As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Chris Doman at Cado Security
The Cado Platform Full Export for Forensic Data Lakes - Digital Forensics Myanmar
CHIP OFF ( Mobile FORENSIC) - Domiziana Foti
LetsDefend- SOC142 — Multiple HTTP 500 Response - Oleg Afonin at Elcomsoft
Analyzing iPhone PINs - Forensic Science International: Digital Investigation
Volume 44 - Jamf
Threat advisory: Mobile spyware continues to evolve - Mattia Epifani at Zena Forensics
iOS Forensics References: a curated list - N00b_H@ck3r
Try Hack Me: Boogeyman 1 (BlueTeam) - Orange Cyberdefense
From BitLocker-Suspended to Virtual Machine - Plainbit
- Bill Marczak, John Scott-Railton, Bahr Abdul Razzak, and Ron Deibert at The Citizen Lab
Triple Threat: NSO Group’s Pegasus Spyware Returns in 2022 with a Trio of iOS 15 and iOS 16 Zero-Click Exploit Chains - Justin Vaicaro at TrustedSec
THREAT INTELLIGENCE/HUNTING
- 360 Threat Intelligence Center
APT-C-36 (Blind Eagle) Group Deploys LimeRAT Components Against Columbia Region - Adam Goss
Hunting for Persistence with Cympire: Part IV — Startup Folder - Andrea Fortuna
QBot malware returns with new techniques in corporate attacks - Ankith Bharadwaj
Hunting & Detecting SMB Named Pipe Pivoting (Lateral Movement) - Anomali
Anomali Cyber Watch: Cozy Bear Employs New Downloaders, RTM Locker Ransomware Seeks Privacy, Vice Society Automated Selective Exfiltration - Anton Chuvakin
Reading Mandiant M-Trends 2023 - Michael Katchinskiy and Assaf Morag at Aqua
First-Ever Attack Leveraging Kubernetes RBAC to Backdoor Clusters - Jeremy Fuchs at Avanan
Phishing Links via Linktree - Avertium
An Avertium Case Study – LockBit - Black Cell
The future of industrial threat intelligence - Blackberry
From Google Ads Abuse to a Massive Spear-Phishing Campaign Impersonating Spain’s Tax Agency - Lawrence Abrams at BleepingComputer
New QBot email attacks use PDF and WSF combo to install malware - Brad Duncan at Malware Traffic Analysis
2023-04-19 – Quick post: Qakbot (Qbot) activity, distribution tags BB24 and obama254 - CERT-AGID
Sintesi riepilogativa delle campagne malevole nella settimana del 15 – 21 aprile 2023 - Check Point Research
- 17th April – Threat Intelligence Report
- QueueJumper: Critical Unauthenticated RCE Vulnerability in MSMQ Service
- 10th April – Threat Intelligence Report
- Raspberry Robin: Anti-Evasion How-To & Exploit Analysis
- Operation Silent Watch
- March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files
- CISA
APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers - Cisco’s Talos
- Curtis Brazzell
A Practical, AI-Generated Phishing PoC - Cyberknow
#OpAustralia — Hacktivist Campaign Against Australia — March 2023 - Liora Ziv at CyberProof
A look at Advanced Persistent Threats (APTs) Related to Russian Proxies - Reza Rafati at CYBERWARZONE
Understanding the Threat of Titan Stealer Malware - Cyble
- Cyfirma
Weekly Intelligence Report – 21 Apr 2023 - David Bianco at Splunk
Introducing the PEAK Threat Hunting Framework - Dragos
- EclecticIQ
Exposed Web Panel Reveals Gamaredon Group’s Automated Spear Phishing Campaigns - Fortra
Summary of the Investigation Related to CVE-2023-0669 - Billy Leonard at Google Threat Analysis Group
Ukraine remains Russia’s biggest cyber focus in 2023 - Gov.PL
Espionage campaign linked to Russian intelligence services - GuidePoint Security
- Haircutfish
TryHackMe Brim — Task 7 Exercise: Threat Hunting with Brim | Crypto Mining & Task 8 Conclusion - Denis Nagayuk & Francisco Dominguez at Hunt & Hackett
The Definitive Guide To Process Cloning on Windows - Huntress
Critical Vulnerabilities in PaperCut Print Management Software - Darren Spruell at InQuest
Credential Caution: Exploring the New Public Cloud File-Borne Phishing Attack - Jumpsec Labs
Butting Heads with a Threat Actor on an Engagement - Sudeep at K7 Labs
MuddyWater Back with DarkBit - Kevin Beaumont at DoublePulsar
