As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Atola Technologies
Need for Speed: How to Get a Forensic Image Quicker? - Clint Marsden at DFIR Insights
- Cyber 5W
Google Drive Forensics - Digital Forensics Myanmar
- Oleg Afonin at Elcomsoft
- Forensafe
Investigating iOS Viber - Geir Olav Skei
Where’s my logs at…. UEMS and ZoHo Meeting-edition - Hal Pomeranz at ‘Righteous IT’
Recovering Deleted Files in XFS - N00b_H@ck3r
LetsDefend: Adobe ColdFusion RCE
THREAT INTELLIGENCE/HUNTING
- Chris Brenton at Active Countermeasures
Zeek Log Analysis Using Hacky Scripts - Adam at Hexacorn
High Fidelity detections are Low Fidelity detections, until proven otherwise - Francis Guibernau at AttackIQ
Emulating the Long-Term Extortionist Nefilim Ransomware - Australian Cyber Security Centre
APT40 Advisory - Blackberry
- CERT-AGID
Sintesi riepilogativa delle campagne malevole nella settimana del 06 – 12 luglio 2024 - Check Point
- Exploring Compiled V8 JavaScript Usage in Malware
- 8th July – Threat Intelligence Report
- Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112)
- June 2024’s Most Wanted Malware: RansomHub Takes Top Spot as Most Prevalent Ransomware Group in Wake of LockBit3 Decline
- CISA
CISA Releases Advisory Detailing Red Team Activity During Assessment of US FCEB Organization, Highlighting Necessity of Defense-in-Depth - Cisco’s Talos
- Fabian Bader at Cloudbrothers
Find lateral movement paths using KQL Graph semantics - Cofense
- Keith J. Jones at Corelight
Detecting The Agent-Tesla Malware Family | Corelight - Cybereason
Hardening of HardBit - Cyble
- Cyfirma
- Cyfirma
Weekly Intelligence Report – 12 July 2024 - Cyjax
Weekly Cyber Threat Intelligence Summary - Dragos
What Manufacturers Need to Know About the OT Cyber Threat Landscape - Ryan Slaney at Field Effect
Field Effect discovers M365 adversary-in-the-middle campaign - Bhavin Patel at Foregenix
Uncovering Stealthy Malware Tactics: Disabling WordFence Scanner - John Hultquist at Google Cloud Threat Intelligence
Emboldened and Evolving: A Snapshot of Cyber Threats Facing NATO - Hudson Rock
Re-Infected: The Persistent Threat of Infostealers - John F
Charting the IOCs - Paul Kimayong at Juniper Networks
BianLian Ransomware Group: 2024 Activity Analysis - Krebs on Security
- Lasq MalfindLabs
Cyber threat intelligence - Natto Thoughts
RansomWar Part 4a: CyberCriminals as “Combat Resource” and Bargaining Chip - Aurelien Chalot at Orange Cyberdefense
Dumping LSA secrets: a story about task decorrelation - Phylum
New Tactics from a Familiar Threat - Recorded Future
OilAlpha Malicious Applications Target Humanitarian Aid Groups Operating in Yemen - Red Alert
Monthly Threat Actor Group Intelligence Report, May 2024 (ENG) - Brian Donohue at Red Canary
Halting a hospital ransomware attack - Resecurity
Smishing Triad Is Targeting India To Steal Personal and Payment Data at Scale - SANS Internet Storm Center
- Kunai: Keep an Eye on your Linux Hosts Activity, (Mon, Jul 8th)
- Finding Honeypot Data Clusters Using DBSCAN: Part 1, (Wed, Jul 10th)
- Understanding SSH Honeypot Logs: Attackers Fingerprinting Honeypots, (Thu, Jul 11th)
- 16-bit Hash Collisions in .xls Spreadsheets, (Sat, Jul 13th)
- Attacks against the “Nette” PHP framework CVE-2020-15227, (Fri, Jul 12th)
- Sansec
CosmicSting attacks have started hitting major stores - Securelist
- Den Iuzvyk and Tim Peck at Securonix
The Ghost In The Machine: Tracking Stealthy Fileless Malware In The Windows Registry - Silent Push
FIN7: Silent Push unearths the largest group of FIN7 domains ever discovered. 4000+ IOFA domains and IPs found. Louvre, Meta, and Reuters targeted in massive global phishing and malware campaigns. - Puja Mahendru at Sophos
The State of Ransomware in Education 2024 - Splunk
- Stephan Berger
- Symantec Enterprise
Ransomware: Activity Levels Remain High Despite Disruption - Miguel Hernández at Sysdig
CRYSTALRAY: Inside the Operations of a Rising Threat Actor Exploiting OSS Tools - Taz Wake
Linux IR – Creating evidence of execution in Linux - Trend Micro
- David Broggy at Trustwave SpiderLabs
The Underdog of Cybersecurity: Uncovering Hidden Value in Threat Intelligence - Valdin
Poseidon Analysis – Quick and Intuitive Workflows with Validin
UPCOMING EVENTS
- Richard Boddington at Belkasoft
Webinar: From the Field: Belkasoft X User’s Guide to Effective Forensics - Black Hills Information Security
BHIS – Talkin’ Bout [infosec] News 2024-07-15 - Magnet Forensics
