As always, thanks to those who give a little back for their support!

FORENSIC ANALYSIS

• Andrea Fortuna at ‘So Long, and Thanks for All the Fish’
  If you’re a fan of Volatility, you’ll love CrowdStrike’s SuperMem
  
  
• Atomic Matryoshka
  AutoRun Malware: Why your computer is summoning dark lords after you plugged in that parking lot USB
  
  
• Dr. Brian Carrier at Cyber Triage
  Cyber Triage on Google Cloud: DFIR in the Cloud
  
  
• Forensafe
  • Investigating Sticky Notes
  • Investigating Last Accessed Key
    
    
• Ian Whiffin at DoubleBlak
  iOS GeoFences
  
  
• Christopher Peacock at Scythe
  SCYTHE Presents: Threat Thursday – NetWire RAT
  
  
• Kevin Pagano at Stark 4N6
  Restore Log – Tracking iOS Update History
  
  
• Joachim Metz at Open Source DFIR
  Pearls and pitfalls of timeline analysis
  
  
• Junhyeong Lee at Plainbit
  [TIP#8] UserAssist
  
  
• Recorded Future
  How To Assess a Potential Phishing Email
  
  
• Matt Graeber at Red Canary
  Better know a data source: Process command line
  
  
• John Dwyer at Security Intelligence
  Detections That Can Help You Identify Ransomware
  
  
• Security Onion
  • Quick Malware Analysis: Remcos RAT pcap from 2021-01-06
  • Quick Malware Analysis: AngryPoutine exercise pcap from 2021-09-10
  • Quick Malware Analysis: Qakbot spambot pcap from 2021-10-01
  • Quick Malware Analysis: Stolen Images Evidence and Sliver pcap from 2021-10-20
  • Quick Malware Analysis: TA551/SHATHAK and Sliver pcap from 2021-10-20
    
    
• Bill Marczak, John Scott-Railton, Siena Anstis, Bahr Abdul Razzak, and Ron Deibert at ‘The Citizen Lab’
  Breaking the News: New York Times Journalist Ben Hubbard Hacked with Pegasus after Reporting on Previous Hacking Attempts
  
  
• The DFIR Report
  IcedID to XingLocker Ransomware in 24 hours
  
  
• TheHexNinja
  • Shhh we’re hunting Phishers…  %50%68%69%73%68%69%6E%67 or UGhpc2hpbmc=
  • Shhh we’re still hunting Phishers    Part 2
    
    
• Williams Kosasi
  • Digital Forensic Challenge 2021 Writeup (208 — iOS Fridump)
  • Digital Forensics Challenge 2021 Writeup (308— Find Forged Record)
    

THREAT INTELLIGENCE/HUNTING

• 360 Netlab
  七年一剑，360 DNS威胁分析平台
  
  
• 360 核心安全技术博客
  预警：警惕黑客借“提币潮”牟利
  
  
• Anomali
  Anomali Cyber Watch: FIN12 Ramps-Up in Europe, Interactsh Being Used For Malicious Purposes, New Yanluowang Ransomware and More
  
  
• Anton Chuvakin
  Do You Trust Your SIEM?
  
  
• Azure Sentinel
  • MITRE ATT&CK technique coverage with Sysmon for Linux
  • What’s New: Azure Sentinel Threat Intelligence Workbook
    
    
• Brad Duncan at Malware Traffic Analysis
  • 2021-10-01 – TR Qakbot (Qbot) infection with spambot activity
  • 2021-10-04 – MirrorBlast/Kixtart, ReflectiveGnome, and FlawedGrace infection
  • 2021-10-05 – MirrorBlast/Kixtart infection
  • 2021-10-06 – Stolen Images Evidence campaign pushes Gozi/ISFB/Ursnif
  • 2021-10-12 – Stolen Images Evidence campaign pushes IcedID (Bokbot)
  • 2021-10-13 – Malspam-based Dridex activity
  • 2021-10-14 – Stolen Images Evidence campaign pushes BazarLoader
  • 2021-10-22 – Files for an ISC diary (October 2021 Forensic Contest)
  • 2021-10-20 – TA551 (Shathak) pushes Sliver-based malware
  • 2021-10-20 – Files for an ISC diary (Stolen Images Evidence –> Sliver)
    
    
• BushidoToken
  Ransomware Decryption Intelligence
  
  
• CERT-AGID
  Nuova campagna malspam AteraAgent a tema Dike
  
  
• Check Point
  18th October – Threat Intelligence Report
  
  
• CISA
  Alert (AA21-291A) BlackMatter Ransomware
  
  
• Cisco’s Talos
  • Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India
  • Threat Roundup for October 15 to October 22
    
