As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Cyber 5W
Windows Shell Items Analysis - Derek Eiri
Exploring UFADE to Extract Data From iOS Devices - Forensafe
Investigating Android Samsung Browser - J Smith
Solving the 13Cubed Linux Memory Forensics Challenge - Justin De Luna at ‘The DFIR Spot’
Lateral Movement – Remote Desktop Protocol (RDP) Event Logs - Husam Shbib at Memory Forensic
Inside Cridex – Memory Analysis Case Study - Raj Upadhyay
FeatureUsage — Evidence of Execution ?? || AppSwitched - The DFIR Report
Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware
THREAT INTELLIGENCE/HUNTING
- Adam at Hexacorn
Using Guids to guide the ID of samples’ capabilities or unique (attributable) properties… - Ian Rogers and Francis Guibernau at AttackIQ
Emulating the Surging Hadooken Malware - Jade Brown at Bitdefender
Meow, Meow Leaks, and the Chaos of Ransomware Attribution - Brad Duncan at Malware Traffic Analysis
- Censys
Simplify Threat Investigations: Identify Suspicious Open Directories with Censys Search - CERT-AGID
Sintesi riepilogativa delle campagne malevole nella settimana del 28 settembre – 4 ottobre - Check Point
- Yehuda Gelb at Checkmarx Security
Crypto-Stealing Code Lurking in Python Package Dependencies - Tiago Pereira and Arnaud Zobec at Cisco’s Talos
Threat actor believed to be spreading new MedusaLocker variant since 2022 - Ian Ahl at Permiso
When AI Gets Hijacked: Exploiting Hosted Models for Dark Roleplaying - Jhon Revesencio at Cofense
From Collaboration to Deception: The Zoom Phishing Threat - Critical Start
DarkGate Malware Campaign: New Threat Intelligence Report - Crowdstrike
International Authorities Indict, Sanction Additional INDRIK SPIDER Members and Detail Ties to BITWISE SPIDER and Russian State Activity - CTF导航
威胁情报 | APT-Patchwork 组织测试 Badnews 新变种？ - Cybereason
CUCKOO SPEAR Part 2: Threat Actor Arsenal - Cyble
- Cyfirma
Weekly Intelligence Report – 04 Oct 2024 - Cyjax
Initial Access Broker Market Q2 Summary - Darktrace
Business Email Compromise (BEC) in the Age of AI - Rohit Sadgune and Amruta Sadgune at Detect Diagnose Defeat Cyber Threat
Threat Hunting for CloudFanta - Detect FYI
- Disconinja
日本におけるC2サーバ調査(Week 39 2024) - DomainTools
Hostile Takeover: A History of Evil Corp after a Leader is named by Law Enforcement - Dragos
Why Adversaries Target VPN Appliances: The Pathway from IT to OT Cyber Attack - Elastic
- Flashpoint
- David French at Google Cloud Security Community
Monitoring for Unexpected Rule Changes in Google Security Operations (2 of 2) - Ron Bowes at GreyNoise Labs
Whatchu looking for (starring SolarWinds Serv-U – CVE-2024-28995) - HackTheBox
Exploring the Snowflake Breach (Attack Anatomy) - Hudson Rock
Does the New Infostealer CAPTCHA Infection Actually Work? - Hunt IO
- Huntress
Hunting for M365 Password Spraying | Huntress - Intel471
- Kyosuke Nakamura at JPCERT/CC
Event Log Talks a Lot: Identifying Human-operated Ransomware through Windows Event Logs - Nick Rieniets at Kasada
Exposing the Credential Stuffing Ecosystem - Kostas
Unintentional Evasion: Investigating How CMD Fragmentation Hampers Detection & Response - Krebs on Security
- Michael Haag at MagicSword
Announcing LOLRMM: A Unified Approach to RMM Software Tracking - Microsoft Sentinel Blog
- Tabitha Colter, Shiri Bendelac, Lily Wong, Christina Liaghati, & Keith Manville at MITRE-Engenuity
Threat-Informed Defense to Secure AI - Natto Thoughts
Chinese Threat Groups That Use Ransomware and Ransomware Groups That Use Chinese Names - Palo Alto Networks
- Proofpoint
Security Brief: Royal Mail Lures Deliver Open Source Prince Ransomware - Akshat Pradhan at Qualys
Threat Brief: Understanding Akira Ransomware - Rapid7
Ransomware Groups Demystified: CyberVolk Ransomware - Watson Brown at Recon Infosec
SigmaHQ Essentials – Building Robust Detection Capabilities – Part 2 - SANS Internet Storm Center
- Sansec
Thousands of Adobe Commerce stores hacked in competing CosmicSting campaigns - Securelist
- Doug Bonderud at Security Intelligence
Spooky action: Phantom domains create hijackable hyperlinks - Securonix
SHROUDED#SLEEP: A Deep Dive into North Korea’s Ongoing Campaign Against Southeast Asia - Sekoia
- SentinelOne
- Silent Push
FIN7 hosting honeypot domains with malicious AI DeepNude Generators – New Silent Push research - SOCRadar
Dark Web Profile: UserSec - SonicWall
A look into Embargo Ransomware, another Rust-based ransomware - Splunk
- Kate Lee at Stairwell
Introducing the Stairwell browser extension: Bringing threat hunting directly to your browser - Symantec Enterprise
Stonefly: Extortion Attacks Continue Against U.S. Targets - Sysdig
