As always, thanks to those who give a little back for their support!

FORENSIC ANALYSIS

• Chris Vance at ‘D20 Forensics’
  • iOS 16 Breaking Down the Biomes Part 2 – AppInstalls, AppLaunch, & AppIntents
  • iOS 16 – Breaking Down the Biomes (Part 3) – Keeping up with CarPlay
  • iOS 16 – Breaking Down the Biomes (Part 4) – Surfin’ with Safari
  • iOS 16 – Breaking Down the Biomes Part 5 — “Hey Siri, find me some more data…”
    
    
• Kevin Pagano at DFIR Review
  Turbo Speed: Parsing Device Health Services from Google
  
  
• Domiziana Foti
  SOC167 — LS Command Detected in Requested URL — Letsdefend.io
  
  
• Ahmad Muneeb and Muhammad Jasim Waqar at Ebryx
  Organized ATM Jackpotting
  
  
• Forensafe
  Investigating Slack for Windows
  
  
• ForensicXlab
  📦 Volatility3 Windows Plugin : AnyDesk
  
  
• Microsoft’s ‘Security, Compliance, and Identity’ Blog
  Forensic artifacts in Office 365 and where to find them
  
  
• OpenText
  • Mobile device examination with EnCase
  • Targeted DFIR evidence collections
  • Using the Generic SQLite Database Parser EnScript in forensic examinations of a mobile device
    
    
• Oxygen Forensics
  Location Data: Parsing Semantic Location History in Google Takeout
  
  
• Rich Plummer
  Basic Concepts in Mobile Device Forensics – Part 2
  
  
• The DFIR Report
  BumbleBee: Round Two
  
  
• The Security Noob.
  [DFIR TOOLS] bstrings, what is it & how to use!
  
  
• Tyler Williams at Securonix
  Insider Threat Case Study [Misaligned Saboteur]: Hacker Leaks Offensive Security Software Data
  

THREAT INTELLIGENCE/HUNTING

• ProxyNotShell
  • Warning: New Attack Campaign Utilized A New 0-day Rce Vulnerability On Microsoft Exchange Server
  • Zero-Day Vulnerabilities Found in Microsoft Exchange (CVE-2022-41040 and CVE-2022-41082)
  • Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
  • Zero-Day Vulnerability – Microsoft Exchange
  • ProxyNotShell— the story of the claimed zero day in Microsoft Exchange
  • Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082
  • Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server
  • Exchange Server 0-Day Actively Exploited, (Fri, Sep 30th)
    
    
• Akamai
  • Purple Fox Rootkit Now Propagates as a Worm
  • FritzFrog: A New Generation of Peer-to-Peer Botnets
  • PLEASE_READ_ME: The Opportunistic Ransomware Devastating MySQL Servers
  • Flagging 13 Million Malicious Domains in 1 Month with Newly Observed Domains
    
    
• Anomali
  Anomali Cyber Watch: Sandworm Uses HTML Smuggling and Commodity RATs, BlackCat Ransomware Adds New Features, Domain Shadowing Is Rarely Detected, and More
  
  
• Antonio Piazza
  Jumping Over the Gate
  
  
• Simar Singh at Aqua
  Triaging Trivy AWS Alerts with Postee and AWS Security Hub
  
  
• Arctic Wolf
  1H 2022 Incident Response Insights from Arctic Wolf Labs
  
  
• AT&T Cybersecurity
  Stories from the SOC – C2 over port 22
  
  
• Avertium
  An In-Depth Look at APT35 aka Charming Kitten
  
  
• Bitdefender
  • Bitdefender Threat Debrief | September 2022
  • Tech Explainer | What is DLL Sideloading?
    
    
• Hector Diaz at Blackberry
  H0lyGh0st Ransomware: Watch This Unholy Threat “Meet Its Maker” (Video)
  
  
• BushidoToken
  Brute Ratel cracked and shared across the Cybercriminal Underground
  
  
• CERT Ukraine
  Щодо невідкладних заходів кіберзахисту
  
  
• Check Point Software
  Hacker Groups take to Telegram, Signal and Darkweb to assist Protestors in Iran
  
  
• Cisco’s Talos
  • New campaign uses government, union-themed lures to deliver Cobalt Strike beacons
  • Threat Source newsletter (Sept. 29, 2022) — Attackers are already using student loan relief for scams
  • Threat Roundup for September 23 to September 30
    
