#pikabot — Public Fediverse posts

🔎 The Sekoia TDR team delved into the deep secrets and operations of #PikaBot.

Our lastest report provides insights resulting from the PikaBot reverse engineering.

Aditionally, this report shares technical details on tracking its C2 infrastructure.

https://blog.sekoia.io/pikabot-a-guide-to-its-deep-secrets-and-operations/

Awesome work shutting down botnet infrastructure related to #icedid, #bumblebee, and #pikabot
https://www.europol.europa.eu/media-press/newsroom/news/largest-ever-operation-against-botnets-hits-dropper-malware-ecosystem

We are proud to announce that Sekoia #TDR team contributed to the joint international law enforcement operation #OperationEndgame, targeting the notorious botnets #IcedID, #Smokeloader, #SystemBC and #Pikabot

https://operation-endgame.com/

Ach guck an, keine Festnahmen in Russland, keine #Vorratsdatenspeicherung nötig gewesen:

BKA: Bisher größter Schlag gegen weltweite Cyberkriminalität

#Trickbot #Pikabot #Ransomware
https://www.br.de/nachrichten/deutschland-welt/bka-bisher-groesster-schlag-gegen-weltweite-cyberkriminalitaet,UEEG6Di

Operation Endgame - Largest Ever Operation Against Botnets Hits Dropper Malware Ecosystem

Date: May 30, 2024
CVE: Not specified
Vulnerability Type: Malware
CWE: [[CWE-94]], [[CWE-502]]
Sources: Europol News, Eurojust News

Issue Summary

Europol, in coordination with law enforcement agencies from multiple countries, conducted the largest ever operation targeting botnets. This operation, dubbed "Operation Endgame," took place from May 27 to 29, 2024, and led to the disruption of major malware droppers including IcedID, SystemBC, Pikabot, Smokeloader, and Bumblebee. The effort resulted in four arrests and the takedown of over 100 servers worldwide. These droppers were used to facilitate ransomware and other cyber-attacks by installing additional malware onto target systems. The operation was supported by Eurojust and involved contributions from countries including France, Germany, the Netherlands, Denmark, the UK, the US, and others. Private partners also played a role in the operation, which aimed to dismantle the infrastructure supporting these malicious activities. The success of this operation marks a significant step in combating cybercrime on a global scale.

Operation Endgame, coordinated by Europol, dismantled several major botnets including IcedID, SystemBC, Pikabot, Smokeloader, and Bumblebee. This international effort involved law enforcement agencies from multiple countries and led to the arrest of four individuals and the takedown of over 100 servers. The botnets targeted facilitated ransomware and other cyber-attacks.

Technical Key Findings

The malware droppers involved are designed to infiltrate systems and install additional malware, often avoiding detection through sophisticated evasion techniques. These droppers were used to deploy ransomware and other malicious payloads by bypassing security measures and enabling further system compromises.

Vulnerable Products

The operation did not specify particular products but targeted the infrastructures supporting droppers like IcedID, SystemBC, Pikabot, Smokeloader, and Bumblebee.

Impact Assessment

If abused, these vulnerabilities could lead to widespread ransomware attacks, financial losses, and significant disruption of services. The infrastructure taken down had facilitated numerous cyber-attacks globally, highlighting the severe impact on cybersecurity.

Patches or Workaround

The report did not mention specific patches or workarounds. However, continuous monitoring and updating of security measures are recommended to protect against such threats.

Tags

#Botnets #Malware #Ransomware #Cybersecurity #Europol #OperationEndgame #Cybercrime #IcedID #SystemBC #Pikabot #Smokeloader #Bumblebee

We are proud to announce that we assisted the joint international law enforcement operation #OperationEndgame, targeting the notorious botnets #IcedID, #Smokeloader, #SystemBC and #Pikabot 🔥

abuse.ch has provided key infrastructure to LEA and internal partners to disrupt these botnet operations 🛑

More information on the operation is available here:
👉 https://operation-endgame.com/

🚨#IcedID, #Smokeloader, #SystemBC, #Pikabot and #Bumblebee botnets have been disrupted by Operation Endgame!! This is the largest operation EVER against botnets involved with ransomware, with gargantuan thanks to a coordinated effort led by international agencies 👏👏

As with the #Qakbot and #Emotet takedowns, Spamhaus are again providing remediation support - those affected will be contacted from today with steps to take.

👉 For more information, read our write-up here: https://www.spamhaus.org/resource-hub/malware/operation-endgame-botnets-disrupted-after-international-action/

#OperationENDGAME

Zscaler identified Pikabot malware loader's string obfuscation algorithm. They describe the algorithm and their approach to decrypt the binary strings using IDA's microcode. They developed an IDA plugin to automatically decrypt Pikabot's obfuscated strings and released the source code. IOC provided. 🔗 https://www.zscaler.com/blogs/security-research/automating-pikabot-s-string-deobfuscation

#Pikabot #threatintel #IOC #IDA

Bleeping describes this #pikabot campaign aimed at stealing NTLM hashes with connection information.
⬇️​
👀​⚠️​
"Vulnerability researcher Will Dormann suggests that it's possible that the hashes are not being stolen to breach networks but rather as a form of reconnaissance to find valuable targets."
👇​
https://www.bleepingcomputer.com/news/security/hackers-steal-windows-ntlm-authentication-hashes-in-phishing-attacks/

