As always, thanks to those who give a little back for their support!

FORENSIC ANALYSIS

• Patrick Bennett at CrowdStrike
  The Call Is Coming from Inside the House: CrowdStrike Identifies Novel Exploit in VOIP Appliance
  
  
• Cyber Social Hub
  How To Use ExifTool To Look At Metadata
  
  
• Digital Forensics Myanmar
  • eCDFP Module (5) File System Analysis (Part-6)  (NTFS File System Analysis)
  • OSINT Critical Thinking For Social Media
    
    
• Elcomsoft
  • checkm8 Extraction: the iPads, iPods, and TVs
  • Logical Acquisition: Not as Simple as It Sounds
  • GPU Acceleration: Attacking Passwords with NVIDIA RTX Series Boards
    
    
• Emma at ‘The Forgotten Nook’
  Magnet Forensics June 2022 CTF – Linux
  
  
• Michael Karsyan at Event Log Explorer blog
  Event Log Explorer Forensic Edition – working with damaged logs or disks
  
  
• Falcon Guard
  Acquiring Forensic Artifacts with Falcon Uploader and Amazon S3 Buckets
  
  
• Forensafe
  • Investigating Windows Management Instrumentation (WMI)
  • Windows Network Interfaces
    
    
• Heather Mahalik at Cellebrite
  Part 1: CTF 2022 Write Up – Marsha’s PC
  
  
• Kevin Pagano at Stark 4N6
  • Magnet User Summit 2022 CTF – Egg Hunt
  • Magnet User Summit 2022 CTF – iPhone
    
    
• Microsoft 365 Security
  How do I approach a technical topic? – Packet Capture (Part 1)
  
  
• Shanna Daly at ‘Fancy Forensics’
  ACSC BSides IR Challenge 2021 – 08 – Alternate Persistence
  

THREAT INTELLIGENCE/HUNTING

• Anastasios Pingios
  The forgotten SUAVEEYEFUL FreeBSD software implant of the EQUATION GROUP
  
  
• Anomali
  • Anomali Cyber Watch: GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool, DragonForce Malaysia OpsPatuk / OpsIndia and More
  • Cyber Threats Are as Bad as You Imagine, But Different Than You May Think
    
    
• AttackIQ
  Response to US-CERT Alert (AA22-174A): Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems 
  
  
• Avertium
  An In-Depth Look at Chinese APT, Aoqin Dragon
  
  
• Brad Duncan at Malware Traffic Analysis
  2022-06-21 – aa distribution Qakbot with DarkVNC and  Cobalt Strike
  
  
• CERT Ukraine
  • Кібератака групи APT28 з використанням шкідливої програми CredoMap (CERT-UA#4843)
  • Кібератака групи UAC-0098 на об’єкти критичної інфраструктури України (CERT-UA#4842)
  • Кібератаки груп, асоційованих з Китаєм, у відношенні російських науково-технічних підприємств та державних органів (CERT-UA#4860)
  • Кібератака у відношенні операторів телекомунікацій України з використанням шкідливої програми DarkCrystal RAT (CERT-UA#4874)
  • Sintesi riepilogativa delle campagne malevole nella settimana del 18 – 24 giugno 2022
    
    
• Check Point Research
  • 20th June – Threat Intelligence Report
  • Chinese actor takes aim, armed with Nim Language and Bizarro AES
    
    
• Cisco’s Talos
  • Avos ransomware group expands with new attack arsenal
  • Threat Roundup for June 17 to June 24
    
    
• Cleafy
  BRATA is evolving into an Advanced Persistent Threat
  
  
• Greg Darwin at Cobalt Strike Research and Development
  Arsenal Kit Update: Thread Stack Spoofing
  
  
• Covertshell
  Threat Hunting | Qbot (a.k.a Qakbot or Quakbot or Pinkslipbot)
  
  
• CyberCX
  Threat Advisory. Russian travel sanctions against an additional 121 Australians: Impacts for Australian organisations’ cyber risk
  
  
• Cybereason
  • THREAT ALERT: Follina/MSDT Microsoft Office Vulnerability
  • Cybereason vs. Black Basta Ransomware
    
    
• Cyble
  • Quantum Software:  LNK file-based builders growing in popularity
  • Keona Clipper Leverages Telegram for Anonymity
  • “NightLion” Worm Strikes Again
  • Amazon S3 Bucket Misconfigurations Continue to Trouble Enterprises
  • Matanbuchus Loader Resurfaces
    
