As always, thanks to those who give a little back for their support!

FORENSIC ANALYSIS

• Andre Maccarone and John Ailes at Aon
  Amazon Web Services: Exploring the Cost of Exfil
  
  
• CERT-SE CTF2022
  CERT-SE CTF2022
  
  
• CyberJunnkie
  Incident Response LetsDefend : Detecting Web App attack and detecting persistence
  
  
• Forensafe
  • Investigating LogMeIN
  • Investigating ExpressVPN
    
    
• Kathryn Hedley
  Windows 11 Time Rules
  
  
• Magnet Forensics
  SRUM: Forensic Analysis of Windows System Resource Utilization Monitor
  
  
• Carl Purser at OpenText
  Apple property list parsing with EnScript
  
  
• Justin Schoenfeld and Zach Diehl at Red Canary
  Cloud coverage: Detecting an email payroll diversion attack
  
  
• Samruddhi Raut
  Back to Basics : Window Registry
  
  
• John Scott-Railton, Bill Marczak, Bahr Abdul Razzak, Siena Anstis, Paolo Nigro Herrero, and Ron Deibert at The Citizen Lab
  New Pegasus Spyware Abuses Identified in Mexico
  
  
• Alexia Bowie at The Leahy Center for Digital Forensics & Cybersecurity
  Mobile Forensics on Kik Messenger
  

THREAT INTELLIGENCE/HUNTING

• Akamai
  • Financial Services Malware Just Won?t Die: What to Do About It?
  • Holiday Readiness, Part II: Best Practices for Detecting and Mitigating Attacks
    
    
• Anomali
  Anomali Cyber Watch: Canceling Subscription Installs Royal Ransomware, Lazarus Covinces to SSH to Its Servers, Polyglot File Executed Itself as a Different File Type, and More
  
  
• APNIC
  Threat Integration: Lessons of indicator and incident exchange
  
  
• Arctic Wolf
  Threat Intelligence 101
  
  
• Giovanni López, Andres Arrowsmith, Ken Towne, and Jackson Wells at AttackIQ
  Attack Graph Response to US-CERT Alert (AA22-277A): Chinese Threat Actors Steal Sensitive Information from a Defense Industrial Base Organization
  
  
• Avertium
  Everything You Need to Know About Bumblebee Malware
  
  
• Ben Heater
  Wazuh: Enhancing Zeek Logs with RITA
  
  
• Martin Zugec at Bitdefender
  Deep Dive into a Cryptojacking Operation
  
  
• Blackberry
  • Anatomy of a Ransomware Attack: 7 Stages of Operation [White Paper]
  • Mustang Panda Abuses Legitimate Apps to Target Myanmar Based Victims
    
    
• Brad Duncan at Malware Traffic Analysis
  • 2022-10-01 thru 10-03 – 3 days of traffic from scans/probes hitting a web server
  • 2022-09-16 thru 09-30 – 15 days of traffic from scans/probes hitting a web server
  • 2022-09-03 thru 09-15 – 13 days of traffic from scans/probes hitting a web server
  • 2022-09-29 – Qakbot (Qbot) with Cobalt Strike
  • 2022-10-04 – HTML smuggling –> IcedID (Bokbot) –> Cobalt Strike
  • 2022-10-06 – HTML smuggling –> IcedID (Bokbot) –> Cobalt Strike
    
    
• Cado Security
  AWS Lambda Incident Response
  
  
• CERT-AGID
  • BluStealer arriva in Italia: come è fatto il malware che ruba password, carte di credito, e-mail e criptovalute
  • Sintesi riepilogativa delle campagne malevole nella settimana del 1 – 7 ottobre 2022
    
    
• Check Point Research
  • Bumblebee: increasing its capacity and evolving its TTPs
  • 3rd October – Threat Intelligence Report
    
    
• Jossef Harush at Checkmarx Security
  LofyGang – Software Supply Chain Attackers; Organized, Persistent, and Operating for over a Year
  
  
• CISA
  • AA22-277A: Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization
  • AA22-279A: Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors
    
    
• Cisco’s Talos
  • Developer account body snatchers pose risks to the software supply chain
  • Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
  • Threat Roundup for September 30 to October 7
    
    
• Cryptax
  Virus Bulletin 2022 — Day 3
  
  
• CTF导航
  • A glimpse into the shadowy realm of a Chinese APT: detailed analysis of a ShadowPad intrusion
  • 揭秘APT团体常用的秘密武器——AsyncRAT
  • SideWinder Uncoils to Strike
  • 基于AD Event日志识别DCShadow攻击
    
