As always, thanks to those who give a little back for their support!
Lee Whitfield has announced the finalists for this years Forensic 4cast awards. Thanks for everyone that nominated this site for Resource of the Year.
Forensic 4:cast Awards 2023 – Voting is now open!
FORENSIC ANALYSIS
- ThinkDFIR
CPY JMP - Brian Maloney at Malware Maloney
OneDrive Evolution - Forensafe
Investigating Remote Desktop Connection Event Logs - ForensicXlab
📦 Volatility3 Windows Plugin : KeePass - Invictus Incident Response
Importing Windows Event Log files into Splunk - Mailxaminer
Guide On Apple Mail Forensics: Detailed Analysis - Revo4n6
Path of a Murderer: Location & Device Data - Paritosh at System Weakness
Windows Event Analysis: Unlocking the Hidden Insights in Event Logs
THREAT INTELLIGENCE/HUNTING
- Adam Goss
- Anomali
Anomali Cyber Watch: Lancefly APT Adopts Alternatives to Phishing, BPFdoor Removed Hardcoded Indicators, FBI Ordered Russian Malware to Self-Destruct - AttackIQ
Attack Graph Response to CISA Advisory (AA23-136A): #StopRansomware: BianLian Ransomware Group - Avertium
A Deeper Look into the PaperCut Vulnerabilities - Black Cell
Global Vulnerability Trends | Infographic - Lawrence Abrams at BleepingComputer
MalasLocker ransomware targets Zimbra servers, demands charity donation - Bobby Rauch
The Dangers of Google’s .zip TLD - Brad Duncan at Malware Traffic Analysis
- BushidoToken
Fake Steam Desktop Authenticator App distributing DarkCrystal RAT - CERT-AGID
Sintesi riepilogativa delle campagne malevole nella settimana del 13 – 19 maggio 2023 - Check Point Research
- Tzachi(Zack) Zorn at Checkmarx Security
PyPi on Hold: Suspends New Users’ and Projects Creations Due to A High Volume of Malicious Activity - CISA
#StopRansomware: BianLian Ransomware Group - Chetan Raghuprasad at Cisco’s Talos
Newly identified RA Group compromises companies in U.S. and South Korea with leaked Babuk source code - William Burgess at Cobalt Strike Research and Development
Cobalt Strike and YARA: Can I Have Your Signature? - Cofense
- Daniel Fonseca Yarochewsky at Confiant
BadTrip: A chain of fake travel sites abuses search ads to commit fraud and credential theft - CTF导航
APT-C-28（ScarCruft）组织利用恶意文档投递RokRat攻击活动分析 - Cyble
- Cyborg Security
- Cyfirma
Weekly Intelligence Report – 19 May 2023 - DCSO CyTec
Andariel’s “Jupiter” malware and the case of the curious C2 - Emiliano Martinez at VirusTotal
VirusTotal += Mandiant Permhash: Unearthing adversary infrastructure and toolkits by leveraging permissions similarity - Paul Lawrence And Roger Studner at Expel
Customer context: beware the homoglyph - Flashpoint
- Michael Zuckerman at Infoblox
Black Basta: Anatomy of the Attack - InfoSec Write-ups
Attacking Active Directory & Kerberoasting - Michael DeBolt at Intel471
Gaining the Intelligence Advantage with Cyber HUMINT – Part Two - Intrusion Truth
- Kela
Delving Into The Emerging Infostealers Of 2023 – Report - Kim Zetter at ‘Zero Day’
How Volexity Discovered the SolarWinds Hacking Campaign - Bill Cozens at Malwarebytes Labs
APT attacks: Exploring Advanced Persistent Threats and their evasive techniques - Mandiant
- Michael Koczwara
Hunting Malicious Infrastructure using JARM and HTTP Response - Vasu Jakkal at Microsoft Security
Cyber Signals: Shifting tactics fuel surge in business email compromise - Nasreddine Bencherchali