    
• Cyborg Security
  Qakbot
  
  
• Kevin Libby at DomainTools
  Timing Is Everything
  
  
• Eclypsium
  May Firmware Threat Report
  
  
• Esentire
  Socgholish to Cobalt Strike in 10 Minutes
  
  
• Gianni Castaldi at Kusto King
  Detecting the DFSCoerce attack
  
  
• Benoit Sevens and Clement Lecigne at Google Threat Analysis Group
  Spyware vendor targets users in Italy and Kazakhstan
  
  
• Drew Schmitt at GuidePoint Security
  • GRIT Ransomware Report Spotlight: Healthcare
  • GRIT Ransomware Report Spotlight: Government
    
    
• Intel471
  The 7 common traits among highly successful cybercriminals: Part I
  
  
• Lacework
  Kubernetes tools are helpful for your team and sadly, your attacker
  
  
• Lina Lau at Inversecos
  Detecting Linux Anti-Forensics Log Tampering
  
  
• LockBoxx
  Bootcamp #24: Writing an Alert
  
  
• Marco Ramilli
  Cyber Threats Tracker: Status Update
  
  
• Matt Zorich at Microsoft Sentinel 101
  KQL lessons learnt from #365daysofKQL
  
  
• Evgeny Bogokovsky and Andrey Karpovsky at Microsoft Security
  Detecting malicious key extractions by compromised identities for Azure Cosmos DB
  
  
• MITRE-Engenuity
  • Determine, Prioritize, and Compare the Most Observed MITRE ATT&CK® Techniques
  • Put MITRE ATT&CK® at Your Fingertips
    
    
• NVISO Labs
  Cortex XSOAR Tips & Tricks – Creating indicator relationships in automations
  
  
• PhishLabs
  Q1 Phishing Volume Consistent, Up Over Q4
  
  
• Praetorian
  • Relaying to ADFS Attacks
  • How to Detect DFSCoerce
    
    
• Proofpoint
  How Threat Actors Hijack Attention: The 2022 Social Engineering Report 
  
  
• Harshal Tupsamudre at Qualys
  Defending Against Scheduled Task Attacks in Windows Environments
  
  
• Red Canary
  Intelligence Insights: June 2022
  
  
• Justin Palk at Red Siege Information Security
  Creating a Simple Windows Domain for Offensive Testing: Part 4
  
  
• SANS Internet Storm Center
  • Malicious PowerShell Targeting Cryptocurrency Browser Extensions, (Wed, Jun 22nd)
  • Experimental New Domain / Domain Age API, (Tue, Jun 21st)
  • FLOSS 2.0 Has Been Released, (Thu, Jun 23rd)
  • Python (ab)using The Windows GUI, (Fri, Jun 24th)
  • Malicious Code Passed to PowerShell via the Clipboard, (Sat, Jun 25th)
    
    
• Securelist
  • ‘Unpacking’ technical attribution and challenges for ensuring stability in cyberspace
  • The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs
    
    
• Security Investigation
  • Weird Trick to Block Password-Protected Files to Combat Ransomware
  • Anatomy Of An Advanced Persistent Threat Group
  • New Aggah Campaign returns with new TTPS – Detection & Response
  • Russia’s APT28 Launches Follina Exploit Campaign
  • IcedID Banking Trojan returns with new TTPS – Detection & Response
  • MITRE D3FEND Knowledge Guides to Design Better Cyber Defenses
    
    
• Vikram Navali at SentinelOne
  Detecting Unconstrained Delegation Exposures in AD Environment
  
  
• John Shier at Sophos
  Active Adversary Playbook 2022 Insights: Web Shells
  
  
• Stefano Chierici at Sysdig
  How to detect the containers’ escape capabilities with Falco
  
  
• Satnam Narang at Tenable
  Understanding the Ransomware Ecosystem: From Screen Lockers to Multimillion-Dollar Criminal Enterprise
  
  
• David Harrington at Varonis
  Ryuk Ransomware: Breakdown and Prevention Tips
  
  
• Josue Ledesma at Varonis
  Evil Twin Attack: What It Is, How to Detect & Prevent It
  
  
• Andy Gill at ZeroSec
  Azure Attack Paths: Common Findings and Fixes (Part 1)
  

UPCOMING EVENTS

• Celeste Bishop and Charles Goldberg at AWS Security
  AWS re:Inforce 2022: Threat detection and incident response track preview
  
