home.social

#modelorat — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #modelorat, aggregated by home.social.

  1. TechNadu @[email protected] ·

    DNS-based staging via ClickFix represents tactical evolution.

    Per Microsoft:
    • Cmd.exe → nslookup execution
    • Hardcoded external DNS resolver
    • Payload embedded in DNS Name: response
    • ZIP retrieval from azwsappdev[.]com
    • Python-based reconnaissance
    • VBScript persistence via Startup LNK
    • ModeloRAT deployment
    • Lumma Stealer distribution via CastleLoader (GrayBravo)

    Campaign telemetry also discussed by Bitdefender and Kaspersky.

    DNS offers:
    • Reduced dependency on HTTP
    • Traffic blending with legitimate queries
    • Lightweight validation signaling

    Detection priorities:
    • Anomalous nslookup patterns
    • External DNS resolver usage
    • Suspicious Startup LNK creation
    • DNS response content inspection

    Is your EDR correlating DNS queries with process lineage?
    Engage below.
    Follow @technadu for advanced threat analysis.

    #ThreatIntel #ClickFix #DNSStaging #ModeloRAT #LummaStealer #CastleLoader #DetectionEngineering #BlueTeam #SOC #Infosec #CyberOperations #MalwareAnalysis

    #threatintel #clickfix #dnsstaging #modelorat #lummastealer #castleloader
  2. TechNadu @[email protected] ·

    DNS-based staging via ClickFix represents tactical evolution.

    Per Microsoft:
    • Cmd.exe → nslookup execution
    • Hardcoded external DNS resolver
    • Payload embedded in DNS Name: response
    • ZIP retrieval from azwsappdev[.]com
    • Python-based reconnaissance
    • VBScript persistence via Startup LNK
    • ModeloRAT deployment
    • Lumma Stealer distribution via CastleLoader (GrayBravo)

    Campaign telemetry also discussed by Bitdefender and Kaspersky.

    DNS offers:
    • Reduced dependency on HTTP
    • Traffic blending with legitimate queries
    • Lightweight validation signaling

    Detection priorities:
    • Anomalous nslookup patterns
    • External DNS resolver usage
    • Suspicious Startup LNK creation
    • DNS response content inspection

    Is your EDR correlating DNS queries with process lineage?
    Engage below.
    Follow @technadu for advanced threat analysis.

    #ThreatIntel #ClickFix #DNSStaging #ModeloRAT #LummaStealer #CastleLoader #DetectionEngineering #BlueTeam #SOC #Infosec #CyberOperations #MalwareAnalysis

    #threatintel #clickfix #dnsstaging #modelorat #lummastealer #castleloader
  3. TechNadu @[email protected] ·

    DNS-based staging via ClickFix represents tactical evolution.

    Per Microsoft:
    • Cmd.exe → nslookup execution
    • Hardcoded external DNS resolver
    • Payload embedded in DNS Name: response
    • ZIP retrieval from azwsappdev[.]com
    • Python-based reconnaissance
    • VBScript persistence via Startup LNK
    • ModeloRAT deployment
    • Lumma Stealer distribution via CastleLoader (GrayBravo)

    Campaign telemetry also discussed by Bitdefender and Kaspersky.

    DNS offers:
    • Reduced dependency on HTTP
    • Traffic blending with legitimate queries
    • Lightweight validation signaling

    Detection priorities:
    • Anomalous nslookup patterns
    • External DNS resolver usage
    • Suspicious Startup LNK creation
    • DNS response content inspection

    Is your EDR correlating DNS queries with process lineage?
    Engage below.
    Follow @technadu for advanced threat analysis.

    #ThreatIntel #ClickFix #DNSStaging #ModeloRAT #LummaStealer #CastleLoader #DetectionEngineering #BlueTeam #SOC #Infosec #CyberOperations #MalwareAnalysis

    #malwareanalysis #cyberoperations #infosec #soc #blueteam #detectionengineering
  4. TechNadu @[email protected] ·

    DNS-based staging via ClickFix represents tactical evolution.

    Per Microsoft:
    • Cmd.exe → nslookup execution
    • Hardcoded external DNS resolver
    • Payload embedded in DNS Name: response
    • ZIP retrieval from azwsappdev[.]com
    • Python-based reconnaissance
    • VBScript persistence via Startup LNK
    • ModeloRAT deployment
    • Lumma Stealer distribution via CastleLoader (GrayBravo)

    Campaign telemetry also discussed by Bitdefender and Kaspersky.

    DNS offers:
    • Reduced dependency on HTTP
    • Traffic blending with legitimate queries
    • Lightweight validation signaling

    Detection priorities:
    • Anomalous nslookup patterns
    • External DNS resolver usage
    • Suspicious Startup LNK creation
    • DNS response content inspection

    Is your EDR correlating DNS queries with process lineage?
    Engage below.
    Follow @technadu for advanced threat analysis.

