What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-07-15 11:27:07 | Weekly OSINT Highlights, 15 July 2024 (lien direct) | ## Snapshot Last week\'s OSINT reporting highlights a diverse array of cyber threats, showcasing the prominence of sophisticated malware, information stealers, and ransomware attacks. Attack vectors frequently include compromised websites, phishing emails, malicious advertisements, and exploitation of known vulnerabilities, particularly in widely-used software like Oracle WebLogic and Microsoft Exchange. Threat actors range from organized state-sponsored groups, such as China\'s APT41 (tracked by Microsoft as [Brass Typhoon](https://security.microsoft.com/intel-profiles/f0aaa62bfbaf3739bb92106688e6a00fc05eafc0d4158b0e389b4078112d37c6)) and APT40 (tracked by Microsoft as [Gingham Typhoon](https://security.microsoft.com/intel-profiles/a2fc1302354083f4e693158effdbc17987818a2433c04ba1f56f4f603268aab6)), to individual developers using platforms like GitHub to distribute malware. The targets are varied, encompassing financial institutions, cryptocurrency exchanges, government agencies, and sectors like healthcare, education, and manufacturing, with a notable focus on high-value data and critical infrastructure across multiple countries. ## Description 1. [Clickfix Infection Chain](https://security.microsoft.com/intel-explorer/articles/85fea057): McAfee Labs discovered the "Clickfix" malware delivery method that uses compromised websites and phishing emails to trick users into executing PowerShell scripts. This method is being used to deliver [Lumma](https://security.microsoft.com/intel-profiles/33933578825488511c30b0728dd3c4f8b5ca20e41c285a56f796eb39f57531ad)[Stealer](https://security.microsoft.com/intel-profiles/33933578825488511c30b0728dd3c4f8b5ca20e41c285a56f796eb39f57531ad) and [DarkGate](https://security.microsoft.com/intel-profiles/52fa311203e55e65b161aa012eba65621f91be7c43bacaaad126192697e6b648) malware across multiple countries, including the US, Canada, and China. 2. [CRYSTALRAY Expands Targeting](https://security.microsoft.com/intel-explorer/articles/ecea26df): Sysdig researchers identified the threat actor CRYSTALRAY, who has scaled operations to over 1,500 victims using SSH-Snake and various vulnerabilities for lateral movement and data exfiltration. Targets include systems vulnerable to CVE-2022-44877, CVE-2021-3129, and CVE-2019-18394. 3. [DodgeBox Loader by APT41](https://security.microsoft.com/intel-explorer/articles/3524d2ae): Zscaler ThreatLabz reported on DodgeBox, a reflective DLL loader used by the Chinese APT41 group, also known as Brass Typhoon. The loader delivers the MoonWalk backdoor and employs sophisticated techniques like call stack spoofing to avoid detection. 4. [ViperSoftX Information Stealer](https://security.microsoft.com/intel-explorer/articles/8084ff7b): Trellix researchers highlighted ViperSoftX, an information stealer spread through cracked software and malicious eBooks. The malware uses PowerShell and AutoIt for data exfiltration and evasion, targeting cryptocurrency wallets and other sensitive information. 5. [Coyote Banking Trojan](https://security.microsoft.com/intel-explorer/articles/201d7c4d): BlackBerry detailed Coyote, a .NET banking trojan targeting Brazilian financial institutions. Delivered likely via phishing, it performs various malicious functions like screen capture and keylogging, communicating with C2 servers upon detecting target domains. 6. [Kematian-Stealer on GitHub](https://security.microsoft.com/intel-explorer/articles/4e00b1b4): CYFIRMA identified Kematian-Stealer, an open-source information stealer hosted on GitHub. It targets applications like messaging apps and cryptocurrency wallets, employing in-memory execution and anti-debugging measures to evade detection. 7. [Eldorado Ransomware-as-a-Service](https://security.microsoft.com/intel-explorer/articles/3603cd85): Group-IB reported on Eldorado, a RaaS targeting various industries and countries, primarily the US. Written in Golang, it uses Chacha20 and RSA-OAEP encryption and has customizable features for targeted attacks. 8. [DoNex Ransomware Flaw](https://security.microsoft.com | Ransomware Malware Tool Vulnerability Threat Legislation Prediction Medical | APT 41 APT 40 | |
 |
2021-12-21 16:57:00 | Anomali Cyber Watch: \'PseudoManuscrypt\' Mass Spyware Campaign Targets 35K Systems, APT31 Intrusion Set Campaign: Description, Countermeasures and Code, State-sponsored hackers abuse Slack API to steal (lien direct) | The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT31, Magecart, Hancitor, Pakdoor, Lazarus, and Vulnerabilities CVE-2021-21551.. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.
Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.
Trending Cyber News and Threat Intelligence
NSW Government Casual Recruiter Suffers Ransomware Hit
(published: December 17, 2021)
Finite Recruitment suffered a ransomware attack during the month of October 2021, resulting in the exfiltration of some data. Their incident responders (IR) identified the ransomware as Conti, a fast encrypting ransomware commonly attributed to the cybercriminal group Wizard Spider. The exfiltrated data was published on the dark web, however the firm remains fully operational, and affected customers are being informed.
Analyst Comment: Always check to see if there is a decryptor available for the ransomware before considering payment. Enforce a strong backup policy to ensure that data is recoverable in the event of encryption or loss.
MITRE ATT&CK: [MITRE ATT&CK] Scheduled Transfer - T1029
Tags: Conti, Wizard Spider, Ransomware, Banking and Finance
Phorpiex botnet is back with a new Twizt: Hijacking Hundreds of crypto transactions
(published: December 16, 2021)
Check Point Research has uncovered a new variant of the Phorpiex botnet named Twizt. Historically, Phorpiex utilized sextortion, ransomware delivery, and cryptocurrency clipping. Twizt however, appears to be primarily focused on stealing cryptocurrency and have stolen half a million dollars since November 2020 in the form of Bitcoin, Ether and ERC20 tokens.The botnet features departure from it’s traditional command and control (C2) infrastructure, opting for peer-to-peer (P2P) communications between infected hosts, eliminating the need for C2 communication as each host can fulfill that role.
Analyst Comment: Bots within a P2P network need to communicate regularly with other bots to receive and share commands. If the infected bots are on a private network, private IP addresses will be used. Therefore, careful monitoring of network traffic will reveal suspicious activity, and a spike in network resource usage as opposed to the detection of C2 IP addresses.
MITRE ATT&CK: [MITRE ATT&CK] Data Encoding - T1132 | [MITRE ATT&CK] File and Directory Discovery - T1083 | [MITRE ATT&CK] Clipboard Data - T1115
Tags: Phorpiex, Twizt, Russia, Banking and Finance, Cryptocurrency, Bitcoin
‘PseudoManuscrypt’ Mass Spyware Campaign Targets 35K Systems
(published: December 16, 2021)
Kaspersky researchers have documented a spyware that has targeted 195 countries as of December 2021. The spyware, named PseudoManuscrypt, was developed and deployed by Lazarus Group |
Ransomware Malware Vulnerability Threat Guideline Medical | APT 41 APT 38 APT 28 APT 31 |
1
We have: 2 articles.
We have: 2 articles.
To see everything:
Our RSS (filtrered)