    
• Cybereason
  • Blue Teaming on macOS with eslogger
  • Leveraging Indicators of Behavior for Early Detection
    
    
• Reza Rafati at Cyberwarzone
  • Killnet claims 14 new hacking groups have joined
  • Anonymous Operation Iran overview
  • Backdoor hacking group reveals Amini’s Arrest team
  • 24 year old phishers arrested because of personalized link
    
    
• Cyble
  • Fake Ransomware Infection Under widespread
  • ‘BidenCash’ Strikes Again: Over 1.2 Million Compromised Payment Cards Data Leaked
    
    
• Adam Price at Cyjax
  Cyberattacks on the utilities sector
  
  
• Daniel Chronlund
  Sentinel Hunting Query Pack – DCSecurityOperations
  
  
• David Krivobokov at Otorio
  GhostSec Now Targeting Iranian ICS in Support of Hijab Protests
  
  
• Maor Korkos at Deep Instinct
  AMSI Unchained: How to Unchain the Antimalware Providers and Bypass AMSI
  
  
• Joe St Sauver at DomainTools
  Using AXAMD to Read Observations from NOD SIE Ch212 (“Newly Observed Domains”) with Python3
  
  
• Dragos
  • Using Threat Intelligence to Build a Mature OT Network Defense
  • How SMBs Can Use the Collection Management Framework (CMF) to Prepare for a Cyber Incident
    
    
• EclecticIQ
  Killnet Effectively Amplifies Russian Narratives but has Limited DDoS Capabilities
  
  
• Esentire
  Russian-Speaking Attacker Exposes Their Toolbox While Attempting to Deploy the Phobos Ransomware to Community College
  
  
• Flashpoint
  • Conti Ransomware: The History Behind One of the World’s Most Aggressive RaaS Groups
  • Analysis of CISA releases Advisory on Top CVEs Exploited Chinese State-Sponsored Groups
    
    
• Florian Roth
  Capturing Detection Ideas to Improve Their Impact
  
  
• Bob Rudis at GreyNoise
  A week in the life of a GreyNoise Sensor: The benign view
  
  
• Group-IB
  • Take control of your shadow IT
  • Letting off steam
    
    
• Vishal Garg at InfoSec Write-ups
  Ransomware Attacks — Current Trends and Protection Strategies | by Vishal Garg | Medium
  
  
• Intel471
  Cyber Underground Marketplace Intelligence:  A New Offering from Intel 471 to Help Anticipate Future Threats
  
  
• Jamie Collier
  Structured Analytical Techniques for Pragmatists
  
  
• Keisuke Shikano at JPCERT/CC
  TSUBAME Report Overflow (Apr-Jun 2022)
  
  
• Lacework
  Threat detection and response tools are built on shaky foundations, leaving your cloud workloads at risk
  
  
• Luke Leal
  McDonald’s Phishing Page Used to Steal Saudi Payment Data
  
  
• Malwarebytes Labs
  • Ransomware review: September 2022
  • Hundreds of Microsoft SQL servers found to be backdoored
    
    
• Megan Deblois at Mandiant
  Curating Threat Intelligence with Custom Dashboards
  
  
• Matt Zorich at Microsoft Sentinel 101
  A picture is worth a thousand words – visualizing your data.
  
  
• Microsoft 365 Security
  • How to upgrade the CU level of an On-Premises Exchange server?
  • Mitigating CVE-2022-41040 with Exchange On-premises Mitigation Tool v2
  • Hunting in On-Premises Exchange Server logs
  • Hunting Exchange Webshell Activity
    
    
• Mark Russinovich and Jeffrey He at Microsoft Azure
  Advancing anomaly detection with AIOps—introducing AiDice
  
  
• Microsoft Security
  Detecting and preventing LSASS credential dumping attacks
  
  
• MITRE
  • Deception: An Operator’s Guide to Getting the Lawyers to “Yes”
  • Introducing ATT&CK Campaigns
    
    
• Shawn Westfall at Palo Alto Networks
  Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
  
  
• PhishLabs
  What is Email Spoofing?
  