- Netskope
- Oleg Skulkin at BI.ZONE
BI.ZONE sheds light on data breaches caused by Leak Wolf’s malware-free attacks - Palo Alto Networks
It’s All in the Name: How Unit 42 Defines and Tracks Threat Adversaries - Viren Chaudhari at Qualys
New Strain of Sotdas Malware Discovered - Recorded Future
- Rob van Os
Why your detections may be failing (and what to do about it) - Ryan Fetterman at Splunk
Model-Assisted Threat Hunting (M-ATH) with the PEAK Framework - Miles Arkwright and James Tytler at S-RM Insights
Cyber Intelligence Briefing: 19 May 2023 - SANS Internet Storm Center
- DShield Sensor Update, (Sun, May 14th)
- VMware Aria Operations addresses multiple Local Privilege Escalations and a Deserialization issue, (Sun, May 14th)
- Ongoing Facebook phishing campaign without a sender and (almost) without links, (Mon, May 15th)
- Increase in Malicious RAR SFX files, (Wed, May 17th)
- Signals Defense With Faraday Bags & Flipper Zero, (Tue, May 16th)
- When the Phisher Messes Up With Encoding, (Fri, May 19th)
- A Quick Survey of .zip Domains: Your highest risk is running into Rick Astley., (Thu, May 18th)
- Phishing Kit Collecting Victim’s IP Address, (Sat, May 20th)
- Kristen Cotten at Scythe
Threat Emulation: Agent Tesla - Securelist
- Security Intelligence
- Izzmier Izzuddin Zulkepli at Security Investigation
Threat Hunting Hypothesis Examples: Start For a Good Hunt! - Sekoia
APT28 leverages multiple phishing techniques to target Ukrainian civil society - SentinelOne
- SOCRadar
Unlock Industry-Specific Cyber Insights: Industry Threat Landscape Report - Sean Gallagher at Sophos
The Phantom Menace: Brute Ratel remains rare and targeted - Riley Kilmer at Spur
Identifying The Nexus Of Scaled Ad Fraud - Ben Martin at Sucuri
- Sumuri
DarkSide attack? You’re gonna need more than the Justice League! - Symantec Enterprise
Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors - Team Cymru
Visualizing QakBot Infrastructure - Teri Radichel
Solar Winds Breach - Justin Elze at TrustedSec
Walking the Tightrope: Maximizing Information Gathering while Avoiding Detection for Red Teams - Vikas Singh
Chrome Extensions – Forensics - Yelisey Bohuslavskiy
Check out Yelisey Bohuslavskiy’s post
UPCOMING EVENTS
- Celeste Bishop and Himanshu Verma at AWS Security
Your guide to the threat detection and incident response track at re:Inforce 2023 - Cellebrite
How to Simplify Modern Mobile Data Collection and Review - Exterro
How Barry Bonds Influenced Forensic Investigations - Magnet Forensics
Mobile Unpacked With Chris Vance Ep. 5 // Getting Mixed Messages: Making Sense of Android Messaging Data - SANS
Exploring the Evolution of Cybersecurity Certifications, with Megan Roddie | May 23, 2023
PRESENTATIONS/PODCASTS
- Ali Hadi
New PowerShell Plugin – Adversary Simulation - Black Hills Information Security
- Digital Forensic Survival Podcast
DFSP # 378 – SVCHOST Revisited - Grzegorz Tworek
Using “format” command to sideload DLL and launch an arbitrary application - InfoSec_Bret
IR – SOC186-132 – Multiple User Login Failures Detected on Same Machine - John Hubbard at ‘The Blueprint podcast’
Strategy 2: Give the SOC the Authority to Do Its Job - Magnet Forensics
- Mostafa Yahia
- MSAB
- Paraben Corporation
Tor Browser Processing - SANS
- SentinelOne
- Sumuri