#cyberveille

New blog post! In this one I look at a Java-based dropper for Pikabot that TA577 used in mid-February 2024.
https://forensicitguy.github.io/dissecting-java-pikabot-dropper/
#malware #pikabot #ta577

So, according to Any.Run
👇​
🐦​🔗​twitter[.]com/anyrun_app/status/1762854550627561852

and Deutsche Telecom's CERT,
👇​
🐦​🔗​
twitter[.]com/DTCERT/status/1762808435723145366

the objective of this strange campaign iteration is to "simply" capture hashes (and IP address, username, victim's computer name) from NTLMv2 connections through SMB.
This occurs because Edge and Chrome establish connections without prompting users for authorization. (enumeration operation)

IoCs --> file://SMB IP
👇​
https://threatfox.abuse.ch/browse/malware/win.pikabot/

(image by any.run)
#CyberVeille #Pikabot

very good analysis of last week's #pikabot campaign

✉️​➡️​link➡️​zip➡️​js+data➡️​:terminal:​ .ps
👇​
https://www.elastic.co/security-labs/pikabot-i-choose-you

if anyone understands this week's chaining or has managed to grab the payload, I'm interested

✉️➡️​​zip➡️​html+data➡️​html refresh➡️​file: //xxx.xxx.xxx.xxx/xxx/xxx.txt

:blobcatwaitwhat:​
👇​
https://bazaar.abuse.ch/browse/tag/Pikabot/

[IP SMB]
👇​
https://threatfox.abuse.ch/browse/malware/win.pikabot/

#CyberVeille #malspam

PikaBot Resurfaces with Streamlined Code and Deceptive Tactics
https://thehackernews.com/2024/02/pikabot-resurfaces-with-streamlined.html #Cybercrime #Malware #PikaBot

🚨 Nouveau malware alerte! Pikabot, identifié pour la première fois en février 2023, est un logiciel malveillant sophistiqué qui échappe à la détection et à l'analyse grâce à ses techniques de furtivité avancées. 🕵️‍♂️ Distribué principalement via des campagnes de malspam et de malvertising, il évite les systèmes liés à la Russie et pourrait avoir des liens avec le maliciel Matanbuchus. 📧 Méfiez-vous des emails piégés et des fausses publicités, car Pikabot est associé à des cyberattaques et au ransomware Black Basta. #CyberSécurité #Malware #Pikabot
https://www.lemagit.fr/conseil/Maliciel-a-la-decouverte-de-Pikabot

After dropping #PikaBot for a few days, the threat actor behind one of the #malvertising campaigns switched back to #FakeBat.

The PowerShell script looks different, and there may be some new evasion tricks.

C2: ads-analyze[.]xyz

Sample: https://www.virustotal.com/gui/file/9c57936b065f3eb5a019f39058910ce94ddfff13257acb7bddddea000c305d0f

#threatintel

More #pikabot via google #malvertising again today

Redirection infrastructure:
teemviewer.onelink[.]me
fgrernentse[.]top

Fake site:
tvewer.irngo[.]com

MSI downloaded: https://www.virustotal.com/gui/file/8eed8935c7652c0bc878229aefad603501f513837cb277ce841c756de82b8d55

#IOCs #malware

Malicious slack ad leading to #Pikabot malware ⚠️​ Pikabot is closely associated with ransomware intrusions.

Redirection Infrastructure:
slalk.onelink[.]me
anewreseller[.]top

Fake Site:
siack.ovmv[.]net

.msi payload hosted on dropbox:
https://www.virustotal.com/gui/file/f1bc547091f9a2447fd16c804aa568707ca323e3d20c90e5568b303480ae7a03

#IOCs #malvertising

QakBot, also known as QBot and Pinkslipbot, was dismantled in August as part of a coordinated law enforcement effort called Operation Duck Hunt.

#Cybersecurity #DarkGate #QakBot #Malware #Phishing #PikaBot

https://cybersec84.wordpress.com/2023/11/21/qakbot-reborn-darkgate-and-pikabot-malware-leverage-old-tactics-in-new-phishing-attacks/

Some fresh #pikabot

https://app.any.run/tasks/28cc4691-5e13-4ec2-ae90-c2f835af242e

Today's quick #malware analysis with #SecurityOnion: TA577 #PIKABOT INFECTION WITH #CobaltStrike pcap from 2023-10-17!

Thanks to @malware_traffic for sharing this #pcap!

More screenshots:
https://blog.securityonion.net/2023/10/quick-malware-analysis-ta577-pikabot.html

#infosec
#infosecurity
#ThreatHunting
#IncidentResponse

Today's quick #malware analysis with #SecurityOnion:
#Pikabot infection with #CobaltStrike pcap from 2023-05-23

Thanks to Brad Duncan for sharing this pcap!

More info:
https://blog.securityonion.net/2023/09/quick-malware-analysis-pikabot.html

#infosec
#infosecurity
#ThreatHunting
#IncidentResponse

We are seeing an increase in #Pikabot activity, spreading through spam email campaigns that traditionally where pushing #Qakbot malware🔥

In response to this emerging threat, we have started to include active Pikabot botnet C2s in Feodo Tracker, pushing automated protection out for millions of internet users 🛡️

👉 https://feodotracker.abuse.ch/browse/

In order to block active Pikabot botnet C2s, just implement Feodo Tracker's recommend IP blocklist on your security perimeter:

🛑 https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt