institute-dfir-classes-activity-7372981624734576640-zrwN?utm_source=share&utm_medium=member_desktop&rcm=ACoAABd7OUoBVN750zcbzPTXBcB9nFZcxIiKpRc

Intel 471 Cyborg Security, Now Part of Intel 471
#ThreatIntel #ThreatHunting #ThreatDetection #DFIR #HappyHunting

Happy Monday everyone!

CrowdStrike is reminding us that just because some of us use Macs, doesn't mean we are malware proof! In this case the cybercriminal group dubbed #COOKIESPIDER was deploying their stealer known as #SHAMOS.

Using a combination of malvertising and the #ClickFix technique, the group would trick their victim's into installing the Shamos stealer which leads to it running "host reconnaissance and data collection tasks, including searching for known cryptocurrency-related wallet files and sensitive credential-based files on disk".

As always, take a read for yourself to see all the details I left out! Enjoy and Happy Hunting!

Falcon Platform Prevents COOKIE SPIDER’s SHAMOS Delivery on macOS
https://www.crowdstrike.com/en-us/blog/falcon-prevents-cookie-spider-shamos-delivery-macos/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Wednesday everyone!

#GodRAT is a new remote trojan that is targeting financial institutions as reported by Kaspersky. According to their analysis, GodRAT is based on the #Gh0stRAT codebase and uses steganography to evade detection. It supports additional plugins that are used to explore the victim's systems, deploy browser password stealers, and during the attack they even deployed the #AsyncRAT as a backup to maintain access.

Looking at two password stealer payloads, it can give us some ideas of where to begin a hunt focused on this threat: Both the Chrome and MS Edge password stealer added an executable to the path %ALLUSERSPROFILE%\google\ and named them after the browser they were after ("chrome.exe" and "msedge.exe" respectfully). An interesting hunt would be to look at new executables added to this directory OR hunt for executables that may be masquerading as browser related executables! However you do it, get hunting!

GodRAT – New RAT targeting financial institutions
https://securelist.com/godrat/117119/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #IntelDriveThreatHunting

Happy Monday everyone!

Cisco Talos researchers report on a "malvertising campaign" that involved the #PS1Bot, which is modular and has "several modules delivered to perform a variety of malicious activities on infected systems." It has the capability to capture keystrokes from their victim, conduct reconnaissance and establish persistence.

This campaign involved Search Engine Optimization (SEO) poisoning and/or malvertising where the file name matched the keywords used in this target. The victim received a compressed archive that had a single file named "FULL DOCUMENT" which functioned as the downloader and retrieved the next stage. Powershell modules cam into play later that had the capability to detect which antivirus was being used by the victim, capture screen shots and key strokes, collect wallet information, and gain persistence, which is a pretty creative way of achieving it! But I won't spoil it! Find out for yourself and discover all the other details I left out! Enjoy and Happy Hunting!

Malvertising campaign leads to PS1Bot, a multi-stage malware framework
https://blog.talosintelligence.com/ps1bot-malvertising-campaign/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #inteldriventhreathunting

Happy Friday everyone!

Really thankful for the opportunity to join Arun Warikoo at the SANS Digital Forensics and Incident Response Summit to talk about my passion, Threat Hunting. We focused on how to prioritize a structured-hunt (hypothesis driven) and when to conduct an unstructured, or a data-structured hunt.

A big thank you to Heather Barnhart and Phil Hagen for hosting and providing us the opportunity to speak at the event, it truly was an honor and an unforgettable experience! If you missed it in person or virtually during the event, here it is! Enjoy and Happy Hunting!

Making Sense of the Chaos: When to Conduct Structured and Unstructured Threat Hunts
https://www.youtube.com/watch?v=VAVj1JE6dG0

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Good day everyone!

Somehow I missed this article when it first dropped but at least I found it! The DFIR Report published another great article that involved the #Bumblebee malware as the initial access vector that was installed after a user fell victim to an SEO poisoning campaign. The report states that "the threat actor moved laterally to a domain controller, dumped credentials, installed persistent remote access tools, and exfiltrated data using an SFTP client." The adversary also created two new domain accounts and used one to connect to a domain controller via RDP and dumped the NTDS.dit file using wbadmin.exe.

There are more technical details along with some great queries to use to aid your threat hunting and detection engineering efforts! As always, thank you to the authors for a great report! Happy Hunting!

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #IntelDrivenThreatHunting #HappyHunting #readoftheday

Happy Friday everyone!

Researchers from the FortiCNAPP team, part of FortiGuard Labs identified a new variant of the #Lcryx ransomware called #Lcrypt0rx. The report states that it "is a relatively new VBScript-based ransomware strain first observed in November 2024" and "exhibits several unusual characteristics that suggest it may have been generated using AI." According to the researchers, it currently only targets Windows machines.

Indicators that led the researchers to believe it is AI generated include:
- Function Duplication
- Incorrect Persistence Mechanisms
- Nonexistent Target Paths
- Invalid Ransom Note URL
- Ineffective AV Disabling

These are just a few indicators and the article provides more details about each indicator, but I am not going to spoil the fun! Go and check it out for yourself! Enjoy and Happy Hunting!

Old Miner, New Tricks: H2miner Resurfaces with Lcrypt0rx Ransomware
https://www.fortinet.com/blog/threat-research/old-miner-new-tricks

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #ransomware #AI #artificialintelligence

Good day everyone!

Cisco Talos researchers report on a malware-as-a-service (MaaS) operation that was targeting Ukrainian entities and involved the #Amadey trojan, known for "collecting system information and downloading secondary payloads" and the #Emmenhtal downloader.

Behaviors that are observed in this attack include a BUNCH of powershell activity with obfuscation and dropping a legitimate copy of PuTTY.exe. Looking at the technical details, they also us some URLs that may look legitimate to their targets in Ukraine as they add the value "ukraine2" in the URL. Finally, the attack involved multiple variants of the Emmenhtal downloader that were masquerading as MP4 files.

As usual, I glossed over many of the technical details so you can go enjoy the article without me spoiling it! Thanks to the researchers and authors and Happy Hunting!

MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities
https://lnkd.in/gUisprru

Intel 471 Cyborg Security, Now Part of Intel 471#ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Wednesday everyone!

News broke that #SaltTyphoon gained access to the U.S. National Guard's network "and, among other things, collected its network configuration and its data traffic with its counterparts’ networks in every other US state and at least four US territories, according to a DOD report. This data also included these networks’ administrator credentials and network diagrams—which could be used to facilitate follow-on Salt Typhoon hacks of these units."