  
• Selena Larson and Daniel Blackford at Proofpoint
  Exploiting COVID-19: how threat actors hijacked a pandemic
  
  
• Digvijay Mane at Quick Heal
  Beware: SOVA Android Banking Trojan emerges more powerful with new capabilities
  
  
• Rabobank
  DeTTECT v1.7.0
  
  
• Red Alert
  Monthly Threat Actor Group Intelligence Report, August 2022 (KOR)
  
  
• Will Thomas at SANS
  Cracked Brute Ratel C4 framework proliferates across the cybercriminal underground
  
  
• SANS Internet Storm Center
  • Credential Harvesting with Telegram API, (Tue, Oct 4th)
  • More IcedID, (Wed, Oct 5th)
  • Powershell Backdoor with DGA Capability, (Fri, Oct 7th)
  • What is in your Infosec Calendar? , (Thu, Oct 6th)
  • Critical Fortinet Vulnerability Ahead, (Fri, Oct 7th)
  • Wireshark 4.0.0 Released, (Sat, Oct 8th)
  • Sysmon v14.1 Release, (Sat, Oct 8th)
    
    
• Securelist
  • DeftTorero: tactics, techniques and procedures of intrusions revealed
  • A look at the 2020–2022 ATM/PoS malware landscape
  • TOP 10 unattributed APT mysteries
    
    
• Secureworks
  2022 State of the Threat: A Year in Review
  
  
• Security Intelligence
  • What Experts Had To Say About the 2022 Cost of a Data Breach Report
  • Why Do Ransomware Gangs Keep Coming Back From the Dead?
    
    
• Dheeraj Kumar and Ella Dragun at Securonix
  Securonix Threat Labs Monthly Intelligence Insights – September
  
  
• Sekoia
  XDR detection engineering at scale: crafting detection rules for SecOps efficiency
  
  
• Snyk
  • Phony PyPi package imitates known developer
  • Red teaming vs blue teaming: Breaking down security roles
    
    
• SOC Fortress
  • Build Your Own SIEM Stack with Open Source Tools Series
  • Part 1. Wazuh Indexer — SIEM Backend
    
    
• Sonatype
  • Weaponizing Open Source Through Job Recruiting
  • This Week in Malware – Over 100 Packages Discovered
    
    
• Joshua Prager and Emily Leidy at SpecterOps
  Prioritization of the Detection Engineering Backlog
  
  
• Stephen Johnston at Sucuri
  What is a Malware Attack?
  
  
• Sygnia
  Revealing Emperor Dragonfly: Night Sky and Cheerscrypt – A Single Ransomware Group
  
  
• Team Cymru
  A Visualizza into Recent IcedID Campaigns:
  
  
• Teri Radichel
  AWS Credentials in Boto3 and CLI Debug Output
  
  
• Trellix
  Evolution of BazarCall Social Engineering Tactics
  
  
• Edwin David at TrustedSec
  Common Conditional Access Misconfigurations and Bypasses in Azure
  
  
• Roman Kovac at WeLiveSecurity
  ESET Threat Report T2 2022
  

UPCOMING EVENTS

• Cellebrite
  What You Need to Know Now About macOS 13 and iOS 16
  
  
• Huntress
  A Sneak Peek at hack_it 2022
  
  
• Magnet Forensics
  • Timing is Everything: What You Need to Know About DVR Dates & Times
  • Duty to Preserve, but How?
  • Ask Me Anything: Live Q&A With Magnet Forensics Trainers
    
    
• SANS
  Make Security a Lifestyle, Not Just a Job
  
  
• SANS Institute
  Sharing the Mic in Cyber. A Day of Allyship and Action
  

PRESENTATIONS/PODCASTS

• Aon
  37: On Aon’s Cyber Threat Hunt with Samantha Billy and Jonathan Rajewski
  
  
• ArcPoint Forensics
  Cesar Quezada & Jessica Hyde Present: Missing Pieces
  
  
• Black Hills Information Security
  • AASLR: Playing with Velociraptor! | John Strand
  • AASLR: Volatility3 is awesome! | John Strand
  • Talkin’ About Infosec News – 10/5/2022
    
    
• BlueMonkey 4n6
  Necessary skills for a career in DFIR – interview with DerrickDonnelly
  
  
• Breaking Badness
  133. A Shot in the Dark Web
  
  
• Censys
  Episode Three: The Internet’s Response to Major Vulnerabilities
  
  
• Digital Forensic Survival Podcast
  DFSP # 346 – Masquerading
  
  
• Doug Burks at Security Onion
  Security Onion Conference 2022 recordings are now available!
  
  
• Forensic Focus
  • In Which Si and Desi Are Left Unsupervised
  • Cyacomb Examiner Product Demonstration
    
    
• Gerald Auger at Simply Cyber
  How to Use Attack Emulation to Find Cybersecurity Control Failure!
  
  
• Horangi Cyber Security
  Threat Hunting and Incident Response (Ask A CISO SE02EP35)
  
  
• InfoSec_Bret
  End User Submission – Game Demo or Cred Stealer???
  