    
• Cluster25
  In the footsteps of the Fancy Bear: PowerPoint mouse-over event abused to deliver Graphite implants
  
  
• Corelight
  Detecting the Manjusaka C2 framework
  
  
• CrowdStrike
  • CrowdStrike Falcon Platform Identifies Supply Chain Attack via a Trojanized Comm100 Chat Installer
  • “Gitting” the Malware: How Threat Actors Use GitHub Repositories to Deploy Malware
  • The Anatomy of Wiper Malware, Part 3: Input/Output Controls
    
    
• Cyberknow
  Optus Data Breach Timeline
  
  
• Dr. Robert Ames at Security Scorecard
  Extortion and Adaptability: Ransomware Motives Remain Consistent as Tactics Change
  
  
• EclecticIQ
  • Common Attack Patterns Still Feature in Modern Cyberattacks
  • Ukraine-Russia Conflict: Ukraine Alerts Energy Enterprises to Possible Cyberattack Escalation
    
    
• Esentire
  Popular Info-Stealing Malware, SolarMarker, is Using Watering Hole Attacks and Fake Chrome Browser Updates to Infect Business Professionals, Warns eSentire
  
  
• Follow The White Rabbit
  [Euskalhack V]: Pentest Active Directory Rocks! Part III
  
  
• Shunichi Imano and James Slaughter at Fortinet
  Ransomware Roundup: Bisamware and Chile Locker
  
  
• FourCore
  Ryuk Ransomware: History, Timeline, and Adversary Simulation
  
  
• Pavle Culum and Roman Kroshinsky at Gigamon
  Investigating Web Shells
  
  
• GreyNoise
  How GreyNoise tags get created and how to use them
  
  
• Hornet Security
  Neue Umfrage: Ransomware-Angriffe nehmen weiter zu: 20% aller gemeldeten Angriffe erfolgten in den letzten 12 Monaten
  
  
• Nico Agnese, Vikas Parthasarathy, Joao Santos, Adam Sell, and Inna Vasilyeva at Human Security
  Poseidon’s Offspring: Charybdis and Scylla
  
  
• Frank Block at Insinuator
  Some experiments with Process Hollowing
  
  
• John Fokker at Trellix
  Dismantling a Prolific Cybercriminal Empire: REvil Arrests and Reemergence
  
  
• Journey Notes
  • Threat Spotlight: In-depth look at a cryptominer attack exploiting the Confluence bug
  • Threat Spotlight: Continuing attacks on Atlassian Confluence zero day
    
    
• Tyler Tracy at Logz.io
  Mind the Overspray – Password Spraying Remains a Major Threat
  
  
• Mandiant
  • Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors
  • Bad VIB(E)s Part Two: Detection and Hardening within ESXi Hypervisors
    
    
• Michael Haag
  Follina for Protocol Handlers
  
  
• Microsoft Security
  ZINC weaponizing open-source software
  
  
• Moath Maharmeh
  Ransomware: Detect & Respond
  
  
• NCC Group
  • A glimpse into the shadowy realm of a Chinese APT: detailed analysis of a ShadowPad intrusion
  • Detecting Mimikatz with Busylight
    
    
• Mayuresh Dani at Qualys
  Qualys Threat Research Thursday
  
  
• SANS Internet Storm Center
  • Easy Python Sandbox Detection , (Mon, Sep 26th)
  • DNS Option 15: Debugging DNSSEC Errors., (Tue, Sep 27th)
  • 10 Years Later: Attacker re-discovering old VTiger CRM Vulnerability?, (Wed, Sep 28th)
  • PNG Analysis, (Thu, Sep 29th)
    
    
• Scythe
  • SCYTHE Presents: Easy LOLBAS Wins for Purple Teams
  • SCYTHE Presents: Threat Emulation: Yanluowang
    
    
• mr.d0x
  Phishing With Chromium’s Application Mode
  
  
• Charlie Clark at Semperis
  New Attack Paths? AS Requested Service Tickets
  
  
• Puja Mahendru at Sophos
  The State of Ransomware in State and Local Government 2022
  
  
• Jared Atkinson at SpecterOps
  On Detection: Tactical to Functional – Part 7: Synonyms
  
  
• Sucuri
  • New Malware Variants Serve Bogus CloudFlare DDoS Captcha
  • WordPress Vulnerability & Patch Roundup September 2022
    