I am posting this as situational awareness and I never try to strike fear in the community, so I want to remind everyone of the great resources that exist out there when you want to threat hunt or you are trying to detect activity related to different #APT groups or malware! Check out the article posted below and check the comments for resources I would recommend using to supplement your threat hunting or blue team efforts! Enjoy and Happy Hunting!

DHS Salt Typhoon
https://www.documentcloud.org/documents/25998809-20250611-dhs-salt-typhoon/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone!

Morphisec released an insightful report covering Iranian Cyber Warfare that is targeting the West and other enemies of Iran. The APT involved is #Pay2Key, "an Iranian-backed ransomware-as-as-service (RaaS) operation" that is linked to the Fox Kitten APT group and "closely tied to the well-known #Mimic ransomware."

Normally I call out behaviors and TTPs related but for this report I want to call out the completeness of the report. Not only does it provide more than enough technical details to make actionable in any environment but it also provides a TON of threat intel to support their claims giving the readers and audience an idea if they would be a target or not. It is a great report and I encourage you all to read it! Enjoy and Happy Hunting!

Pay2Key’s Resurgence: Iranian Cyber Warfare Targets the West
https://www.morphisec.com/blog/pay2key-resurgence-iranian-cyber-warfare/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Wednesday everyone!

Elastic Security Labs researchers found a bunch of infostealers being spread by adversaries. In the past we have seen other tools like Brute Ratel and CobaltStrike but this time they decided to use a cracked version of #SHELLTER, another offensive security tool (OST). There are TONS of technical details about the tools they used during the investigation into the tool and what artifacts they found. Interestingly they are also releasing a "dynamic unpacker for binaries protected by SHELLTER. This tool leverages a combination of dynamic and static analysis techniques to automatically extract multiple payload stages from a SHELLTER-protected binary." Thought that was a pretty cool add!

Take a read and get all the important details! Enjoy and Happy Hunting!

Taking SHELLTER: a commercial evasion framework abused in- the- wild
https://www.elastic.co/security-labs/taking-shellter

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Monday everyone and what a way to start it!

I encourage you to read the latest report from The DFIR Report where they document an attack that started with a "password spray attack against an exposed RDP server" and ended in the #RansomHub ransomware strain being deployed in the victim's environment and spread over SMB.

I am going to forgo the brief summary because I truly believe these reports need to be read by you! But a bunch of LOLBINs were leveraged, including PowerShell and Windows Command Shell, of course RDP connections, MimiKatz, the Advanced IP Scanner, and many more! One behavior I will point out is that Persistence was gained by the actors deploying the legitimate RMM tools AteraAgent and Splashtop and then created services to run them!

This is another great example of an extremely thorough report and I hope you enjoy it as much as I do! Enjoy and Happy Hunting!

Hide Your RDP: Password Spray Leads to RansomHub Deployment
https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Wednesday everyone!

I came across this article from Check Point Software's research team where they discuss a malware "prototype" they found that contained prompt injection to trick any LLM that it may be interacting with while it is being analyzed, aptly named Skynet. It attempted to sue the "Ignore all previous instructions" command adding another layer of sandbox evasion but was unsuccessful in this instance. The malware also contained an embedded TOR client which, when executed, can be later used and controlled by accessing the specified ports. After execution the malware component wipes the entire %TEMP%/skynet directory that was created. This was overall a very interesting read and could unfortunately be the first of many malware to attempt this technique. I hope you found this as interesting as I did and Happy Hunting!

In the Wild: Malware Prototype with Embedded Prompt Injection
https://research.checkpoint.com/2025/ai-evasion-prompt-injection/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #llm

Good day everyone!

A little while ago I stumbled across an article from Trend Micro that discussed the #Anubis ransomware and its abilities to act both as a ransomware and a wiper. Now it appears that the group has gained sensitive documents related to Disneyland Paris's plans for new rides and renovations (Anubis X post is in the article). Not trying to fear-monger or anything but it goes to show how these groups will adapt their TTPs and behaviors to get to any organization.

Anubis Ransomware Lists Disneyland Paris as New Victim
https://hackread.com/anubis-ransomware-lists-disneyland-paris-new-victim/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

If this article got you thinking about LOLBINs, take this great information and make it actionable with this Community Hunt Package! It covers the execution of common LOLBINs directly related to discovery activity! Now Get Hunting!

Excessive Windows Discovery and Execution Processes - Potential Malware Installation
https://hunter.cyborgsecurity.io/research/hunt-package/6d1c9f13-e43e-4b52-a443-5799465d573b

#huntoftheday #gethunting #HappyHunting

Happy Wednesday all!

Sometimes its good to take it back to the basics! Cisco Talos shares their insights and trends on adversaries using legitimate tools with nefarious intent! They discuss Living-off-the-land binaries (LOLBINs) and Remote Monitoring and Management (RMM) tools and the impact they can have! Enjoy and Happy hunting!

When legitimate tools go rogue
https://blog.talosintelligence.com/when-legitimate-tools-go-rogue/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone!

Trend Micro provides us insight on a "A new ransomware-as-a-service (RaaS) group has emerged and has been making a name for itself in 2025" named #Anubis. It has been designed to have "more destructive capabilities" that can wipe directories that "severely impact chances of file recovery". Researchers also provide MITRE ATT&CK mapping to help teams make this information actionable, so big thanks to them! Check out the details I missed, enjoy the article, and Happy Hunting!

Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper
https://www.trendmicro.com/en_us/research/25/f/anubis-a-closer-look-at-an-emerging-ransomware.html

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Monday Everyone!

It's that time again! Just pushing this out to the threat hunting community and beyond! If you had a question about threat hunting in the past or currently have one that is burning a hole in your brain, feel free to ask us at Intel 471! We are currently working through the back-log of all the other questions that we have, but feel free to throw yours in the ring and get it featured in a future video! Have a wonderful day and Happy Hunting!

Lee-Git Threat Hunting
https://docs.google.com/forms/d/1fYIKFwNGuwYzl3-ktMa7gRz4Uxl2vOUHbAj2CuiuQ4M/edit

Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Happy Wednesday everyone!

A "fully undetected #infostealer malware sample written in Rust" was identified by Trellix researchers while conducting a proactive hunt! The distribution should not come as any surprise, fraudulent gaming websites! This is not an old tactic and something that I have read about from many vendors (Remember, downloading cracked or "free" games from sites normally means you just aren't paying with money!). In this case, the "game" files were distributed as password-protected rar files which contained the stealer executable with some legitimate game-related files. This is another tactic that is commonly used to "assure" the user that they downloaded something legitimate.