SUMURI Podcast Episode 018 – Essentials of Digital Forensics for Litigation
MALWARE
- 0x70RVS
- Any.Run
Deobfuscating the Latest GuLoader: Automating Analysis with Ghidra Scripting - ASEC
- ASEC Weekly Phishing Email Threat Trends (April 30th, 2023 – May 6th, 2023)
- LokiLocker, a Ransomware Similar to BlackBit Being Distributed in Korea
- Chinese Hacker Group Stealing Information From Korean Companies
- RecordBreaker Infostealer Disguised as a Well-known Korean Software
- SparkRAT Being Distributed Within a Korean VPN Installer
- Infostealer Being Distributed to Japanese Users
- ASEC Weekly Malware Statistics (May 8th, 2023 – May 14th, 2023)
- Erik Pistelli at Cerbero
Extreme PowerShell Obfuscation - CTF导航
Cobalt Strike的DLL Stager分析 - Embee Research
- Fortinet
More Supply Chain Attacks via Malicious Python Packages - Igor Skochinsky at Hex Rays
Igor’s Tip of the Week #141: Parsing C files - Igal lytzki at Toxin Labs
Kraken – The Deep Sea Lurker Part 1 - John Hammond
ChatGPT Analyzes Fake ChatGPT Malware - Mellvin S at K7 Labs
AMOS (MacOS Stealer) - Karlo Licudine at AccidentalRebel
Classifying More With Less: New VGL4NT Update - Kyle Cucci at SecurityLiterate
Book Summary – “Evasive Malware: Understanding Deceptive and Self-Defending Threats” - Lucija Valentić at ReversingLabs
RATs found hiding in the npm attic - S2W Lab
Detailed Analysis of AlphaSeed, a new version of Kimsuky’s AppleSeed written in Golang - Leonid Bezvershenko, Georgy Kucherin, and Igor Kuznetsov at Securelist
CloudWizard APT: the bad magic story goes on - Trend Micro
MISCELLANEOUS
- Andrew Rathbun and Eric Zimmerman at Kroll
KAPE Quarterly Update – Q1 2023 - Adam at Hexacorn
Blue teaming – it’s DATa complicated… - ADF Solutions
3 Ways Digital Forensic Software Can Improve Your Forensic Lab Operations - Belkasoft
- Cassie Doemel at AboutDFIR
AboutDFIR Site Content Update – 05/20/2023 - Dr. Tristan Jenkinson at ‘The eDiscovery Channel’
An IP Theft Case With A Difference - Oleg Afonin at Elcomsoft
NVIDIA RTX 40 Series Graphics Cards: The Faster and More Efficient Password Recovery Accelerators - Forensic Focus
- Christa Miller at Forensic Horizons
Third Party Electronic and DNA Evidence in Property Crimes - Howard Oakley at ‘The Eclectic Light Company’
Volume names, mount points and normalisation - Magnet Forensics
CSAM: Arming Investigators With Tools and Tips to Combat Child Sexual Abuse Material - Mailxaminer
Current Challenges in Digital Forensics Investigations - Matt Zorich at Microsoft Sentinel 101
Have a JSON headache in KQL? Try mv-expand or mv-apply - Mike at ØSecurity
Plaso Windows Build - Revo4n6
- SANS
Cybersecurity Jobs: OSINT investigator/Analyst (Japanese) - The Leahy Center for Digital Forensics & Cybersecurity
Capstone Chronicles: Journal File Justice
SOFTWARE UPDATES
- ADF Solutions
ADF Solutions Releases Revolutionary iOS Screen Recording Feature - Alexis Brignoni
- Apache
Tika – Release 2.8.0 – 5/11/2023 - Elcomsoft
Elcomsoft Distributed Password Recovery 80% faster with NVIDIA GeForce RTX 40 Series graphics cards - Eric Zimmerman
ChangeLog - Magnet Forensics
- Malcat
New release: 0.9.1 - Manabu Niseki
Mihari v5.2.2 - May Alsaif
AutoParser 2.0.0 - MISP
MISP 2.4.171 released with a long list of fixes, a dashboard rework, STIX 2.1 improvements and more
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 