Cyber Unpacked Ep. 2 // Uncovering the unseen: Mastering mobile data for internal investigations and eDiscovery
PRESENTATIONS/PODCASTS
- Adversary Universe Podcast
Talking OT Security with Fernando Madureira, Global CISO of Cosan - AhmedS Kasmani
Malware 101: Injection Basics – Dll Injection - Alexis Brignoni
Digital Forensics Now Podcast – Episode 20 - Black Hills Information Security
- BlueMonkey 4n6
Advanced usage of the linux cd command – change directory tutorial - Cellebrite
Tip Tuesday: Cellebrite Design Partner - Clint Marsden at the TLP
- Cyber Social Hub
Detecting and Dealing with Deepfakes and Synthetic Media - Jane Ginn at Cyber Threat Intelligence Training Center
Sandworm: Shadows in the Code - DFIR101
Podcast Visualized: DFSP (ep001) – Premier Episode - Hardly Adequate
Hardly a Week 28 July 8, 2023 - Huntress
- InfoSec_Bret
Challenge – Confluence CVE-2023-22527 – Part 1 - Karsten Hahn at Malware Analysis For Hedgehogs
IDA vs Binary Ninja vs Ghidra after 1.5 years using them - Magnet Forensics
- Malspace
PIVOTcon - Microsoft Security Insights Show
Microsoft Security Insights Show Episode 217 – Heike Ritter - MSAB
MSAB Monday XAMN Pro Part 10 – Reporting - MyDFIR
- Paraben Corporation
E3 Forensic Platform Overview Final - Security Conversations
Ep4: The AT&T mega-breach, iPhone mercenary spyware, Microsoft zero-days - Threat Forest
DFIR & docker containers part 1
MALWARE
- Any.Run
- ASEC
Distribution of AsyncRAT Disguised as Ebook - Avast Threat Labs
Decrypted: DoNex Ransomware and its Predecessors - Baris Dincer
Malicious Document Analysis: Emotet Case IV - Cryptax
Untangling Android/TangleBot - Dr Josh Stroschein at The Cyber Yeti
DEFCON32 Workshop Prep – Dissecting and Defeating Ransomware’s Evasion Tactics - Emanuele De Lucia
Unveiling AzzaSec Ransomware: Technical insights into the group’s locker. - Fareed Fauzi
PEB Walk and API hashing for Malware Analysis – Part 1 - Mayur Sewani at Forcepoint
ShadowRoot Ransomware Targeting Turkish Businesses - Kota Kino at JPCERT/CC
Attack Activities by Kimsuky Targeting Japanese Organizations - Malware Musings
Tofsee (part 2): The First Unpacking Loop - Jérôme Segura at Malwarebytes
Fake Microsoft Teams for Mac delivers Atomic Stealer - Yashvi Shah and Vignesh Dhatchanamoorthy at McAfee Labs
ClickFix Deception: A Social Engineering Tactic to Deploy Malware - OALABS Research
- Vishwa Thothathri, Yijie Sui, Anmol Maurya, Uday Pratap Singh and Brad Duncan at Palo Alto Networks
DarkGate: Dancing the Samba With Alluring Excel Files - Karlo Zanki at ReversingLabs
Malicious NuGet campaign uses homoglyphs and IL weaving to fool devs - Mike Blinkman at System Weakness
Dynamic Malware Analysis Techniques for Cybersecurity - Yin Hong Chang and Sudeep Singh at ZScaler
MISCELLANEOUS
- Sergiy Pasyuta at Atola
E01 vs AFF4: Which image format is faster? - Kushalveer Singh Bachchas at AT&T Cybersecurity
Digital Forensics in the Age of Cryptocurrency: Investigating Blockchain and Crypto Crimes - Sebastian Kandler at Detect FYI
- Forensic Focus
- Magnet Forensics
Meet the Magnet Forensics Training Team: Luke Clarke - Matt Shannon at F-Response
You never forget your first time. Using F-Response before it was F-Response - Nik Earnest at OpenText
Series intro – The rise of the threat hunter - Salvation DATA
- Mike Elgan at Security Intelligence
A decade of global cyberattacks, and where they left us - Doug Burks at Security Onion
Celebrating 10 Years of Security Onion Solutions and Announcing Security Onion Pro! - System Weakness
SOFTWARE UPDATES
- Atola
TaskForce 2 Changelog – 2024.6.1 - Alexis Brignoni
- Amped
Amped FIVE Update 34212: New and Improved Batch Convert DVR, New Supported Video Formats, Updates to Advanced File Info, Frame Size, Link Filters, and Much More - Cellebrite
Unveiling Inseyets UFED Version 10.2: Elevating Digital Forensics - Digital Sleuth
winfor-salt v2024.10.16 - Elcomsoft
iOS Forensic Toolkit 8.60 enhances agent-based low-level extraction in Linux and Windows editions - Francesco de Lorenzi
WhatsApp Forensic Exporter - Magnet Forensics
Magnet Griffeye 24.3: Video Signature Matching uncovers evidence in extensive video footage - Alexandre Borges
Malwoverview 6.0.0 - Manabu Niseki
Mihari v7.6.2 - Metaspike
Forensic Email Intelligence 2.2 Release Notes - OpenCTI
6.2.4 - Phil Harvey
ExifTool 12.89 - SigmaHQ
pySigma v0.11.9 - Ulf Frisk
MemProcFS Version 5.10 - WithSecure Labs
Chainsaw v2.9.2 - Xways
X-Ways Forensics 21.2
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 