The researchers also discussed the capabilities of the malware and here are just a few:
- It displayed a fake window to the user to fool them into it being a legitimate application.
- It terminates a list of processes, some that relate to browsers.
- Steals passwords, cookies, autofills, and saved credit card information from applications like Discord and Chrome.
- Drops a copy of itself in the \AppData\Roaming directory and saves a .lnkk file in the startup directory for persistence. The attackers link the executable and the .lnkk through registry keys so it can execute the .exe file properly.

Thanks goes to the researchers (who if you want tagged in here let me know!) for the great report and details! I hope you enjoy the read as much as I did and go check out the details I left out, its worth it! Happy Hunting!

Demystifying Myth Stealer: A Rust Based InfoStealer
https://www.trellix.com/en-in/blogs/research/demystifying-myth-stealer-a-rust-based-infostealer/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone!

This is a really interesting read from SentinelOne Labs . Back in October 2024 they dealt with a reconnaissance operation that was related to the activity cluster tracked as #PurpleHaze and then in 2025 "they helped disrupt an intrusion linked to a wider #ShadowPad operation". The activity was attributed to China-nexus threat actors.

The article gives an in-depth view of what it looks like when an organization that is responsible for "IT services and logistics" gets compromised, which we could call a supply-chain attack. The article also provides a TON of technical details about tools and infrastructure that was used, indicators of compromise to scan for in your environment, and behaviors and commands that were observed throughout. This one may take a while to read but its worth it! Thanks to the researchers Dr Aleksandar Milenkoski and Tom Hegel for this report! I hope you all enjoy it as much as I did. Happy Hunting!

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets
https://www.sentinelone.com/labs/follow-the-smoke-china-nexus-threat-actors-hammer-at-the-doors-of-top-tier-targets/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Monday Everyone!

Researchers at Cisco Talos "observed a destructive attack on a critical infrastructure entity within Ukraine, using a previously unknown wiper we are calling “#PathWiper”". The article states "The attack was instrumented via a legitimate endpoint administration framework, indicating that the attackers likely had access to the administrative console, that was then used to issue malicious commands and deploy PathWiper across connected endpoints".

The researchers also provided technical details, some IOCs, capabilities of the wiper, and some hints at behaviors. In this incident a batch (BAT) file was dropped on the compromised machine and ran a command that leveraged WScript.exe to execute a VBScript (uacinstall.vbs) from the C:\Windows\Temp\ directory. After the execution, the PathWiper executable appears in the C:\Windows\Temp\ directory with the name of "sha256sum.exe". So assuming this is how the malware or actor operates, you can hunt for new scripting files or executables in the C:\Windows\Temp directory. Now this is not a fool proof method as behaviors can change, but it could be a great start when hunting for this threat! Thank you to the researchers and I hope you enjoy the article! Happy Hunting!

Newly identified wiper malware “PathWiper” targets critical infrastructure in Ukraine
https://blog.talosintelligence.com/pathwiper-targets-ukraine/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone!

As you know I am a big advocate for threat hunting and I like to post the articles that I read related to it but there is a bigger picture that I normally leave out because of my perspective. As a threat hunter I like to look at behaviors and artifacts (Indicators of Attack) and the MITRE ATT&CK Matrix but something I should probably start talking more about is the overall picture of the Threat Hunting Life-cycle. Really, this was brought about because of the joint advisory from Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation (FBI) as well as the Australian Government they released on the #Play Ransomware. This isn't the first time that I have read it and hopefully wont be the last simply because of these couple of lines:

"June 4, 2025: The advisory was updated to reflect new TTPs employed by Play ransomware group, as well as provide current IOCs/remove outdated IOCs for effective threat hunting." Above it they mention that the original advisory was published in December 18, 2023 but the fact that they are returning to the these and updating them with new TTPs and providing new IOCs is a GREAT example of the Threat Hunting Life-cycle.

So if you do have a threat hunting program in your environment, maybe implement something similar to your hunts if you haven't do so already. Revisit the hunts that have been conducted already in your environment and see if the information within is still current and if not, update it accordingly! Have a wonderful day and Happy Hunting!

#StopRansomware: Play Ransomware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #ransomware #readoftheday

Good day everyone!

If you are interested in Threat Hunting and happen to be at the SANS Institute DFIR Summit in Utah, Arun Warikoo and I will be discussing when to use structured and unstructured hunts and what that would look like! I look forward to it and hope to meet a ton of new people! Have a wonderful day and Happy Hunting!

DFIR Summit & Training 2025
https://www.sans.org/cyber-security-training-events/digital-forensics-summit-2025/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Happy Monday everyone!

The Google Threat Intel Group (GTIP) discovered that a government website was hosting malware being used to target multiple other government entities and, with high confidence, attributed the activity to hashtag#APT41 (a.k.a. HOODOO). The group used a piece of malware dubbed #Toughprogress which executes on the compromised host and uses the Google Calendar for command-and-control (C2) communications. The initial access vector was a spear-phishing email that contained a link to a ZIP file which held an LNK masquerading as a pdf, and a directory, which all played their part in the attack. This was a great read and I hope you enjoy it too! Happy Hunting!

Mark Your Calendar: APT41 Innovative Tactics
https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Wednesday everyone!

I stumbled across this interesting report from Flare that took an in-depth look at the relationship between Session Hijacking and Account Takeovers. The article put into perspective how lucrative and common these attacks are and really helped me understand the threat by providing a bunch of contextual information. I enjoyed it and hope you do too! Happy Hunting!

The Account and Session Takeover Economy
https://flare.io/learn/resources/the-account-and-session-takeover-economy?utm_campaign=11744626-2025%20-%20ASTP&utm_source=Media&utm_medium=HackerNews&utm_content=From%20Infection%20to%20Access%3A%20A%2024-Hour%20Timeline%20of%20a%20Modern%20Stealer%20Campaign

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone!

If you are in the threat hunting community, want to join, or simply have questions regarding threat hunting, we at Intel 471 want to hear them! Toss us your questions to possibly get featured in our new series "Lee-Git Threat Hunting: Your Questions, Answered"! Simply put your question in the form and add your name if you want! I look forward to seeing them! Enjoy and Happy Hunting!

https://docs.google.com/forms/d/1fYIKFwNGuwYzl3-ktMa7gRz4Uxl2vOUHbAj2CuiuQ4M/edit

Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Happy Friday everyone!