    
• Symantec Enterprise
  Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East
  
  
• Michael Clark at Sysdig
  Sysdig 2022 Threat Report: Cloud-native threats are increasing and maturing
  
  
• Team Cymru
  Seychelles, Seychelles, on the C(2) Shore
  
  
• Clément Notin at Tenable
  Decrypt “encrypted stub data” in Wireshark
  
  
• Teri Radichel
  VPC Flow Logs Governance
  
  
• Vicente Díaz at VirusTotal
  VT Collections: citius, altius, fortius – communiter
  
  
• Giovanni Vigna at VMware Security
  ESXi-Targeting Ransomware: The Threats That Are After Your Virtual Machines (Part 1)
  

UPCOMING EVENTS

• Chris Brenton at Active Countermeasures
  Cyber Threat Hunting Level 1 | Chris Brenton | Tuesday October 4th, 2022 | 6-Hours
  
  
• Cybereason
  Webinar October 18th 2022: The True Cost of Ransomware – Evaluating Risk and How to Avoid Attacks
  
  
• Gerald Auger at Simply Cyber
  • Anything Goes Stream – Live From Wild West Hackin’ Fest 2022
  • Want An Easy Fix For Your Table Top Exercises? Start Here!
    
    
• Pavel Yosifovich
  Next Windows Internals Training
  
  
• Recon InfoSec
  Thursday Defensive
  
  
• SANS Institute
  • Leading Cyber in a Neurodiverse Workforce
  • Security Isn’t Just a Job, It’s a Lifestyle: Tips for Ransomware Prevention
    
    
• Magnet Forensics
  • Offline iOS Tracking and Remote Wiping
  • Integrate, Automate, and Scale DFIR Investigations With Magnet AUTOMATE Enterprise
  • Tips & Tricks// A New Yet Familiar Look at Email Evidence in AXIOM Cyber

PRESENTATIONS/PODCASTS

• Chris Brenton at Active Countermeasures
  Threat Hunting Shorts – External Target Investigation – Video Blogs
  
  
• AhmedS Kasmani
  Racoon Stealer V2 Malware Analysis
  
• Alexander Adamov at ‘Malware Research Academy’
  • Analysis of Cyberweapons – Ep1: Overview of Russian cyberattacks in 2022. WhisperGate operation
  • Analysis of Cyberweapons – Ep2: Static analysis of WhisperGate’s stage2.exe component
    
• ArcPoint Forensics
  UNALLOCATED SPACE S1: EP11 ASK US ANYTHING
  
• Black Hills Information Security
  • BHIS – Talkin’ Bout [infosec] News 2022-10-03
  • BHIS – Talkin’ Bout [infosec] News 2022-09-26
  • Constrained Language Mode Bypass When __PSLockDownPolicy Is Used
  • AASLR: Job Hunting Like a Hacker with Jason Blanchard
  • AASLR: Cyber Range Challenge Walkthrough/Solutions w/ Serena
  • Why You Really Need to Stop Disabling UAC
    
• Chris Stanko at Data Rescue Labs Inc.
  Forensic tools and iOS 16
  
• Dark Mode
  Demystifying ransomware leaks and data extortion on the dark web – James Hammond
  
• Digital Forensic Survival Podcast
  DFSP # 345 – AutoRuns
  
• Down the Security Rabbithole Podcast
  DtSR Episode 519 – Insights From an Industry Leader
  
• Erik Hjelmvik at Netresec
  Hunting for C2 Traffic
  
• Fleet
  Future of device management episode 6
  
• Gerald Auger at Simply Cyber
  Want to See Blackmatter Ransomware Group in Action? 🔥
  
• InfoSec_Bret
  Malware Analysis – Suspicious Browser Extension
  
• Insane Forensics
  How to Threat Hunt For Wireless Network Compromise
  
• MalGamy
  • Learn how to resolve APIs with Bl00dy ransomware
  • Reverse sample.reg challenge Black Hat CTF2022
  • Reverse FinalGate challenge Black Hat CTF2022
    
• Malwarebytes Labs
  Calling in the ransomware negotiator, with Kurtis Minder: Lock and Code S03E20
  
• Magnet Forensics
  Roundtable: How Can We Share Digital Evidence Most Effectively?
  