    
• CrowdStrike
  • LightBasin: A Roaming Threat to Telecommunications Companies
  • Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign
    
    
• Curated Intelligence
  Initial Access Broker Landscape
  
  
• Brianna Leddy at Darktrace
  Recycling ransomware: The return of Ryuk
  
  
• Didier Stevens
  “Public” Private Cobalt Strike Keys
  
  
• Elliptic
  DarkSide bitcoins on the move following government cyberattack against REvil ransomware group
  
  
• Erik Hjelmvik at Netresec
  How the SolarWinds Hack (almost) went Undetected
  
  
• Flashpoint
  REvil Disappears Again: ‘Something Is Rotten in the State of Ransomware’
  
  
• Gemini Advisory
  • Cybercriminals Abuse Donation Sites for Card Testing
  • FIN7 Recruits Talent For Push Into Ransomware
    
    
• Ashley Shen at Google Threat Analysis Group
  Phishing campaign targets YouTube creators with cookie theft malware
  
  
• Patrick Schläpfer at HP Wolf Security
  MirrorBlast and TA505: Examining Similarities in Tactics, Techniques and Procedures
  
  
• Caleb Stewart at Huntress
  Threat Advisory: Hackers Are Exploiting a Vulnerability in Popular Billing Software to Deploy Ransomware
  
  
• Dusty Miller at Hurricane Labs
  GreyNoise: Alert Tuning for the SOC Analyst’s Soul
  
  
• Pratinav Chandra at InfoSec Write-ups
  Windows Threat Hunting : Processes of Interest
  
  
• Dmitry Melikov at InQuest
  Advanced Qbot Downloader
  
  
• Karlo Licudine at AccidentalRebel
  New Tool Preview: vATT&CK
  
  
• Malwarebytes Labs
  • “Killware”: Is it just as bad as it sounds?
  • Protect yourself from BlackMatter ransomware: Advice issued
  • REvil ransomware disappears after Tor services hijacked
  • Chrome targeted by Magnitude exploit kit
    
    
• Microsoft Security
  • New Microsoft Sysmon report in VirusTotal improves security
  • Franken-phish: TodayZoo built from other phishing kits
    
    
• Amy L. Robertson, Alexia Crumpton, and Chris Ante at MITRE ATT&CK
  Introducing ATT&CK v10: More Objects, Parity and Features
  
  
• NCC Group Research
  • Cracking RDP NLA Supplied Credentials for Threat Intelligence
  • Detecting and Protecting when Remote Desktop Protocol (RDP) is open to the Internet
    
    
• Nik Alleyne at ‘Security Nik’
  Pivoting / Relaying SSH communication through ncat, iptables, netsh, SSH and getting internet access via SSH “dynamic” application port forwarding
  
  
• Brad Duncan at Palo Alto Networks
  Case Study: From BazarLoader to Network Reconnaissance
  
  
• Penetration Testing Lab
  Lateral Movement – WebClient
  
  
• Pete Cowman at Hatching
  One-man tweak plus AtomSilo and STRRAT detections
  
  
• Proofpoint
  • Whatta TA: TA505 Ramps Up Activity, Delivers New FlawedGrace Variant
  • TA551 Uses ‘SLIVER’ Red Team Tool in New Activity
    
    
• RiskIQ
  • Discord CDN Abuse Found to Deliver 27 Unique Malware Types
  • The Threat Landscape is Dynamic and Ever-Changing — Can You Keep Up?
    
    
• V3ded
  Utilizing Programmatic Identifiers (ProgIDs) for UAC Bypasses
  
  
• SANS Internet Storm Center
  • Malicious PowerShell Using Client Certificate Authentication, (Mon, Oct 18th)
  • Can you make the Great Chinese Firewall work for you?, (Tue, Oct 19th)
  • “Stolen Images Evidence” campaign pushes Sliver-based malware, (Thu, Oct 21st)
  • October 2021 Contest: Forensic Challenge, (Fri, Oct 22nd)
  • YARA Release v4.1.3, (Sat, Oct 23rd)
  • Reader Malware: ZIP/HTML Phish, (Sat, Oct 23rd)
  • Phishing ZIP With Malformed Filename, (Sun, Oct 24th)
    
    
• Securelist
  • Lyceum group reborn
  • Russian-speaking cybercrime evolution: What changed from 2016 to 2021
    
    
• Security Investigation
  • Threat Hunting with EventID 5145 – Object Access – Detailed File Share
  • Advanced Hunting to Find the Ransomware
  • Persistence Remote Password Reset – Event IDs to Monitor
  • What is the MITRE ATT&CK Framework? How Is It Useful
    
    
• Bradley Collis at Sophos
  • Secrets of a security analyst: Investigating an incident
  • Secrets of a security analyst: Starting a threat hunt
    