With the news breaking that the #DanaBot was disrupted, it got me thinking: How do these pieces of malware function and how do they stay on the victim's machines? And when you think of what a botnet operator really needs is repeated access to the compromised machine which gets me thinking about persistence. So, I poked around my favorite resources, the MITRE ATT&CK Matrix, looked at as many bot malware they have, and looked at what they had in common from a perspective of persistence. Two of the most common techniques used were T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder and T1053.005 - Scheduled Task/Job: Scheduled Task. So, if you are hunting for bots, you may want to start there! Enjoy the read and Happy Hunting!

DanaBot malware disrupted, threat actors named
https://intel471.com/blog/danabot-malware-disrupted-threat-actors-named

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone!

I don't know how I missed this one but here is your #readoftheday:

The DFIR Report published an article on Monday that details an attack that started with a vulnerable Confluence server and ended with the deployment of the ELPAC-team ransomware. There were multiple tools that were used that are publicly available, including Anydesk.exe, Mimikatz, ProcessHacker, and Impacket Secretsdump. Side note, they mention that this case is featured in one of their labs, so go check it out! Also, go find out all the details that I couldn't post here and read the article! Enjoy and Happy Hunting!

Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware
https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/#impact

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Happy Wednesday!

Today's #readoftheday is an article from Sophos researchers provide details on an attack that involved the #3AM ransomware strain. With what started with email-bombing, led to social engineering and Microsoft Quick Assist, and a Windows 7 virtual machine. What I really enjoy about this article is the technical details about the "pre-ransomware" activity which can be seen in the Discovery and Defense Evasion sections. These normally involve some LOLBINs (Living-Off-The-Land Binaries) and use the tools that can help provide the adversary with information about the system. Enjoy and Happy Hunting!

A familiar playbook with a twist: 3AM ransomware actors dropped virtual machine with vishing and Quick Assist
https://news.sophos.com/en-us/2025/05/20/a-familiar-playbook-with-a-twist-3am-ransomware-actors-dropped-virtual-machine-with-vishing-and-quick-assist/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Good day everyone!

Check Point Software researchers produced another great article that involves #APT29 and #phishing and a little bit of masquerading. This phishing campaign targeted European diplomatic entities that distributes fake invitations to diplomatic events and appears to be a continuation of a previous campaign run by the same actors. These phishing emails utilized a backdoor known as #Wineloader and also employs a new loader #Grapeloader. There is a lot to unpack here and I hope you enjoy!

Renewed APT29 Phishing Campaign Against European Diplomats
https://research.checkpoint.com/2025/apt29-phishing-campaign/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Monday everyone!

Just got done reading an incredible article from ESET researchers describing an APT group that was long thought to be inactive alive in well! #FamousSparrow is a China-aligned APT group that has had no publicly documented activity since 2022 and was found using two previously undocumented versions of their backdoor, SparrowDoor. They used a mix of publicly available and custom tools for their attack ultimately leading to the deployment of SparrowDoor and ShadowPad (a privately sold backdoor). This report gets more and more interesting as you go so please go take the time to read it! Enjoy and Happy Hunting!

You will always remember this as the day you finally caught FamousSparrow
https://www.welivesecurity.com/en/eset-research/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Wednesday!

I know this is a repeat of yesterday, but tomorrow is the day! You still have time to register and get your community HUNTER account before we begin! I look forward to seeing you there! Happy Hunting!
https://www.linkedin.com/events/threathuntingfoundationsworksho7300891886297235456/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #workshop #webinar

Měla by zaniknout díra uprostřed Středočeského kraje?

Měla by zaniknout Praha a stát se městem na území Středočeského kraje?

Je to jedna z 5 variant, které posuzovala Analýza institucionalizace a posílení motivace metropolitní spolupráce v pražsko-středočeském prostoru.

V analýze je dokonce doporučení, jak by budoucí uspořádání metropolitního regionu mělo vypadat.

Víc lidí se o tohle téma bude zajímat, když nenapíšu, jak to dopadlo. #happyhunting

Good day everyone!

An APT group known as Angry Likho (a.k.a. Sticky Werewolf) is being monitored by Kaspersky's Securelist researchers and they have identified hundreds of victims of a recent attack in Russia, several in Belarus, and additional incidents in other countries. They used an age-old technique of spear-phishing to gain initial access that had various attachments that would contain the legitimate bait file as well as other files, in some cases malicious LNK files. Execution would lead to a newly discovered implant named FrameworkSurvivor.exe.

As usual, check out all the juicy details that I left out and enjoy the read! Happy Hunting!

Angry Likho: Old beasts in a new forest
https://securelist.com/angry-likho-apt-attacks-with-lumma-stealer/115663/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Friday everyone!

The Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation (FBI) have released a #cybersecurity advisory focusing on the #Ghost ransomware threat. They provide us with some updates to the TTPs and Behaviors on the groups activity and what we can hunt for!

Behaviors (MITRE ATT&CK):
Initial Access - TA0001
Exploit Public-Facing Application - T1190 - the group exploited many CVEs to gain their initial foothold. They exploited Fortinet FortiOS appliances (CVE-2018-13379), servers running Adobe ColdFusion (CVE2010-2861 and CVE-2009-3960), Microsoft SharePoint (CVE-2019-0604), and Microsoft Exchange (CVE2021-34473, CVE-2021-34523, and CVE-2021-31207.

Defense Evasion - TA0005
Impair Defenses: Disable or Modify Tools - T1562.001 - Ghost
frequently runs a command to disable Windows Defender on network connected devices.

There are plenty of other technical and behavior artifacts in the report, so go check it out yourself! Enjoy and Happy Hunting!

#StopRansomware: Ghost (Cring) Ransomware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-050a

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone!

Fortinet's FortiGuard Labs discovered a new variant of the #Snake keylogger, a.k.a. "404 Keylogger". According to the report most of the detections from their "FortiSandbox" have come from China, Turkey, Indonesia, Taiwan, and Spain but if you aren't from these countries, you still may be a target!

Behaviors (MITRE ATT&CK):
Persistence - TA0003:
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - After the malware is executed and drops a copy of itself in the %Local_AppData%\supergroup directory then copies itself the the %Startup% folder.

Defense Evasion - TA0005:
Process Injection: Process Hollowing T1055.012 - The malware injects itself into a legitimate .NET process, in this sample it was RegSvcs.exe. This allowed it to run within a trusted process to evade detection.