Russian hackers exfiltrated data from Capita over a week before outage - Kim Zetter at ‘Zero Day’
- Kostas Sale
EDR Telemetry Project: A Comprehensive Comparison - Logpoint
- Malwarebytes Labs
- Mandiant
- Microsoft Security
- Palo Alto Networks
- Eric Capuano at Recon Infosec
Audit Active Directory Attack Paths with Bloodhound - Recorded Future
Xiaoqiying/Genesis Day Threat Actor Group Targets South Korea, Taiwan - Red Alert
Phishing Attack Activities: Threat Actors in Sheep’s Clothing (ENG) - Red Canary
Intelligence Insights: April 2023 - Miles Arkwright and James Tytler at S-RM Insights
Cyber Intelligence Briefing: 21 April 2023 - SANS Internet Storm Center
- Kristen Cotten at Scythe
Threat Emulation: APT27 - Secureworks
Bumblebee Malware Distributed Via Trojanized Installer Downloads - Jonathan Reed at Security Intelligence
Triple Extortion and Erased Data are the New Ransomware Norm - Security Investigation
- Den Iuzvyk, Tim Peck, and Oleg Kolesnikov at Securonix
Securonix Threat Labs Security Advisory: New OCX#HARVESTER Attack Campaign Leverages a Modernized More_eggs Suite to Target Victims - Simone Kraus
- Sophos
- Ben Martin at Sucuri
Massive Abuse of Abandoned Eval PHP WordPress Plugin - Symantec Enterprise
- Julien Egloff at Synacktiv
Windows secrets extraction: a summary - Team Cymru
AllaKore(d) the SideCopy Train - Vicente Díaz at VirusTotal
APT43: An investigation into the North Korean group’s cybercrime operations - Dana Behling at VMware Security
Bring Your Own Backdoor: How Vulnerable Drivers Let Hackers In
UPCOMING EVENTS
- Cyacomb forensics
Rapid Digital Triage Tools Drop-In Session - X1
X1 Social Discovery v7.0 Product Tour
PRESENTATIONS/PODCASTS
- ArcPoint Forensics
- Black Hills Information Security
- Cloud Security Podcast by Google
EP117 Can a Small Team Adopt an Engineering-Centric Approach to Cybersecurity? - Cyber Security Interviews
#126 – Douglas Brush (Part 4): Dollars and Cents, Not Bytes - Cyberwarcon
CYBERWARCON 2022 - Digital Forensic Survival Podcast
DFSP # 374 – SRUM - Dump-Guy Trickster
IDA Memory Snapshot – Amadey Malware Unpacking & Initterm Poisoning - Eric Conrad
Atlantic Security Conference 2023 – Threat Hunting via Sysmon 14 - Hacker Valley Blue
Is Paying Ransomware Ethical? #cybersecurity #cyberdefense #shorts - Hornet Security
We Used ChatGPT to Create Ransomware - InfoSec_Bret
IR – SOC176-126 – RDP Brute Force Detected - John Hammond
- Magnet Forensics
- Exploring the New User Interface Features in Magnet REVIEW 5.0
- Privileged Materials Workflow in AXIOM Cyber
- Supporting eDiscovery With Email Relationship Linking in AXIOM Cyber Load Files
- Comae Memory Analysis Capabilities Integrated Into AXIOM Cyber
- Accelerating Access to Your Endpoints With Shared Agents In AXIOM Cyber
- Magnet User Summit 2023: Another One for the Books
- Get to the Evidence Quickly with Magnet AUTOMATE
- MSAB
How to Take Advantage of the New & Improved MSAB Customer Forum? - OALabs
Well it finally happened… infected myself with Emotet lel - RickCenOT
BREAKING DOWN “I will pwn your Schneider Electric modicon M221 ICS with open Source Tools” - SANS Cloud Security
MALWARE
- Adam at Hexacorn
Using Detect It Easy to… detect it easy - Any.Run
PrivateLoader: Analyzing the Encryption and Decryption of a Modern Loader - ASEC
- Trigona Ransomware Attacking MS-SQL Servers
- Additional Activities of the Tick Group That Attacks with a Modified Q-Dir and Their Ties with Operation Triple Tiang
- February 2023 Threat Trend Report on Kimsuky Group
- Shadow Force Group’s Viticdoor and CoinMiner
- ASEC Weekly Malware Statistics (April 10th, 2023 – April 16th, 2023)
- ASEC Weekly Phishing Email Threat Trends (April 2nd, 2023 – April 8th, 2023)
- January 2023 Threat Trend Report on Kimsuky Group
- BlackBit Ransomware Being Distributed in Korea
- 8220 Gang Uses Log4Shell Vulnerability to Install CoinMiner