- Anne An at Trellix
Cyber Threats Targeting the US Government During the Democratic National Convention - Ryan Soliven, Maria Emreen Viray, Fe Cureg at Trend Micro
MDR in Action: Preventing The More_eggs Backdoor From Hatching - Jesse Kimbrel at at Vectra AI
Now Playing: 2024 State of Threat Detection and Response by Jesse Kimbrel - Romain Dumont at WeLiveSecurity
Separating the bee from the panda: CeranaKeeper making a beeline for Thailand
UPCOMING EVENTS
- Belkasoft
Trusting AI in DFIR: Where It Shines and Fails - Magnet Forensics
PRESENTATIONS/PODCASTS
- 0day in {REA_TEAM}
Empowering Malware Analysis with IDA AppCall Feature - Adversary Universe Podcast
Small But Mighty: The Kernel’s Essential Role in Cybersecurity Defense - Alexis Brignoni
Digital Forensics Now Podcast – S2 E2 - Ali Hadi
How to Use Windows Volume Shadow Copies in Digital Forensics | ShadowMe Webinar - Black Hills Information Security
- Breaking Badness
Defending Your Digital Domain: AI, Ransomware, and the Power of Reputation - Cellebrite
Tip Tuesday – 2024 Cellebrite CTF Registration - Cybereason
Malicious Life Podcast: Operation Snow White, Part 1 - Cyberwox
- Dr Josh Stroschein
- Endace
Packet Forensic Files Ep 58 Stephen Donnelly - Hacker Valley Blue
How Adversaries Are Living Off The Dark Web - Huntress
- InfoSec_Bret
Challenge – Log Analysis With Sysmon - John Hammond
- Karsten Hahn at Malware Analysis For Hedgehogs
Malware Analysis – ConfuserEx 2 Deobfuscation with Python and dnlib, BBTok Loader - Magnet Forensics
- Ask the right questions in incident response thanks to Axiom Incident Response Examinations (AX310)
- Magnet Forensics Training courses that help you go deeper into mobile investigations
- Master cloud-based and social media forensics with Axiom Internet & Cloud Investigations (AX320)
- How Magnet Axiom Examinations (AX200) helps level up your DFIR abilities
- Revolutionizing digital forensics with Magnet One
- MSAB
MSAB Customer Portal Installation Guide - MyDFIR
- Richard Davis at 13Cubed
Linux Memory Forensics Challenge - SANS
- The Defender’s Advantage Podcast
Using LLMs to Analyze Windows Binaries
MALWARE
- Alex Necula
Malware Analysis Part 5. XeHook Stealer - Any.Run
- Assaf Morag and Idan Revivo at Aqua
perfctl: A Stealthy Malware Targeting Millions of Linux Servers - CERT Polska
The Dark Knight Returns: Joker malware analysis - contagio
2024-09-24 Linux Malware Cryptocurrency Miners, DONUT LOADER, RUDEVIL RAT, KAIJI- Stager and DDoS botnet samples - Dr. Web
- Christopher Lopez at Kandji
Another PDF Viewer – Is It Malicious? - Lexfo
- Jan Michael Alcantara at Netskope
Netskope Threat Labs Uncovers New XWorm’s Stealthy Techniques - Nikhil “Kaido” Hegde
Emansrepo Infostealer – PyInstaller, Deobfuscation and LLM - Bart Parys at NVISO Labs
All that JavaScript for… spear phishing? - Zhassulan Zhussupov
Malware development trick 43: Shuffle malicious payload. Simple C example.
MISCELLANEOUS
- Chris Brenton at Active Countermeasures
Running Zeek and RITA on Windows - Fabian Mendoza at DFIR Dominican
DFIR Jobs Update – 09/30/24 - Doug Metz at Baker Street Forensics
Book Review: Cloud Forensics Demystified - Erik Hjelmvik at Netresec
- Forensic Focus
Amped Authenticate – Overcoming Multimedia Forensics Challenges With Expert Witness Testimony - Husam Shbib at Memory Forensic
- Namit Ranjan
Day 29 of MYDFIR-30 Day-SOC Analyst Challenge:Installing and Configuring Elastic Defend for… - Matt Linton at Open Source DFIR
Communicating is our hardest job - Passware
New Articles on the Passware Knowledge Base – Revision 2024 - Security Onion
Did you know Security Onion Pro provides enterprise features that folks have been asking for? - Stephan Berger
EDR: The Great Escape – RomHack Training Review - Sumuri
Why Take the CFME? The Mac Forensics Certification for Digital Forensic Examiners - Victor M. Alvarez at YARA-X
The fmt command
SOFTWARE UPDATES
- Alexis Brignoni
- Cyber Triage
3.12 Adds Data Exfiltration Detection, USB Devices, and Easier Validation - Digital Sleuth
winfor-salt v2024.14.2 - Falco
Blog: Introducing Falco 0.39.0 - Soufiane Fariss, Willi Ballenthin, Mike Hunhoff, Genwei Jiang, Tina Johnson, and Moritz Raabe at Google Cloud Threat Intelligence
capa Explorer Web: A Web-Based Tool for Program Capability Analysis - Mandiant
Capa v7.4.0 - Mazars Tech
AD_Miner v1.6.1 - MSAB
Now available: XRY 10.11, XAMN 7.11, and XEC 7.11 - Niantic Labs
Venator – Threat Detection Platform - OpenCTI
6.3.5 - Passmark Software
OSForensics – V11.0 build 1014 3rd October 2024 - Vound
Intella 2.7.2 Release Notes - Xways
X-Ways Forensics 21.3 Beta 2
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 