Command And Control - TA0011:
Application Layer Protocol: Web Protocols - T1071.001
Application Layer Protocol: Mail Protocols - T1071.003

The malware used multiple techniques to upload stolen credentials. The researchers observed SMTP, Telegram bots, and HTTP Post requests to transmit the data.

As usual, go check out the research for yourself to check out the details that I left out and support the good work! Enjoy and Happy Hunting!

FortiSandbox 5.0 Detects Evolving Snake Keylogger Variant
https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone, new Blizzard has dropped!

Microsoft's Threat Intelligence shares their research on a Russian state actor dubbed #SeashellBlizzard! Part of the GRU, they specialize in operations from espionage to information operation and cyber-enabled disruptions which have resulted in destructive attacks and manipulation of ICS. They have leveraged different types of malware to include #KillDisk, #FoxBlade, and #NotPetya.

Behavior Summary (With MITRE ATT&CK):
Initial Access - TA0001:
Exploit Public-Facing Application - T1190
Seashell Blizzard commonly exploited vulnerable public facing infrastructure.

Persistence - TA0003:
Create or Modify System Process: Windows Service - T1543.003 -
Among other means of persistence, Seashell Blizzard created a system service.

Execution - TA0002:
Command and Scripting Interpreter: PowerShell - T1059.001
Command and Scripting Interpreter: Windows Command Shell - T1059.003
Seashell Blizzard abused both of these living off the land binaries for multiple reasons and using multiple different parameters.

As always, there is WAAAAY too many technical details here, so go check it out yourself! Enjoy the read and Happy Hunting!

The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation
https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone!

The wonderful researchers at AhnLab, Inc. Security Intelligence Center (ASEC) publishes their findings on recent attacks they observed coming from the #Kimsuky group. The APT group delivered malicious .LNK files through spear-phishing attacks and these files contained the company's they were targeting names, which would suggested this was a targeted attack. As the attack progressed, the #PebbleDash backdoor and a custom version of #RDPWrapper (which is a software that enabled remote desktop on systems that may not support Windows Native RDP).

Behavior Summary (With MITRE ATT&CK):
Initial Access:
Phishing: Spearphishing Attachment (T1566.001) - Kimsuky delivered their malicious .LNK files through email.

Execution:
Comand and Scripting Interpreter: Powershell (T1059.001) - When the LNK file is executed, a powershell (or mshta.exe) is executed to download and execute addtional payloads from external sources.

Defense Evasion:
System Binary Proxy Execution: Mshta (T1218.005) - When the LNK file is executed it could lead to mshta executed to download and execute addtional payloads from external sources.

Masquerading: Masquerade File Type (T1036.008) - The .LNK files are disguised as a document file with an Office document icon such as PDF, Excel, or Word.

Collection/Credential Access:
Input Capture: Keylogging (T1056.001)
The APT group used a powershell script to perform keylogging and also installs keyloggers in executable file format.

You know the drill! Go check out the article for a lot more technical details! Enjoy and Happy Hunting!

Persistent Threats from the Kimsuky Group Using RDP Wrapper
https://asec.ahnlab.com/en/86098/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Wednesday everyone!

The #AsyncRAT is made headlines in a report published by the Forcepoint X-Labs research team. A significant finding was that the malware leveraged payloads delivered through suspicious TryCloudflare quick tunnels and Python packages. While I am familiar with Python packages being weaponized during a supply chain attack, the topic of quick tunnels eluded me. So, I looked it up and found that "Developers can use the TryCloudflare tool to experiment with Cloudflare Tunnel without adding a site to Cloudflare's DNS. TryCloudflare will launch a process that generates a random subdomain on trycloudflare.com. Requests to that subdomain will be proxied through the Cloudflare network to your web server running on localhost." [https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/]

This was interesting as it seemed to be a workaround or possibly a replacement for domain generating algorithms (DGAs). And if I am misunderstanding this technology, someone please enlighten me!

Behaviors:
Initial Access:
Phishing: Spearphising Link - T1566.002

Execution:
Command And Scripting Interpreter: JavaScript - T1059.007
- A javascript was executed after an LNK file was delivered and executed and links to a .BAT file.

Command And Scripting Interpreter: Windows Command Shell - T1059.003
- A .BAT file is executed that leads to another zip file that contains a python script used to execute the AsyncRAT malware.

Command And Scripting Interpreter: Python - T1059.006
- A python file is used to execute the AsyncRAT malware.

As usual, go show the authors some love and check out the details I excluded and get hunting on those behaviors! Enjoy and Happy Hunting!

AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again
https://www.forcepoint.com/blog/x-labs/asyncrat-reloaded-python-trycloudflare-malware

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone!

While #DeepSeek is making headlines as a competitor to the leading AI tools, bad actors are taking advantage of the hype. Positive Technologies's Supply Chain Security Team detected and prevented a malicious campaign in the Python Package Index (PyPi). The targets were developers, ML engineers, and ordinary AI enthusiasts who were looking into DeepSeek. They noticed a user uploaded two packages, deepseeek and deepseekai that contained functions to collect user and computer data and steal environment variables from it's victims.

Go check out the article for the rest of the technical details and this is a nice example of the good guys getting a win, your work is much appreciated! Enjoy and Happy Hunting!

Malicious packages deepseeek and deepseekai published in Python Package Index

https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/malicious-packages-deepseeek-and-deepseekai-published-in-python-package-index

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Monday everyone!

Fortinet researchers provide us with some very helpful threat intel involving the #Coyote banking trojan that has been used in attacks targeting users in Brazil looking for sensitive information. This trojan has many capabilities which include keylogging, capturing screenshots, and can display phishing overlays to steal sensitive credentials.

Behavior Summary:

Persistence:

During the attack, the Windows Run Registry key is created to provide a persistence mechanism. MITRE ATT&CK ID: T1547.001

Execution:

The LNK file contains malicious PowerShell commands that reach out to C2 servers AND it is used later in the attack. MITRE ATT&CK ID: T1059.001

Discovery:

The antivirus is queried on the compromised system using WMI (Windows Management Instrumentation). MITRE ATT&CK ID: T1518.001.

As usual, I left out a bunch of details for you to go check out in the article, so show the authors some love and enjoy the read! Happy Hunting!

Coyote Banking Trojan: A Stealthy Attack via LNK Files

https://www.fortinet.com/blog/threat-research/coyote-banking-trojan-a-stealthy-attack-via-lnk-files

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Friday everyone!