    
• Matt Hand and Emily Leidy at SpecterOps
  Life is Pane: Persistence via Preview Handlers
  
  
• Symantec Enterprise
  • Harvester: Nation-state-backed group uses new toolset to target victims in South Asia
  • New Espionage Campaign Targets South East Asia
    
    
• Taha Karim at Confiant
  Profiling hackers using the Malvertising Attack Matrix by Confiant
  

UPCOMING EVENTS

• Belkasoft
  [webinar] Forensic Analysis Of LNK Files
  
  
• Magnet Forensics
  • Putting Your DFIR Lab in the Cloud: Lessons Learned
  • Tips & Tricks // Analyzing Vehicle Data with Berla iVe
    
    
• Semantics 21
  LASERi-X v2.2 Demonstration
  
  
• Skyler Curtis and Richard Chitamitre at Cyborg Security
  The callback is coming from inside the house!
  

PRESENTATIONS/PODCASTS

• Alexis Brignoni on the Forensic Focus podcast
  Alexis Brignoni on Teaching and Learning Python: Why It’s Important and What’s Involved
  
  
• Belkasoft
  Qualcomm Acquisition—9th episode of BelkaTalk on DFIR
  
  
• Black Hat
  • Active Directory Security in the Cloud Age
  • Understanding and Addressing The True Risks Facing Connected Machinery / Operational Technology
  • Ransomware, ICS Risk & Cyber-Mercenaries: Cybercrime in 2021
  • Featuring Lenny Zeltser, CISO for Axonius
    
    
• Black Hills Information Security
  Talkin’ About Infosec News – 10/19/2021
  
  
• Cellebrite
  Ask the Expert: Live Q and A at the Cellebrite Envisioning Center
  
  
• CIRCL Luxembourg
  Virtual MISP Summit 0x06
  
  
• Cisco’s Talos
  Beers with Talos, Ep. #110: The 10 most-exploited vulnerabilities this year (You won’t believe No. 6!)
  
  
• Cloud Security Podcast by Google
  EP39 From False Positives to Karl Popper: Rationalizing Cloud Threat Detection
  
  
• Cybereason
  Malicious Life Podcast: Operation GhostShell – An Iranian Espionage Campaign
  
  
• Day Cyberwox
  Wireshark Course for Cybersecurity Beginners
  
  
• DFIR Science
  • searchScreenshots – find screenshots in a disk image
  • Automatically extract faces from video – Tsurugi Linux – video2faces
  • Find and sort files by extension in the Linux command line
    
    
• Digital Detectives
  The SANS Institute and Cybersecurity Careers
  
  
• Digital Forensic Survival Podcast
  DFSP # 296 – Case Study Turla-Comrat
  
  
• Jess Garcia
  [BLOG]  SANS Threat Hunting Summit & Training 2021 – “Hunting mediante la detección de anomalías con Machine Learning y DAISY” – Wrap-Up & Community Resources Announced, by  Jess Garcia
  
  
• Florian Roth
  Sigma Hall of Fame – EU ATT&CK User Workshop, October 2021
  
  
• InfoSec_Bret
  Malware Analysis – MSHTML
  
  
• Karsten Hahn at Malware Analysis For Hedgehogs
  Reversing – Writing an EXE4J Configuration Extractor
  
  
• Magnet Forensics
  • Downloading Data from Google with Magnet AXIOM
  • New in Magnet AXIOM 5.6: Updated Google Workflow and More Chromebook Artifacts
  • AXIOM Cyber 5.6: Upgraded Agent Status Dashboard, FIPS, Google Workspace Improvements, and more!
    
    
• Paraben Corporation
  • Opening Opera & Brave Browser Data
  • Search Results in E3 Forensic Reports
  • Processing MBox Email Archives in E3
  • Dropbox Cloud Data Acquisition
    
    
• Ryan Chapman
  Much Ado About Ransomware
  
  
• SANS
  • SANS Threat Analysis Rundown | Katie Nickels and Runa Sandvik
  • The New ICS418: Training OT Security Managers | REBROADCAST
    
    
• Sumuri
  SUMURI Podcast Episode 010 – TALINO Chassis Redesign and Other News
  

MALWARE

• 0xdf hacks stuff
  • Flare-On 2021: credchecker
  • Flare-On 2021: wizardcult
    
    
• Ali Aqeel
  Zloader Reversing
  
  
• Blackberry
  Threat Thursday: STRRat Malware
  
  
• Erik Pistelli at Cerbero
  • Obfuscated XLSB Malware Analysis
  • PDF JavaScript Extraction Demo Package
    
    
• Idan Shechter & Omer Ventura at Check Point
  Using Discord infrastructure for malicious intent
  
