Hypervisor Ransomware | Multiple Threat Actor Groups Hop on Leaked Babuk Code to Build ESXi Lockers

https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/

#threatintel #ransomware #infosec #dfir

Maximizing Threat Detections of Qakbot with #Osquery

https://research.loginsoft.com/threat-research/blog-maximizing-threat-detections-of-qakbot-with-osquery/

#threatintel #threathunting #dfir #qakbot #infosec

IcedID Malware: Traversing Through its Various Incarnations

https://research.loginsoft.com/threat-research/icedid-malware-traversing-through-its-various-incarnations/

#threatintel #threathunting #malware #dfir

We're excited to welcome @loginsoft to the Tidal Product Registry! You can now explore their System-41 analytics to detect potential cyber threats in the Tidal Community Edition, and add them to your matrix to check coverage against specific threat actors or groups. Be sure to check them out!

https://hubs.la/Q01NkXgn0

#tidalproductregistry #threatinformeddefense #threatintel #cybersecurity

@HcInfosec Mural seems a commercial product but freemium version serves my purpose. Cool thing is that, they offer tagging and searching features

Hey all, here I created a quick map of resources if you're interested in hunting/tracking
threat actors or malware. You can learn different techniques employed by researchers in our community.

I am not keeping this list to just infostealers, will keep updating with more.

https://app.mural.co/invitation/mural/myexperiments5672/1682262220911?sender=u474b3a087bc592a418973696&key=e3c239d4-5a5a-44f5-b184-eb0897045906

I am using Mural for mindmap which has cool features like search & tagging..

#threatintel #infosec #cybersecurity #malware #threathunting

QakBot Malware Used Unpatched Vulnerability to Bypass Windows OS Security Feature

https://blog.eclecticiq.com/qakbot-malware-used-unpatched-vulnerability-to-bypass-windows-os-security-feature

#infosec #malware #threatintel #dfir

Decrypted: BianLian Ransomware

https://decoded.avast.io/threatresearch/decrypted-bianlian-ransomware/

#infosec #threatintel #ransomware

Breaking the silence - Recent Truebot activity

https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/

#infosec #threatintel #dfir #malware

A Variant Of CIA’s HIVE Attack Kit Emerges

https://blog.netlab.360.com/headsup_xdr33_variant_of_ciahive_emeerges/

#infosec #threatintel #malware #ransomware

This is beyond the Threat Attribution..! Great Post

https://analyst1.com/ransomware-diaries-volume-1

#infosec #threatintel

Detecting malicious artifacts using an ETW consumer in kernel mode

https://www.countercraftsec.com/blog/detecting-malicious-artifacts-using-an-etw-consumer-in-kernel-mode/

#dfir #threathunting #infosec

IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

https://www.trendmicro.com/en_us/research/22/l/icedid-botnet-distributors-abuse-google-ppc-to-distribute-malware.html?

#infosec #threatintel #dfir #malware

Analyzing Rhadamanthys Stealer

https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88

#infosec #threatintel #threathunting #dfir

NoName057(16) – The Pro-Russian Hacktivist Group Targeting NATO

https://www.sentinelone.com/labs/noname05716-the-pro-russian-hacktivist-group-targeting-nato/

#infosec #threatintel #dfir

Kasablanka #APT Group Probably Conducted Compaigns Targeting Russia

https://ti.qianxin.com/blog/articles/Kasablanka-Group-Probably-Conducted-Compaigns-Targeting-Russia/

#threatintel #infosec #cybersecurity

@rmceoin This is interesting, took some time to investigate. I feel this is an Ad campaign, not a malware campaign. These domains behaves differently on each time you browse. I have observed these redirecting to mcafee, Opera GX products and some lame hentai-porn. On the last run, it redirected to chrome extension market place to download an extension which I could not find it on google neither on CRXcavator. Thought to analyze the extension for crown jewels

here's the analysis, take a look at recording.
https://tria.ge/230108-nyx8xade24/behavioral1

I think it redirects to google.com if there's no referrer header

https://urlscan.io/result/b99cf01d-a7ec-4fee-94b9-62c7b8700929/

here's crxcavator giving 404. This is important because they scan the marketplace very frequently and maintain historical data. So logically, I should find this extension if it exists.

https://crxcavator.io/report/ifidkgmkpihooaknfaapgkejcgcbniek/

anyone else from #infosec can shed some light :flan_shrug:​

BitRAT Now Sharing Sensitive Bank Data as a Lure

https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

#infosec #threatintel

Detecting Unconstrained Delegation Exposures in AD Environment

https://www.sentinelone.com/blog/detecting-unconstrained-delegation-exposures-in-ad-environment/

#infosec #DFIR

Security Support Provider (SSP) for Credential Dumping

https://www.sentinelone.com/blog/how-attackers-exploit-security-support-provider-ssp-for-credential-dumping/

#infosec #dfir #redteam