Bitdefender researcher Martin Zugec recently published a report that involved UAC-0063 targeting high-value targets and organizations in Central Asia and Europe that included government entities and diplomatic missions.

According to the report, initial access was gained when the actor stole a legitimate document, weaponized it, and sent it to the target. The email contains a link, not the actual document, and when the target downloads it and enables macros, triggers a VBA script. A new temporary document is created in the %LocalAppData%\Tmep directory and stores the variables form the initial document. Once the variables are extracted the #HATVIBE malware (a backdoor designed to receive VBS modules for exection on compromised hosts) enters the picture and a scheduled task is created to execute it every 4 minutes for persistence. Then, HATVIBE contacts the C2 server for further instructions.

Now this is just a brief summary but the report contains PLENTY of more technical details, so I would encourage you to go and read it yourself and see what I missed! Enjoy and Happy Hunting!

UAC-0063: Cyber Espionage Operation Expanding from Central Asia

https://www.bitdefender.com/en-us/blog/businessinsights/uac-0063-cyber-espionage-operation-expanding-from-central-asia

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone!

ESET published a report covering a China-aligned APT group named PlushDaemon and their campaign against a VPN provider in South Korea. The attack started with the victim downloading a malicious IPanyVPNsetup.exe installer that, when ran, creates both legitimate and malicious files. Persistence is gained through the use of the Windows Run Registry key and references the directory that the malware lives: %PUBLIC%\Documents\WPSDocuments\WPSManager\svcghost.exe. Later in the attack, .dll's and .exe's are created in the same directory, further leading to suspicious activity.

Opportunities to hunt:
Suspicious File Creates:
Looking in the %PUBLIC% directory for files being created could be your first step. This directory is commonly abused by actors because it is an easy place to hide their payloads since this isn't a location normally used by end-users to store documents and files.

Pseudo Query:
event_type="file_create" AND file_directory="*PUBLIC*" AND (file_extension=".dll" OR file_extension=".exe").

Article source:
PlushDaemon compromises supply chain of Korean VPN service
https://www.welivesecurity.com/en/eset-research/plushdaemon-compromises-supply-chain-korean-vpn-service/

I know it's not a lot but it can help you uncover suspicious activity earlier in the attack chain and hopefully you find it before the malware achieves its goal! Enjoy and Happy Hunting!

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #huntoftheday

Hey everyone,
As I settle into 2025, I’ve been reflecting on the past few years. They’ve been filled with learning, growth, and, yes, a lot of forgetting what I've learned! Along the way, I’ve been fortunate to meet some incredible people in the community and beyond, and to have opportunities I never thought possible.

One of the most rewarding parts of this journey has been working with Threat Hunting teams around the world. I’ve had the chance to help refine their processes and learn from their unique perspectives. Becoming a Black Hat trainer in 2023 and 2024 for a course I helped design and build has been another highlight, and I’m hopeful to see it continue in 2025. These experiences have shown me just how much we all benefit when information is shared more openly within the threat hunting community.

Looking back to when I was in the thick of threat hunting, I often wished for a resource that could have helped me solve problems faster, explained things in a straightforward way, or even provided quick tutorials to get me over the next hurdle. That kind of guidance would have made a huge difference, and it’s something I’d love to give back to the community. But this isn’t just about me sharing knowledge. I want to help threat hunters connect with each other because the best insights often come from shared experiences.

In an attempt to continue to be a resource for the community, I'd like to try something out. We are toying with the best way to do this, but we figured we would get a feel for what the community wants. So, here is the burning question!

I look forward to hearing what you have to say! #HappyHunting

Would some kind of "Ask-Me-Anything" series on threat hunting be beneficial to you?

Good day everyone!

Ryan R. at Intezer shares with us their work analyzing the #BabbleLoader, which is an "extremely evasive loader, packed with defensive mechanisms that is designed to bypass antivirus and sandbox environments to deliver stealers into memory".

There is a TON of analysis and intel here, so I am going to try and highlight the parts that I find significant and actionable!

Defense Evasion:
- The malware checks the installed graphics adapters to see if it is running in a sandboxed environment or not. This leverages the dxgi.dll which is the DirectX Graphics Infrastructure library.
- It checks the amount of unique running processes in the machine by calling NtQuerySystemInformation. The magic number is 85 unique processes with the assumption that a true infected computer would have more running processes that a sandbox would.

Next Stage:
- The next stage involves a Donut loader which, according the the GitHub README states: "Donut is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.[1]"
- The ultimate payload in these examples were WhiteSnake and Meduza Stealers.

Hunt opportunity:
In this case, because the Donut loader and other payloads involved use command and control as their communication, there is an opportunity to run an unstructured hunt for "new" or anomalous connections. The article also mentioned that the WhiteSnake stealer uses the TOR network for C2 which would involve the installation on the victim's machine, which is another opportunity to find something suspicious.

Well, I am SURE there is plenty of information that is critical to everyone else BUT that is why it is time for you to read it for yourself! Enjoy and Happy Hunting!

Babble Babble Babble Babble Babble Babble BabbleLoader
https://intezer.com/blog/research/babble-babble-babble-babble-babble-babble-babbleloader/

Supplemental [1]:
GitHub/TheWover/Donut
https://github.com/TheWover/donut

Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday Cyborg Security, Now Part of Intel 471

Happy Wednesday everyone!

Some good news from the Bitdefender research team! They took a look at the #ransomware strain dubbed #ShrinkLocker and its behaviors and discovered that it abuses a built-in #Windows feature for encryption. It modifies BitLocker (a Windows security feature that encrypts drives to protect data from theft or exposure if a device is lost or stolen) and, if needed, installs it, then re-encrypts the system using a randomly generated password which is delivered to the attacker. Using this feature and paired with Group Policy Objects (GPOs) and scheduled tasks, encrypting an entire network doesn't take much time at all.

The good news: The BitDefender team discovered a window of opportunity for data recovery and have made the decryption tool publicly available. They walk you through the process to recover your data.

Artifacts to hunt for:
Some highlights from the report-
- Look for scheduled tasks that were created that run .vbs scripts and may be in strange locations or have names that are spelled incorrectly or do not match your normal naming convention (if you have one). In this case, "ADHelathCheck" appears that it should have been "ADHealthCheck".
- If scheduled task visibility is an issue, look for svchost.exe being the parent process of abnormal living-off-the-land binaries.
- Monitor RDP connections and identify abuse. This may not be easy but having a baseline or understanding of your environment is paramount.