  
• CCL Solutions
  RabbitHole webinars – Registration now open
  
  
• Fitri Talhah and Frederick Huang at Cellebrite
  Exclusive upgrades that will dramatically speed up investigations
  
  
• Countercraft
  {Webinar} BPFDoor and So Much More: An Analysis of Linux Network Passive Backdoors
  
  
• Magnet Forensics
  • Top Cyber Threats to Financial Services & How to Rapidly Investigate with Digital Forensic Solutions
  • Bringing Your Investigators and Their Evidence Together with Magnet REVIEW
  • Tips & Tricks // Jumpstart Your IR Investigations with YARA Rules
    
    
• Alexa Rzasa at Mandiant
  Attack Surface Management Identifies Critical Issues
  
  
• Rianna MacLeod at Sucuri
  2021 Threat Report Webinar
  

PRESENTATIONS/PODCASTS

• Jessica Hyde at Hexordia
  What is Digital Forensics
  
  
• Ali Hadi
  • LNK File Testing and New Findings (Discussion)
  • Reading NTFS Dataruns
  • MFT Slack Space Discussion (No longer There)!
    
    
• Archan Choudhury at BlackPerl
  Linux Memory Analysis with Volatility- 101, Compromised Linux System
  
  
• Black Hat
  • The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT
  • SideWinder Uncoils to Strike
    
    
• Black Hills Information Security
  • Talkin’ About Infosec News – 5/23/2022
  • BHIS – Talkin’ Bout [infosec] News 2022-06-20
  • Talkin’ About Infosec News – 6/6/2022
  • Talkin’ About Infosec News – 6/13/2022
  • Creating a Honey Pot in Azure
  • Talkin’ About Infosec News – 6/20/2022
    
    
• Cloud Security Podcast by Google
  EP71 Attacking Google to Defend Google: How Google Does Red Team
  
  
• InfoSec_Bret
  SA – SOC167-117 – LS Command Detected in Requested URL
  
  
• John Hammond
  TEARING DOWN the DOMAIN CONTROLLER (Active Directory #04)
  
  
• Magnet Forensics
  • Chat Thread Previews in Magnet REVIEW
  • Important Information at a Glance: Magnet REVIEW Device Dashboard
  • How to Investigate a Data Breach
  • Tesla Forensics – The Wheels Are There So the Computers Don’t Drag On the Ground
  • Forensic Readiness: A Panacea to Successful Incident Response
    
    
• Paraben Corporation
  • Capture Twitter social media data with compliance archives
  • AppCompact Cache parsing
  • Reviewing Data from AmCache
    
    
• SANS Cloud Security
  • Cloud Security for Beginners: Part2
  • New Paradigms for Cloud Security: Keynote
  • Where We Are Going We Don’t Need Roads
  • 2022 CloudSecNext Jon Zeolla
    
    
• SANS Institute
  • RSAC Livestream Review
  • Learning to Combat Ransomware
    
    
• Sumuri
  How Apple Metadata Can Help Your Investigations
  
  
• The Defender’s Advantage Podcast
  Skills Gap: Bridging the Skills Gap
  
  
• The Ransomware Files
  Travelex
  
  
• Uriel Kosayev
  Red Team – Supply Chain Edition
  

MALWARE

• ASEC
  • Bumblebee Being Distributed in Korea Through Email Hijacking
  • Windows MSDT Zero-day Vulnerability ‘DogWalk’ Detected by V3
  • LockBit Ransomware Disguised as Copyright Claim E-mail Being Distributed
    
    
• CISA Analysis Reports
  • MAR-10382580-1.v1 – Unidentified RAT
  • MAR-10382254-1.v1 – XMRIG Cryptominer
    
    
• Cryptax
  Tracking Android/Joker payloads with Medusa, static analysis (and patience)
  
  
• Didier Stevens
  • Another Exercise In Encoding Reversing
  • Examples Of Encoding Reversing
    
    
• Esentire
  eSentire Threat Intelligence Malware Analysis: PINGPULL RAT
  
  
• Igor Skochinsky at Hex Rays
  Igor’s tip of the week #95: Offsets
  
  
• Pedram Amini at InQuest
  Follina, the Latest in a Long Chain of Microsoft Office Exploits
  
  
• Lab52
  MuddyWater’s “light” first-stager targetting Middle East
  
  
• Malware Hell
  • KVM Malware Lab Guide
  • Malware Analysis for Beginners
    
    
• Malwarebytes Labs
  • Client-side Magecart attacks still around, but more covert
  • Russia’s APT28 uses fear of nuclear war to spread Follina docs in Ukraine
    