• OALabs
  Process Memory Basics for Reverse Engineers – Tracking Memory With A Debugger [ Patreon Unlocked ]
  
• RickCenOT
  Pentesting Industrial Control Systems Workshop
  
• SANS Institute
  Announcing 2022 SANS Difference Makers Awards
  
• StealthBay
  Podcast Episode 4 – Lets talk about Defcon
  
• Sumuri
  How to use StoryBoard in RECON LAB!
  
• The Defender’s Advantage Podcast
  Threat Trends: Metador, Mercenaries, and LABScon with SentinelOne
  

MALWARE

• Any.Run
  How to Do Malware Analysis. Infographic
  
  
• ASEC
  • NSIS Type of LockBit 3.0 Ransomware Disguised as Job Application Emails Being Distributed
  • ASEC Weekly Malware Statistics (September 19th, 2022 – September 25th, 2022)
  • LockBit 3.0 Ransomware Distributed via Word Documents
  • ASEC Weekly Malware Statistics (September 12th, 2022 – September 18th, 2022)
    
    
• Ayedaemon
  Fun with Master Boot Record
  
  
• CISA Analysis Reports
  • MAR-10401765-1.v1 – Zimbra 3
  • MAR-10400779-2.v1 – Zimbra 2
  • MAR-10400779-1.v1 – Zimbra 1
    
    
• Anandeshwar Unnikrishnan at CloudSEK
  Technical Analysis of MedusaLocker Ransomware
  
  
• Cyber Geeks
  A technical analysis of Pegasus for Android – Part 2
  
  
• Bret at Cyber Gladius
  LetsDefend’s Malware Analysis: Suspicious Browser Extension Walk-Through
  
  
• Cyble
  • New information stealer targeting crypto-wallets
  • Bl00dy – New Ransomware Strain Active in the Wild
  • Swachhta platform hacked by Threat Actor “LeakBase”
  • Fabricated Bank website distributes Android Spyware
  • Fake Streaming Site Spreading Proxyware
    
    
• Didier Stevens
  Taking A Look At PNG Files with pngdump.py Beta Version 0.0.3
  
  
• Igor Skochinsky at Hex Rays
  Igor’s tip of the week #108: Raw memory accesses in pseudocode
  
  
• John Hammond
  PowerShell – Observing Inline C# Compilation with Add-Type
  
  
• Lumen
  Chaos is a Go-based Swiss army knife of malware
  
  
• Muhammad Hasan Ali at muha2xmad
  Technical analysis of Alien android malware
  
  
• Palo Alto Networks
  • Hunting for Unsigned DLLs to Find APTs
  • More Than Meets the Eye: Exposing a Polyglot File That Delivers IcedID
    
    
• Pete Cowman at Hatching
  Triage Thursday Ep. 87
  
  
• John deGruyter at SANS
  Emulate Shellcode with Radare2
  
  
• Securelist
  • NullMixer: oodles of Trojans in a single dropper
  • Prilex: the pricey prickle credit card complex
  • The secrets of Schneider Electric’s UMAS protocol
    
    
• Securonix
  Securonix Threat Labs Security Advisory: Detecting STEEP#MAVERICK: New Covert Attack Campaign Targeting Military Contractors
  
  
• Dinesh Devadoss and Phil Stokes at SentinelOne
  Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto
  
  
• Sonatype
  This Week in Malware – 135 Packages Target npm and PyPI Registries
  
  
• Squiblydoo
  Solarmarker: The Old is New
  
  
• Vlad at ‘Слава Україні — Героям Слава!’
  .bl00dy ransomware [EN]
  
  
• Jason Reaves and Jonathan McCay at Walmart
  Diavol resurfaces
  
  
• Peter Kálnai at WeLiveSecurity
  Amazon themed campaigns of Lazarus in the Netherlands and Belgium
  
  
• Yoroi
  Dissecting BlueSky Ransomware Payload
  
  
• Zhassulan Zhussupov
  • APT techniques: Access Token manipulation. Token theft. Simple C++ example.
  • Malware development: persistence – part 12. Accessibility Features. Simple C++ example.
    