- Martin Zugec at Bitdefender
Technical Advisory: Why LockBit Ransomware on macOS Is Not a Significant Threat (Yet) - Christophe Tafani-Dereeper
Hiding in Plain Sight: Unlinking Malicious DLLs from the PEB - CISA
CISA Releases Malware Analysis Report on ICONICSTEALER - Dr. Brian Carrier at Cyber Triage
Sandboxing Malicious Files: Recorded Future Triage Integration - David Burkett at Signalblur
ImpELF: Unmasking Linux Malware with a Novel Imphash Approach for ELF Binaries - Flashpoint
- Cara Lin at Fortinet
EvilExtractor – All-in-One Stealer - Igor Skochinsky at Hex Rays
Igor’s Tip of the Week #137: processor modes and segment registers - InfoSec Write-ups
- Ferdous Saljooki and Jaron Bradley at Jamf
BlueNoroff APT group targets macOS with RustBucket Malware - Kengo Teramoto at JPCERT/CC
Activity Targeting Crypto Asset Exchangers for Parallax RAT Infection - Karlo Licudine at AccidentalRebel
Classifying Malware Packers Using Machine Learning - Dexter Shin at McAfee Labs
Fakecalls Android Malware Abuses Legitimate Signing Key - Arnold Osipov and Michael Dereviashkin at Morphisec
in2al5d p3in4er is Almost Completely Undetectable - NCSC
Malware analysis reports – Jaguar Tooth - OALABS Research
- Patrick Wardle at Objective-See
The LockBit ransomware (kinda) comes for macOS - Phylum
Attackers Repurposing existing Python-based Malware for Distribution on NPM - Victoria Vlasova, Andrey Kovtun, and Darya Ivanova at Securelist
QBot banker delivered through business correspondence - Phil Stokes at SentinelOne
LockBit for Mac | How Real is the Risk of macOS Ransomware? - Mandeep Singh at Sonatype
Protecting Software Developers from Malware with AI/ML Insights - Splunk
Threat Update: AwfulShred Script Wiper - Threatmon
APT Blind Eagles Malware Arsenal Technical Analysis - Don Ovid Ladores at Trend Micro
An Analysis of the BabLock (aka Rorschach) Ransomware - Tejaswini Sandapolla at Uptycs
Cyber Espionage in India: Decoding APT-36’s New Linux Malware Campaign - Vincent Van Mieghem
Process injection in 2023, evading leading EDRs - VMRay
Beyond Hashes: YARA’s Impact on Malware Detection - Zhassulan Zhussupov
Malware AV/VM evasion – part 16: WinAPI GetProcAddress implementation. Simple C++ example. - Nico Chiaravio & Gianluca Braga at Zimperium
Kimsuky: Infamous Threat Actor Churns Out More Advanced Malware - Shatak Jain and Meghraj Nandanwar at ZScaler
Introducing DevOpt: A Multifunctional Backdoor Arsenal - بانک اطلاعات تهدیدات بدافزاری پادویش
Trojan.Win32.RisePro
MISCELLANEOUS
- Abhiram Kumar
Incident Response Essentials & Tips – My Two Cents - Brett Shavers
This is an evidence storage device. - Cassie Doemel at AboutDFIR
AboutDFIR Site Content Update 04/22/2023 - CISA
CISA to Continue and Enhance U.K.’s Logging Made Easy Tool - Forensic Focus
- Magnet Forensics
- MSAB
- Lisa Forte at Red Goat
How to write an effective ransomware playbook - Salvation DATA
What does a Forensic Video Analyst do in Law Enforcement? - SANS
- SentinelOne
- Teri Radichel
- John Patzakis at X1
Social Media Evidence Proves Essential in Recent High-Stakes Trademark Infringement Matters
SOFTWARE UPDATES
- ANSSI
DFIR-ORC v10.1.7 - Cellebrite
- Crowdstrike
Falconpy Version 1.2.14 - Doug Burks at Security Onion
Security Onion 2.3.230 now available including CyberChef 10.2.0, Grafana 9.2.15, nginx 1.22.1, Redis 6.2.11, Suricata 6.0.11, Zeek 5.0.8, and more! - Federico Lagrasta
PersistenceSniper v1.9.3 - GMDSoft
GMDSOFT Q1 MD-Series Release Note Highlights - Manabu Niseki
Mihari v5.2.1 - OpenCTI
5.7.2 - Sandfly Security
Sandfly 4.4.0 – Agentless Linux Password Auditing and Data De-Duplication - Sebdraven
Yeti 2.0 - SpecterOps
Introducing BloodHound 4.3 — Get Global Admin More Often - Ulf Frisk
MemProcFS Version 5.5 - Xways
- Yamato Security
Hayabusa v2.4.0 🦅 - YARA
v4.3.1
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 