Well, that is all for now! I hope you enjoy the article and get some good hunts in! Happy Hunting!

ShrinkLocker (+Decryptor): From Friend to Foe, and Back Again
https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again

Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday Cyborg Security, Now Part of Intel 471

Happy Friday everyone!

A Joint Advisory from the National Security Agency, Federal Bureau of Investigation (FBI), Cyber National Mission Force, and the National Cyber Security Centre provides updates on the Russian Federation's Foreign Intelligence Service, or #SVR.

According to the advisory, #APT29 (a.k.a Midnight Blizzard, Cozy Bear, and the Dukes) has targeted the defense, technology, and finance sectors to collect foreign intelligence and enable future cyber operations. They aim to exploit software vulnerabilities for initial access and escalate privileges. They also utilize spearphishing campaigns, password spraying, abuse of supply chain and trusted relationships. They also utilize custom malware and living-off-the-land (LOLBINs) techniques for multiple techniques.

The report includes a list of #CVEs that APT29 has been observed exploiting and attach the vendor and product that are effected with details that describe the vulnerability along with a section of mitigations that your organization can take to increase your security posture.

If you are looking for behaviors that are attributed to APT29, look no further than the MITRE ATT&CK Matrix! This resource has collected historic #TTPs and behaviors and referenced them as well. So while you are working on hardening your environment you can also hunt for their activity as well! Enjoy and Happy Hunting!

Article Source:
Update on SVR Cyber Operations and Vulnerability Exploitation
https://www.ic3.gov/Media/News/2024/241010.pdf

Mitre source:
https://attack.mitre.org/groups/G0016/

Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #huntoftheday #gethunting Cyborg Security, Now Part of Intel 471

Happy Wednesday everyone!

Secureworks released their "State of the Threat" Report that covers cybercrime, state-sponsored threat activity, and, my favorite part, the notable trends in Tactics, Techniques, and Procedures (TTPs).

On page 30, we can find some great information related to #Infostealers and their capabilities. They highlight that the information that they collect are sold as logs and that these logs may contain "local application data such as crypto wallets and VPN data; documents; system information..".

Focusing on the #Lumma stealer, we find that a common behavior associated with it is the abuse of #Windows living-off-the-land binary schtasks to schedule a task that executes from an abnormal location.

If you are currently or planning to hunt for the Lumma Stealer in your environment, this is a good place to start! It is an Intel 471 Community Edition hunt package that anyone with a community account can access! Enjoy and Happy Hunting!

Scheduled Task Executing from Abnormal Location
https://hunter.cyborgsecurity.io/research/hunt-package/09a380b3-45e5-408c-b14c-3787fa48d783

Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #huntoftheday

Happy Thursday everyone!

The Symantec Threat Hunter Team observed activity from the North Korean hashtag#Stonefly group (a.k.a. Andariel, hashtag#APT45, Silent Chollima, Onyx Sleet) and identified parts of their toolset which include the hashtag#Nukebot backdoor, batch files that modify the registry key that is responsible for controlling if credentials are in plaintext or not (HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest), and a list of open-source tools.

There were multiple ways that the adversary gained persistence which included some techniques I've discussed before: creating a .lnk file in the startup directory, creating a service, modifying the registry keys that control or execute items on startup, and scheduled tasks. Which makes me bust out the old but gold Hunt Package that covers that! But enjoy the article and Happy Hunting!

Stonefly: Extortion Attacks Continue Against U.S. Targets
https://symantec-enterprise-blogs.security.com/threat-intelligence/stonefly-north-korea-extortion

Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting $readoftheday

Happy Tuesday everyone!

Here is another great resource from the JPCERT/CC! For those of you out there who aren't familiar with the Japan Computer Emergency Response Team Coordination Center, they published a report that got me into threat hunting, and that was the "Tool Analysis Result Sheet", which changed the game for me.

The article today covers different #Windows Event Logs that you can use to identify human-operated ransomware. Using only the Application, Security, System, and Setup logs, the researchers dug through Conti, Phobos, Midas, BadRabbit, and more ransomware strains to see what evidence they left behind! Enjoy and Happy Hunting!

Event Log Talks a Lot: Identifying Human-operated Ransomware through Windows Event Logs
https://blogs.jpcert.or.jp/en/2024/09/windows.html

Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday Cyborg Security, Now Part of Intel 471

Happy #DFIRDay!

The DFIR Report has released another detailed report that starts with #Nitrogen malware and ends with #BlackCat ransomware encrypting the files of the victim.

Something that really stood out about this attack was the Persistence technique that was observed. Now I am not going to hit you with the same "Run Registry Keys" and "Windows Startup directory" but it does involve scheduled tasks. And not just the existence of a scheduled task being created but MULTIPLE task creation attempts. Not only does the section highlight the "human element" that exists with cyber attacks, since there were multiple mistakes and typos, but makes you question how often this type of thing occurs in your environment. I know I stand a little outside of organizations and I only have a small window in, but I think that this many attempts from a single or multiple hosts seems like a red flag. In other words, don't just think about the technique, think about frequency and how often this might legitimately exist. Once you understand that, it is easier to find the abnormal! Enjoy the rest of the article and Happy Hunting!

Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware
https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#initial-access

Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday Cyborg Security, Now Part of Intel 471

Happy Thursday everyone!

To continue the amazing work of Will Thomas, we have the Ransomware Tool Matrix. Like the Russian APT Matrix, this resource contains tools that each ransomware group, or extortionists, use. They are broken down by types of tools that all Threat Hunters, or Defenders in general, need to know. This can help prioritize YOUR hunts, especially you are an organization focused on ransomware! Enjoy and Happy Hunting!

Ransomware Tool Matrix
https://github.com/BushidoUK/Ransomware-Tool-Matrix/tree/main

Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #readoftheday #HappyHunting Cyborg Security, Now Part of Intel 471

Happy Wednesday everyone!

This resources has been popping up on my feed everywhere so I took a look at it and I see why! When he is not instructing the #SANS FOR589, Will Thomas is creating highly valuable resources like the Russian APT Tool Matrix.

Will has taken the time to correlate the tools of Russian #APTs such as #CozyBear and #Sandworm and even supplied the aliases that go along with them as well. This is a great resource if you are an organization who is APT focused to prioritize your threat hunting! Thanks a ton Will!

Enjoy and Happy Hunting!