  
• John Hammond
  • IT WAS A SCAM
  • HAVOC C2 – Demon Bypasses Windows 11 Defender
  • Unraveling a REMOTE ACCESS TROJAN (VBScript Deobfuscation)
    
    
• LetsDefend
  The weekend started for SOC Analysts
  
  
• Magnet Forensics
  • Offline iOS Tracking and Remote Wiping
  • Integrate, Automate, and Scale DFIR Investigations With Magnet AUTOMATE Enterprise
  • Tips & Tricks// A New Yet Familiar Look at Email Evidence in AXIOM Cyber
    
    
• MalGamy
  • Down Uder CTF2022- source provided
  • Down Under CTF2022- clicky
  • Down Under CTF2022- legit-app-not-ransomware
    
    
• Paraben Corporation
  E3 Forensic Platform Overview
  
  
• Richard Davis at 13Cubed
  Impacket Impediments – Finding Evil in Event Logs
  
  
• Sandfly Security
  • Finding Compromised SSH Credentials on Linux with Agentless Sandfly Security
  • Agentless Embedded Linux Device Security on Raspberry Pi
    
    
• SANS
  • A Visual Summary of SANS Blue Team Summit 2022
  • Introducing the SANS Cloud Ace Podcast
    
    
• Semperis
  The Growing Threat of Ransomware as a Service
  
  
• The Ransomware Files
  Unproven Data Recovery
  
  
• Unallocated Space by ArcPoint Forensics
  UNALLOCATED SPACE S1: EP11 ASK US ANYTHING
  
  
• Velocidex Enterprises
  • DFRWS APAC Workshop: Velociraptor Digging Deeper Part 2
  • DFRWS APAC Workshop: Velociraptor Digging Deeper Part 1
    

MALWARE

• Aaron Jornet
  RecordBreaker
  
  
• Alexander Adamov at ‘Malware Research Academy’
  Analysis of Cyberweapons – Ep3: Decompiling WhisperGate’s stage2.exe in dnSpy
  
  
• Arda Büyükkaya
  • Malware Analysis of XOR Encrypted Shellcode
  • Cobalt Strike Shellcode Loader With Rust
  • LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool
    
    
• ASEC
  Change in Magniber Ransomware (*.js → *.wsf) – September 28th
  
  
• Avast Threat Labs
  Decrypted: MafiaWare666 Ransomware
  
  
• CISA Analysis Reports
  • MAR-10365227-3.v1 China Chopper Webshells
  • MAR-10365227-2.v1 HyperBro
  • MAR-10365227-1.v1 CovalentStealer
    
    
• Cofense
  • Scammers Utilize Wufoo for Vacation Request Phish
  • The Tactics of a Prolific Phishing Campaign Abusing Dropbox
    
    
• CTF导航
  • APT 双尾蝎样本分析
  • A Deep Dive Into the APT28’s stealer called CredoMap
  • 不成熟的黑客组织 ModernLoader 针对东欧地区发起攻击
  • Sharkbot分析
    
    
• Doug Burks at Security Onion
  Quick Malware Analysis: QAKBOT (QBOT) infection with COBALT STRIKE pcap from 2022-09-29
  
  
• Fortinet
  • Leveraging Microsoft Office Documents to Deliver Agent Tesla and njRat
  • Delivery of Malware: A Look at Phishing Campaigns in Q3 2022
  • Excel Document Delivers Multiple Malware by Exploiting CVE-2017-11882 – Part II
    
    
• Igor Skochinsky at Hex Rays
  Igor’s tip of the week #109:  Hex view text encoding
  
  
• David Ledbetter at InQuest
  Hiding in the XML
  
  
• Mhidat
  Function Call Obfuscation101
  
  
• Gustavo Palazolo at Netskope
  RedLine Stealer Campaign Abusing Discord via PDF Links
  
  
• OALABS Research
  ISFB / GOZI / RM3 Config Extraction
  
  
• One Night in Norfolk
  Some Notes on VIRTUALGATE
  
  
• Panagiotis Nakoutis
  CTFlearn writeup: RE_verseDIS challenge using Ghidra.
  
  
• Securelist
  • OnionPoison: infected Tor Browser installer distributed through popular YouTube channel
  • Uncommon infection and malware propagation methods
    
    
• Pedro Tavares at Segurança Informática
  Phishing com visualizadores de PDF impactam utilizadores
  
  
• Andreas Klopsch at Sophos
  Remove All The Callbacks – BlackByte Ransomware Disables EDR Via RTCore64.sys Abuse
  
  
• Splunk
  Deliver a Strike by Reversing a Badger: Brute Ratel Detection and Analysis
  
  
• Stephen Sims
  Using Malware Analysis to Improve Exploitation with Didier Stevens
  
  
• Trend Micro
  • Water Labbu Abuses Malicious DApps to Steal Cryptocurrency
  • Tracking Earth Aughisky’s Malware and Changes
    
    
• Rodel Mendrez at Trustwave SpiderLabs
  HTML File Attachments: Still A Threat
  
  
• Zhassulan Zhussupov
  Malware development: persistence – part 13. Hijacking uninstall logic for application. Simple C++ example.
  
  
• Nipun Gupta at Zimperium
  We Smell A RatMilad Android Spyware
  
  
• Shatak Jain and Aditya Sharma at ZScaler
  Analysis of LilithBot Malware and Eternity Threat Group
  

MISCELLANEOUS

• John Lukach at 4n6ir
  Catching that VPC Flow Log Wave
  
  
• Adam at Hexacorn
  Dealing with alert fatigue, Part 2
  
  
• Beau Faull
  Microsoft Purview/s — What is the difference?
  
  
• Doug Burks at Security Onion
  Sneak Peek at Security Onion 2.4
  
  
• Michael Karsyan at Event Log Explorer blog
  Scripting in Event Log Explorer
  
  
• LockBoxx
  Cyber Responder’s Deliemma / Fallacy
  
  
• Tyler Tracy at Logz.io
  Tips and Tricks for the Small SOC:Part I
  
  
• Magnet Forensics
  Have Your Say on The State of Enterprise DFIR
  
  
• Mailxaminer
  • iCloud Forensics – Compromised Platform Examination
  • Working with Keywords Using the MailXaminer Tool
  • Know How to Find Out Where A Photo Was Taken? – Accurate Solution
  • Working with Advanced Filters – MailXaminer Tool
    
    
• Markus Schober at Blue Cape Security
  How do you become an expert in DFIR
  
  
• Mary Ellen Kennel at ‘What’s A Mennonite Doing In Manhattan?!’
  Hedge Funds: A Unique CyberSecurity Posture
  
  
• NixIntel
  Use Python To Automate Your OSINT Reporting
  
  
• Carlos Canto at Rapid7
  Velociraptor Version 0.6.6: Multi-Tenant Mode and More Let You Dig Deeper at Scale Like Never Before
  
  
• Kevin Gee at Red Canary
  Introducing Linux EDR Response Actions
  
  
• Steven Valverde at ADF
  Here Are 3 Tips To Improve Your Digital Image Forensics Skills
  
  
• Ryan Campbell at ‘Security Soup’
  Weekly News Roundup — October 2 to October 8
  
  
• Salvation DATA
  What are the 8 Types of Digital Evidence?
  
  
• SANS
  5 Reasons to Head to Charlotte for SANS DFIRCON 2022
  
  
• Victor Santoyo at Sucuri
  How to Secure & Harden Your Joomla! Website in 12 Steps
  
  
• The Security Noob.
  Interview With DFIR Legend Brett Shavers
  
  
• John Patzakis at X1
  Flawed Collection Methods Prevent TAR and Other Applications of Analytics on Social Media Evidence
  

SOFTWARE UPDATES

• Apache
  Apache Tika – Release 2.5.0 – 09/30/2022
  
  
• DFIR-HBG
  v1.0.1 Decrypt cached iOS Memories/MEO
  
  
• ExifTool
  ExifTool 12.47
  
  
• Fox IT
  dissect
  
  
• Hex Rays
  IDA 8.1 released
  
  
• k1nd0ne
  VolWeb – v4.0.0-alpha
  
  
• Magnet Forensics
  Magnet DVR Examiner 3.2: Improving Your Workflow With New Features
  
  
• MALCAT
  New release: 0.8.5
  
  
• Manabu Niseki
  Mihari v4.10.0
  
  
• MobilEdit
  MOBILedit Forensic 9.0.1 is live with even better Smartwatch and Cloud Forensic
  
  
• MSAB
  • New release: XRY 10.3, XAMN 7.3 and XEC 7.3
  • New Release: XRY 10.3, XAMN 7.3 & XEC 7.3
  • What’s new in XAMN 7.3
  • What’s new in XEC 7.3
  • What’s new in XRY 10.3
    
    
• OpenText
  OpenText Security eliminates digital blind spots with enhanced threat detection, investigation and response capabilities
  
  
• WithSecure Labs
  Chainsaw v2.1.1
  

And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!