    
• Lakshya Mathur at McAfee Labs
  Rise of LNK (Shortcut files) Malware
  
  
• OALABS Research
  Matanbuchus Triage Notes
  
  
• Mark Lim and Riley Porter at Palo Alto Networks
  There Is More Than One Way to Sleep: Dive Deep Into the Implementations of API Hammering by Various Malware Families
  
  
• Pete Cowman at Hatching
  BumbleBee Fix and New Extractors
  
  
• petikvx
  • Evilnominatus Ransomware
  • Crypt130 Ransomware and how to recovery your files (very easy)
  • Kanalia Ransomware
  • Deadfiles Ransomware
  • Crackme – Crackme 5 Detten – Patching
  • Blackmatter Ransomware x15ZGBhZX
    
    
• Giampaolo Dedola at Securelist
  APT ToddyCat
  
  
• Ax Sharma at Sonatype
  • This Week in Malware—show me your secrets!
  • Python packages upload your AWS keys, env vars, secrets to the web
    
    
• Mohamed Ashraf at XJunior
  • Deep Analysis of Mars Stealer
  • Deep Analysis of Snake Keylogger
  • APT34 – Saitama Agent
    

MISCELLANEOUS

• Adrian at ‘Agood cloud’
  Docker Config: Thehive5 with Cortex and n8n
  
  
• Anton Chuvakin
  Does the World Need Cloud Detection and Response (CDR)?
  
  
• Breachquest
  Introducing…..Percy Alexander
  
  
• Brett Shavers
  The spark of a book
  
  
• Cloudflare
  • Next generation intrusion detection: an update on Cloudflare’s IDS capabilities
  • Introducing Cloudforce One: our new threat operations and research team
  • Bring your own license and threat feeds to use with Cloudflare One
  • Announcing Gateway + CASB
    
    
• Forensic Focus
  • A Systematic Approach to Understanding MACB Timestamps on Unixlike Systems
  • Detego Global and Forensic Computers Inc. Team Up to Deliver Two Specialist Webinars
  • Register for Webinar: GrayKey Passcode History File and Hashcat (Law Enforcement Only)
  • Quantifying Data Volatility for IoT Forensics With Examples From Contiki OS
  • Digital Forensics Research Update: May 2022
  • Magnet REVIEW 4.0: Helping You Bring Investigators and Their Evidence Together
    
    
• Jamf
  What is Endpoint Detection and Response (EDR)?
  
  
• Elli at Misconfig
  • Chain of Custody
  • DFIR Tools 4 All
    
    
• ADF
  • Top 4 Ways to Amplify Cyber Security with Investigation Software
  • Crime Investigation Software: Gain Intelligence on Cybercrime
    
    
• Robert Giczewski
  How to install yara from source on macOS Monterey (M1)
  
  
• Ryan Campbell at ‘Security Soup’
  Weekly News Roundup — June 12 to June 18
  
  
• Michelle Petersen at SANS
  That’s a Wrap! Looking Back on SANS at RSAC 2022
  

SOFTWARE UPDATES

• ANSSI DFIR-ORC
  v10.1.1
  
  
• Atola
  Atola Insight Forensic 5.2.1
  
  
• Cado Security
  Cado Security Unveils Cross Cloud Support to Streamline Cloud Investigations
  
  
• Elcomsoft
  Elcomsoft iOS Forensic Toolkit 8.0 beta 9 adds checkm8 extraction of 14 iPad and iPod Touch devices
  
  
• Eric Zimmerman
  ChangeLog
  
  
• Foxton Forensics
  Browser History Examiner — Version History – Version 1.16.9
  
  
• Hasherezade
  pe-bear 0.5.5.4
  
  
• Magnet Forensics
  Magnet REVIEW 4.0: Helping You Bring Investigators and Their Evidence Together
  
  
• William Ballenthin, Moritz Raabe, and Blaine Stancill at Mandiant
  FLOSS Version 2.0
  
  
• radare2
  radare2 5.7.2
  
  
• Rapid7
  Velociraptor Version 0.6.5: Table Transformations, Multi-Lingual Support, and Better VQL Error-Handling Let You Dig Deeper Than Ever
  
  
• Martin Korman
  Regipy 2.5.4
  
  
• Rizin
  cutter v2.1.0-rc2
  
  
• Xways
  X-Ways Forensics 20.6 Preview 7
  

And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!