    
• Niraj Shivtarkar and Avinash Kumar at ZScaler
  Agent Tesla RAT Delivered by Quantum Builder With New TTPs
  

MISCELLANEOUS

• Andrew Rathbun and Eric Zimmerman
  EZ Tools Manuals
  
  
• 0ut3r Space
  Downloading big files from Tor
  
  
• 4Discovery
  Digital Forensics Doesn’t Need To Be Scary
  
  
• Wolfgang Sommergut at 4sysops
  Configuring Defender Antivirus: Exclusions, real-time protection, scans, and remediations
  
  
• Adam at Hexacorn
  Dealing with alert fatigue, Part 1
  
  
• Alexander Giles at EC-Council
  Why I Recommend the Certified Incident Handler Certification (E|CIH)
  
  
• Jonathan Nguyen at AWS Security
  How to automatically build forensic kernel modules for Amazon Linux EC2 instances
  
  
• Brett Shavers
  • Giveaway Winner!
  • DFIR Book Challenge
  • I sued. It sucked. But I won. It still sucked, tho.
    
    
• Martin Lee and Richard Archdeacon at Cisco
  Cyber Insurance and the Attribution Conundrum
  
  
• Cryptax
  • Virus Bulletin Conference 2022 — Day 1
  • Virus Bulletin Conference — Day 2
    
    
• Derek Eiri
  Byte-sized Training
  
  
• Tim Helming at DomainTools
  We Need More Roads Into Infosec
  
  
• Sam Wilson at Dragos
  Updates to the Dragos Platform – Growing Together As We Defend OT Environments Globally
  
  
• Forensic Focus
  • Project LOCARD’s Pablo Lopez Aguilar on Digital Evidence Management Using the Blockchain of Custody
  • Event Recap: DFRWS-USA Virtual 2022
  • Submissions Are Open for the 2022 Magnet Forensics Scholarship Program
  • The Basics of Forensic Video Recovery with DVR Examiner
    
    
• Kelvin Tegelaar at CyberDrain
  Monitoring with PowerShell: Monitoring VSS snapshot availability
  
  
• Kevin Pagano at Stark 4N6
  Forensics StartMe Updates (10/1/2022)
  
  
• Magnet Forensics
  Collecting Box.com Activity in Magnet AXIOM Cyber
  
  
• Russ Taylor at Hats Off Security
  PowerShell Basic Introduction (Security Version)
  
  
• Ryan Campbell at ‘Security Soup’
  Weekly News Roundup — September 25 to October 1
  
  
• SANS
  • NEW DFIR COURSE IN DEVELOPMENT | FOR548: eDiscovery: Tactics for Conquering the Data Minefield
  • The World’s Best Cyber Security Training Just Got Even Better
  • New SANS Python Course | SEC673: Advanced Information Security Automation with Python
    
    
• The Security Noob.
  Interview with Krzysztof (Chris) Stanko ‘The Forensic Guy’,  a Mobile & Computer Forensic Examiner and co-founder of Data Rescue Labs inc
  
  
• Chris LaFleur at Trend Micro
  Incident Response Services & Playbooks Guide
  
  
• TrustedSec
  • Working with data in JSON format
  • Hardening Backups Against Ransomware
    
    
• Andy Gill at ZeroSec
  ZTH-CH4: Hook & Sling – Phishing For Gold
  

SOFTWARE UPDATES

• ANSSI
  DFIR-ORC v10.1.3
  
  
• Cado Security
  varc release v1.0.5
  
  
• Cyber Triage
  Cyber Triage 3.4.0 New Release
  
  
• daem0nc0re
  ProcMemScan
  
  
• Didier Stevens
  Update: rtfdump.py Version 0.0.11
  
  
• Doug Burks at Security Onion
  Security Onion 2.3.170 now available including Elastic 8.4.1, Zeek 4.0.9, and more!
  
  
• ExifTool
  ExifTool 12.46 – “Write WEBP”
  
  
• Hasherezade
  PE-Bear v0.6.1
  
  
• Manabu Niseki
  Mihari v4.9.0
  
  
• Metaspike
  Forensic Email Collector (FEC) Changelog – 3.80.3.1
  
  
• MISP
  MISP 2.4.163 released with improved periodic notification system and many improvements
  
  
• Open Source DFIR
  Plaso 20220930 released
  
  
• OSForensics
  V10.0 Build 1004 27th September 2022
  
  
• Securizame
  Publicamos una nueva versión de Wintriage: v.18092022
  
  
• Ulf Frisk
  MemProcFS Version 5.1
  
  
• Xways
  X-Ways Forensics 20.7 Preview 2
  
  
• Yamato Security
  Hayabusa v1.7.0 🦅
  

And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!