Russian APT Tool Matrix:
https://github.com/BushidoUK/Russian-APT-Tool-Matrix/blob/main/GroupProfiles/Sandworm.md

Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #readoftheday #HappyHunting Cyborg Security, Now Part of Intel 471

Good day all!

Palo Alto Networks Unit 42 researchers have been keeping a keen eye out for suspicious activity and they certainly found it here! This time it involved the APT known as #GleamingPisces and #python packages that they poisoned to infect both Linux and macOS systems. The goal is assumed to be the establishment of a compromised supply chain specifically targeting developers and their machines.

Looking at the good ole MITRE ATT&CK Matrix, we can see that the use of Python is assigned the sub-technique id of 1059.006, a sub-technique of Command and Scripting Interpreter. This sub-technique captures when adversaries use and abuse Python commands and scripts for execution.

Enjoy the article and stay tuned for some hints!

Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors
https://unit42.paloaltonetworks.com/gleaming-pisces-applejeus-poolrat-and-pondrat/?web_view=true

Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday Cyborg Security, Now Part of Intel 471

Good day everyone!

ReliaQuest Threat Research bring a new term (or at least new to me) to the threat hunt community and that is CAMO (Commercial Applications, Malicious Operations). Using CAMO software for several reasons: these tools provide legitimate uses, organizations may have a lack of comprehensive inventories (think top 2 of Top 18 CIS Critical Security Controls) and can be mistaken for benign activity, which means attackers can hide their malicious behaviors in the traffic because the traffic would be EXPECTED from that tool.

It is an interesting discussion since it further separates and highlights the differences between RMM (remote monitoring and management tools) and LOLBINs and how we have to modify our threat hunting tactics to discover this activity! Enjoy the read and Happy Hunting!

CAMO Unveiled: How Cybercriminals Exploit Legitimate Software for Stealthy Attacks
https://www.reliaquest.com/blog/camo-legit-software-threat/

Cyborg Security Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Monday everyone!

On September 3rd the Federal Bureau of Investigation (FBI) released a Public Service Announcement that raises the awareness of some "well-disguised" social engineering attacks. These attacks have been attributed to The Democratic People's Republic of Korea ("DPRK" aka North Korea) and is targeting the #crypto industry.

Some examples of the effort that is put into these types of attacks, especially from a nation state actor, are:
- The group conducts some serious "pre-operational" research of their victims.
- They individualize the fake scenarios by initiating prolonged conversations with their victims to build rapport. It's not just a drive by/hope for the best encounter.
- They impersonate individuals their victims may know or follow, like prominent people associated with certain technologies, possibly an influencer.

And the FBI shares some indicators that you may be at the end of a social engineering attack:
- Requests to execute code or download applications.
- Conduct a "pre-employment" test or debugging exercise.
- Offers of employment from prominent cryptocurrency or tech firms

Well, this one's a little different, but enjoy the article and Happy Hunting!

North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks
https://www.ic3.gov/Media/Y2024/PSA240903

Cyborg Security Intel 471 #CyberSecurity #ITSecurity #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Happy Tuesday all!

A hacktivist group named Head Mare is making its presence known in Russia and Belarus and Kaspersky shares the technical details they discovered. Recently the group has been abusing CVE-2023-38831 (a vulnerability in WinRAR) to gain initial access and to execute arbitrary code on the victim's machine. Once on the machine the group uses different strains of ransomware, off the shelf toolkits (Sliver), and good ol' Mimikatz.

As far as the techniques, well, there is one that cannot be ignored, the Registry Run key used for Persistence but what was interesting was the defense evasion techniques they showed, which they accomplished in a two-step fashion. First, they created scheduled tasks that had names that hinted they are part of legitimate operations (MicrosoftUpdateCore and MicrosoftUpdateCoree) and then had the malware that was dropped imitate legitimate software names (OneDrive.exe and VLC.exe) which were stored in the C:\ProgramData\ directory, which is a more trust-worthy directory, unlike the AppData or Users\Public directory.

As usual, read further for more interesting TTPs and stand by for the Threat Hunting Tip of the Day! Enjoy and Happy Hunting!

Head Mare: adventures of a unicorn in Russia and Belarus
https://securelist.com/head-mare-hacktivists/113555/

Cyborg Security Intel 471 #CyberSecurity #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Good day everyone!

Microsoft brings us the #readoftheday with a threat group known as #PeachSandstorm. Believed to be operating out of Iran the group deployed a new custom malware, the Tickler backdoor and it sounds like they conduct espionage campaigns.

Looking at the behaviors, we can see a tried and true persistence mechanism (throw your answer in the comments if you spotted it as well, its something I have mentioned too many times to count!) and then another technique used by many adversaries: drop a LEGIT remote monitoring and management (RMM) tool, in this case, AnyDesk. But I am going to leave you guessing where we are going with this one! Enjoy the article and Happy Hunting!

Peach Sandstorm deploys new custom Tickler malware in long-running intelligence gathering operations

https://www.microsoft.com/en-us/security/blog/2024/08/28/peach-sandstorm-deploys-new-custom-tickler-malware-in-long-running-intelligence-gathering-operations/

Cyborg Security Intel 471 #CyberSecurity #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

For your Threat Hunting Tip of the Day:

Masquerading is a common technique used by attackers and by using legitimate names for their malicious programs it makes the victims more likely to click the application. But, as a hunter, what can you do? Easy: Look at the process chain!

Part of Threat Hunting is learning your environment and by identifying process chains that are legitimate in your environment, you can start to look for process chains that may not make sense. So when you are looking at "legit" sounding apps that are executing, make sure you look at the parent process!

Good luck and Happy Hunting!

Cyborg Security Intel 471 #CyberSecurity #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #huntoftheday #gethunting!

Happy Wednesday everyone!

Today's #readoftheday is a tale of victims getting compromised when they tried to download pirated movies! Mandiant (part of Google Cloud) reports that it all started with a zip file whos title hinted that it would be a movie but really contained a malicious LNK (Microsoft Shortcut files) that executes a PowerShell downloader script which leads to the #PEAKLIGHT malware, another PowerShell-based downloader.

Interestingly, one of the variations uses an executable named Setup.exe which appears to be masquerading as a legitimate application, which is a common technique that is used by threat actors to gain trust from their victims!

As always, enjoy the rest of the article, I hope you have time to read it for yourself, and stay tuned for your Threat Hunting Tip of the Day!

PEAKLIGHT: Decoding the Stealthy Memory-Only Malwarehttps://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding-stealthy-memory-only-malware/

Cyborg Security Intel 471 #CyberSecurity #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting