As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- John Lukach at 4n6ir
Amazon Linux Triage for Anyone and Everyone - ArcPoint
Getting started with ALEAPP | ArcPoint Forensics - Cyrill Brunschwiler at Compass Security
Tutorial on how to Approach Typical DFIR Cases with Velociraptor - Forensafe
Investigating Ouick Access - Harel Segev at ‘RAT In Mi Kitchen’
The Forensic Value of the (Other) WSH Registry Key - Lina Lau at Inversecos
How to Investigate Insider Threats (Forensic Methodology) - Oxygen Forensics
Compare Call log and CDR in Oxygen Forensic ® Detective - UnderDefense
Massive Infection through 0-day in the Zimbra Email suite (CVE-2022-41352) - Yamato Security
Yamato Security’s Ultimate Windows Event Log Configuration Guide For DFIR And Threat Hunting - Pieces0310
APK downgrade extraction fails on Samsung smartphones – Pieces0310
THREAT INTELLIGENCE/HUNTING
- Anomali
Anomali Cyber Watch: Emotet Added Two New Modules, LofyGang Distributed 200 Malicious Packages, Bumblebee Loader Expanded Its Reach, and More - Anton Chuvakin
Google Cybersecurity Action Team Threat Horizons Report #4 Is Out! - Sule Tatar at Arctic Wolf
Threat Intelligence 101 - Avertium
An In-Depth Look at Vice Society Ransomware - Bitdefender
Are Open-Source Threat Intelligence Solutions Still Competitive? - Lawrence Abrams at BleepingComputer
Fake Solana Phantom security updates push crypto-stealing malware - Booz Allen Hamilton
China’s Cyberattack Strategy Explained - Brad Duncan at Malware Traffic Analysis
- CERT-AGID
- Check Point Research
- Cisco’s Talos
- Cyber Threat Intelligence Training Center
STIX2.1 Best Practices - Anthony M. Freed at Cybereason
Indicators of Behavior and the Diminishing Value of IOCs - Cyberknow
Update 19. 2022 Russia-Ukraine War — Cyber Group Tracker. October 12. - Cyble
- Dragos
- Erik Hjelmvik at Netresec
IcedID BackConnect Protocol - GuidePoint Security
GRIT Ransomware Report – Q3 2022 - Henri Hambartsumyan at Falcon Force
FalconFriday — Detecting ADCS web services abuse — 0xFF20 - Horizon3
- Intel471
LockBit 3.0 Builder Code Leak Points to Another Disgruntled Criminal Employee - Kostas Tsale
Threat Hunting Series: Using Threat Emulation for Threat Hunting - Magnet Forensics
Identify Malicious Files and IOCs With YARA Rules in Magnet IGNITE - Malwarebytes Labs
- Mandiant
- Microsoft Security
- OALABS Research
Threat Intel – Building A Simple Botnet Tracker - Amer Elsad and Daniel Bunce at Palo Alto Networks
Ransom Cartel Ransomware: A Possible Connection With REvil - PhishLabs
RedLine Stealer Leads Payloads in Q3 - Recorded Future
- Robindimyan
Early Warning Intelligence — How to predict cyber attacks? - SANS Internet Storm Center
- Wireshark: Specifying a Protocol Stack Layer in Display Filters, (Mon, Oct 10th)
- Curl’s resolve Option, (Sun, Oct 9th)
- Scans for old Fortigate Vulnerability: Building Target Lists?, (Wed, Oct 12th)
- Analysis of a Malicious HTML File (QBot), (Thu, Oct 13th)
- Malware – Covid Vaccination Supplier Declaration, (Sat, Oct 15th)
- Tom Hegel at SentinelOne
8220 Gang Cloud Botnet Targets Misconfigured Cloud Workloads - Sonatype
This Week in Malware – Over 50 Packages Discovered - Matt Wixey at Sophos
Are threat actors turning to archives and disk images as macro usage dwindles? - Simon O’Brien at Splunk
APAC BOTS Day 2022 - Sucuri
SiteCheck Malware Trends Report – Q3 2022 - Symantec Enterprise
Budworm: Espionage Group Returns to Targeting U.S. Organizations - Lesley Carhart
ASIS Article – Preparing for OT Incident Response - Trend Micro
- Ashley Pearson and Shane Hartman at TrustedSec
Back to Basics: The TrustedSec Guide to Strong Cyber Hygiene—Part 2 - Javier Inclan at VMware Security
Emotet Exposed: A Look Inside the Cybercriminal Supply Chain
UPCOMING EVENTS
- Binalyze
Redefining the future of digital forensics and incident response with AIR 3.0. - Cellebrite
- Magnet Forensics
- Microsoft Security Response Center
BlueHat 2023 Call for Papers is Now Open! - SANS Institute
Ask Me Anything
PRESENTATIONS/PODCASTS
- Ali Hadi
- Black Hills Information Security
- Brakeing Down Security Podcast
07-oct-news-twitch streaming - Breaking Badness