    #ThreatIntel #ClickFix #DNSStaging #ModeloRAT #LummaStealer #CastleLoader #DetectionEngineering #BlueTeam #SOC #Infosec #CyberOperations #MalwareAnalysis

    #threatintel #clickfix #dnsstaging #modelorat #lummastealer #castleloader
  5. The Threat Codex @[email protected] ·

    New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan
    #Storm_0300 #ModeloRAT
    microsoft.com/en-us/security/b

    #storm_0300 #modelorat
  6. The Threat Codex @[email protected] ·

    New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan
    #Storm_0300 #ModeloRAT
    microsoft.com/en-us/security/b

    #storm_0300 #modelorat
  7. The Threat Codex @[email protected] ·

    New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan
    #Storm_0300 #ModeloRAT
    microsoft.com/en-us/security/b

    #storm_0300 #modelorat
  8. The Threat Codex @[email protected] ·

    New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan
    #Storm_0300 #ModeloRAT
    microsoft.com/en-us/security/b

    #modelorat #storm_0300
  9. The Threat Codex @[email protected] ·

    New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan
    #Storm_0300 #ModeloRAT
    microsoft.com/en-us/security/b

    #storm_0300 #modelorat
  10. RedPacket Security @[email protected] ·

    New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan - redpacketsecurity.com/new-clic

    #threatintel
    #crashfix
    #clickfix
    #modelorat
    #python-payload
    #browser-extension

    #threatintel #crashfix #clickfix #modelorat #python #browser
  11. RedPacket Security @[email protected] ·

    New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan - redpacketsecurity.com/new-clic

    #threatintel
    #crashfix
    #clickfix
    #modelorat
    #python-payload
    #browser-extension

    #threatintel #crashfix #clickfix #modelorat #python #browser
  12. RedPacket Security @[email protected] ·

    New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan - redpacketsecurity.com/new-clic

    #threatintel
    #crashfix
    #clickfix
    #modelorat
    #python-payload
    #browser-extension

    #threatintel #crashfix #clickfix #modelorat #python #browser
  13. RedPacket Security @[email protected] ·

    New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan - redpacketsecurity.com/new-clic

    #threatintel
    #crashfix
    #clickfix
    #modelorat
    #python-payload
    #browser-extension

    #browser #python #modelorat #clickfix #crashfix #threatintel
  14. RedPacket Security @[email protected] ·

    New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan - redpacketsecurity.com/new-clic

    #threatintel
    #crashfix
    #clickfix
    #modelorat
    #python-payload
    #browser-extension

    #threatintel #crashfix #clickfix #modelorat #python #browser
  15. Hackread.com @[email protected] ·

    📣 🚨 #KongTuke hacker group cloned a #Chrome ad blocker to trick users into installing spyware which also launched DoS attacks, crashed browsers, and dropped ModeloRAT.

    Read: hackread.com/clickfix-crashfix

    #CyberSecurity #Malware #ModeloRAT #ClickFix #CrashFix

    #kongtuke #chrome #cybersecurity #malware #modelorat #clickfix
  16. Hackread.com @Hackread ·

    📣 🚨 hacker group cloned a ad blocker to trick users into installing spyware which also launched DoS attacks, crashed browsers, and dropped ModeloRAT.

    Read: hackread.com/clickfix-crashfix

    #kongtuke #chrome #cybersecurity #malware #modelorat #clickfix
  17. Hackread.com @[email protected] ·

    📣 🚨 #KongTuke hacker group cloned a #Chrome ad blocker to trick users into installing spyware which also launched DoS attacks, crashed browsers, and dropped ModeloRAT.

    Read: hackread.com/clickfix-crashfix

    #CyberSecurity #Malware #ModeloRAT #ClickFix #CrashFix

    #kongtuke #chrome #cybersecurity #malware #modelorat #clickfix
  18. Hackread.com @[email protected] ·

    📣 🚨 #KongTuke hacker group cloned a #Chrome ad blocker to trick users into installing spyware which also launched DoS attacks, crashed browsers, and dropped ModeloRAT.

    Read: hackread.com/clickfix-crashfix

    #CyberSecurity #Malware #ModeloRAT #ClickFix #CrashFix

    #crashfix #clickfix #modelorat #malware #cybersecurity #chrome
  19. Hackread.com @[email protected] ·

    📣 🚨 #KongTuke hacker group cloned a #Chrome ad blocker to trick users into installing spyware which also launched DoS attacks, crashed browsers, and dropped ModeloRAT.

    Read: hackread.com/clickfix-crashfix

    #CyberSecurity #Malware #ModeloRAT #ClickFix #CrashFix

    #kongtuke #chrome #cybersecurity #malware #modelorat #clickfix