  
• hasherezade’s 1001 nights
  • Flare-On 8 – Task 7
  • Flare-On 8 – Task 9
  • Flare-On 8 – Task 6
    
    
• Igor Skochinsky at Hex Rays
  Igor’s tip of the week #61: Status bars
  
  
• Jérôme Segura at Malwarebytes Labs
  q-logger skimmer keeps Magecart attacks going
  
  
• Muthamil Mudhalvan
  Some Common API’s In Malware
  
  
• Gustavo Palazolo at Netskope
  DBatLoader: Abusing Discord to Deliver Warzone RAT
  
  
• Nikhil Rathor at 0xthreatintel
  Static Analysis of Bluelight Malware
  
  
• Didier Stevens at NVISO Labs
  Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1
  
  
• Jessica Ellis at PhishLabs
  Multi-Stage Vishing Attacks Skyrocket
  
  
• Oleg Kupreev at Securelist
  Trickbot module descriptions
  
  
• SentinelOne
  • Karma Ransomware | An Emerging Threat With A Hint of Nemty Pedigree
  • AlphaGolang | A Step-by-Step Go Malware Reversing Methodology for IDA Pro
    
    
• Squibydoo.blog
  Solarmarker: by any other name
  
  
• Abdelrhman Sharshar, Jay Yaneza, and Sherif Magdy at Trend Micro
  PurpleFox Adds New Backdoor That Uses WebSockets
  
  
• Vicente Díaz at VirusTotal
  VirusTotal Multisandbox += Microsoft Sysinternals
  
  
• Yoroi
  Spectre v4.0: the speed of malware threats after the pandemics
  
  
• Stuti Chaturvedi and Amandeep Kumar at ZScaler
  New MultiloginBot Phishing Campaign
  

MISCELLANEOUS

• Jessica Hyde at Magnet Forensics
  • Job Hunting in the Digital World
  • Getting Your Career Started in Cyber Forensics
  • MVS Career Day Recap
    
    
• Cassie Doemel at AboutDFIR
  AboutDFIR Content Update 10/23/21
  
  
• Marco Fontani at Amped
  How Can I Export a Processed Video in Amped Replay?
  
  
• Anastasios Pingios
  Offensive Security Private Companies Inventory
  
  
• Any.Run
  Ransomware: Explanation and Examples
  
  
• Yulia Samoteykina at Atola
  RAID 10 configuration autodetection and imaging
  
  
• Amina Zilic at Binalyze
  The Ninth Step to Forensic Readiness: Incident response documents and reporting
  
  
• Carlos Canto at Velocidex
  And The Winners Are…
  
  
• CrowdStrike
  Many Paths, One Goal: Forging a Career in Cybersecurity
  
  
• Forensic Focus
  • A Contemporary Investigation of NTFS File Fragmentation
  • How to Quickly Process All Your Videos (And Audio) for Release in Amped FIVE
  • [Linux] DRONE expanding to multi-platform solutions
  • FTK Feature Focus: Interface Customization
  • A Forensic Analysis of Micromobility Solutions
    
    
• Luke Wilson at Countercraft
  Defend Forward, Part Three: Taking It Operational
  
  
• ph0llux
  Zff
  
  
• Richard Frawley at ADF
  Search Profiles
  
  
• Ryan Campbell at ‘Security Soup’
  Weekly News Roundup — October 10 to October 16
  
  
• Ulf Frisk
  Modifying the Acorn CLE-215+ FPGA into a PCILeech DMA attack device
  

SOFTWARE UPDATES

• Andrew Rathbun
  KAPE-EZToolsAncillaryUpdater 2.0
  
  
• ANSSI DFIR-ORC
  v10.1.0-rc7
  
  
• Cellebrite
  Now Available: Cellebrite UFED, Cellebrite Responder, Cellebrite Physical Analyzer and Cellebrite UFED Cloud v7.49
  
  
• Costas K
  MFTBrowser.exe (x64)
  
  
• DeTTECT
  v1.4.4
  
  
• Didier Stevens
  New Tool: cs-decrypt-metadata.py
  
  
• Eric Zimmerman
  ChangeLog
  
  
• Kroll
  Kape 1.1.0.0
  
  
• Magnet Forensics
  • New in Magnet AXIOM 5.6: Updated Google Workflow and More Chromebook Artifacts
  • New in AXIOM Cyber 5.6: Upgraded Agent Status Dashboard, FIPS, Google Workspace Improvements, and a New Beta Feature!
    
    
• Malwoverview
  Malwoverview 4.4.2
  
  
• Passware
  Passware Kit 2021 v4 Now Available
  
  
• YARA
  v4.1.3
  

And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!