134. OSINTillating Conversation - Heather Mahalik at Cellebrite
iOS Offline Tracking, Wiping and the U1 Chip – Mitch Kajzer - Cloud Security Podcast by Google
Next Special – Can We Escape Ransomware by Migrating to the Cloud? - Reza Rafati at Cyberwarzone
The MITRE Attack Framework explained in basic language - Cyborg Security
Threat Hunting Workshop: Hunting for Execution - Didier Stevens
- Digital Forensic Survival Podcast
DFSP # 347 – Weblogs - Digital Forensics in Real Life
Ep. 10 The eBay Swindler - Down the Security Rabbithole Podcast
DtSR Episode 521 – The Peanut Gallery Takes on XDR - InfoSec_Bret
DFIR – Windows Forensics – Part 1 - Magnet Forensics
- MalGamy
Play with bruteratel framework payload - SANS Institute
Technology is the Reasonable Accommodation | SANS Cyber Solutions Fest 2022 - The Defender’s Advantage Podcast
Threat Trends: The Threat Lanscape in APJ - The Digital Forensics Files Podcast
How Lawyers and Litigants Can Spot Fake Text Messages! - Lesley Carhart
(Podcast) ITSP – Martial Arts, Marksmanship, And ICS Cyber Incident Response | A Conversation With Lesley Carhart - Uriel Kosayev
Why Malware Analysis is important in Red Teams – Proelium Conference
MALWARE
- ASEC
- Blackberry
BianLian Ransomware Encrypts Files in the Blink of an Eye - Anandeshwar Unnikrishnan at CloudSEK
Technical Analysis of BlueSky Ransomware - CTF导航
- Deep Instinct
The Russian SpyAgent – a Decade Later and RAT Tools Remain at Risk - Esentire
Qakbot and HTML Smuggling Resurgence - Fortinet
- Patrick Schläpfer at HP Wolf Security
Magniber Ransomware Adopts JavaScript, Targeting Home Users with Fake Software Updates - Hussein Adel
DarkSide Ransomware Analysis - Igor Skochinsky at Hex Rays
Igor’s tip of the week #110: Self-relative offsets - Aaron Stratton at InfoSec Write-ups
njRAT Malware Analysis - John Hammond
- Yasuyuki Tanaka at NTT Security Japan
LockBit3.0 BuilderによるEncryptorの特徴解析 - OALABS Research
Icarus Stealer – What is it? - Positive Technologies
We study the Trojan agenda with mimicry under XDSpy - Joey Chen and Amitai Ben Shushan Ehrlich at SentinelLabs
WIP19 Espionage | New Chinese APT Targets IT Service Providers and Telcos With Signed Malware - ThreatFabric
TOAD attacks: Vishing combined with Android banking malware now targeting Italian banks - Uptycs
Agent Tesla Malware Analysis: WSHRAT Acting As A Dropper - Brian Baskin at VMware Security
LockBit 3.0 Also Known as LockBit Black - WeLiveSecurity
- Zhassulan Zhussupov
- Nipun Gupta at Zimperium
We Smell A RatMilad Android Spyware - Tarun Dewan and Stuti Chaturvedi at ZScaler
New PHP Variant of Ducktail Infostealer Targeting Facebook Business Accounts
MISCELLANEOUS
- Belkasoft
Internal or external: what data breach elicits the greater risk and damage? - Breachquest
Ransomware Attack! Now what? - Cassie Doemel at AboutDFIR
AboutDFIR Site Content Update 10/9/22 - Cellebrite
Cellebrite to Release Third Quarter 2022 Financial Results on November 17, 2022 - Forensic Focus
- Huntress
- Microsoft 365 Security
- Ashwin Radhakrishnan at MITRE-Engenuity
MITRE Engenuity ATT&CK® Evaluations: Enterprise — Turla Welcomes 31 Participants - Politie
Nederlandse gedupeerden geholpen in unieke ransomware-actie - Rich Plummer
Basic Concepts in Mobile Device Forensics Part 4 – Evidence Fundamentals - SANS
- Security Intelligence
How the US Government is Fighting Back Against Ransomware - SOC Fortress
- Kurt Muhl at TrustedSec
Set Up an Android Hacking Lab for $0
SOFTWARE UPDATES
- AccessData
KFF 7.6 - CISA
RedEye - Crowdstrike
Falconpy Version 1.2.3 - CyberChef
v9.48.0 - Didier Stevens
Update: base64dump.py Version 0.0.24 - ExifTool
ExifTool 12.48 - Grzegorz Tworek
FwOffline - iNPUT-ACE
Axon Investigate Version 3.0 - IntelOwl
v4.1.0 - Jake Hildreth
Locksmith - Martin Willing
MemProcFS-Analyzer-v0.6 - MISP
MISP 2.4.164 released with new tag relationship feature, improvements and a security fix - Passware
Passware Kit Mobile 2022 v4 Now Available - Raymond Roethof
Microsoft Defender for Identity Log Analyzer - Sandfly Security
Sandfly 4.2 – Automatic Host Discovery and Faster Than Ever - Xways
- Yamato Security
Hayabusa v1.7.1 🦅
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 