As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Atola Technology
Mastering Drive Wiping: Ensuring Data Security - Akash Patel
- Belkasoft
Windows Browser Forensics 101 - Brian Maloney
Autopsy Hardening Guide: Part 1 - Dr. Brian Carrier at Cyber Triage
Information Artifacts: Simplify DFIR Analysis - David Cowen at the ‘Hacking Exposed Computer Forensics’ blog
- Daily Blog #709: Sunday Funday 1/5/25 Entra ID and Bloodhound
- Daily Blog #710: Developing an AWS Examination Tool Part 1
- Daily Blog #711: Developing an AWS Examination Tool Part 2
- Daily Blog #712: Developing an AWS Examination Tool Part 3
- Daily Blog #713: Developing an AWS Examination Tool Part 4
- Daily Blog #714: Forensic Lunch 1/10/25 with Ryatt Roesrma talking about fine tuning AI models
- Daily Blog #715: Solution Saturday 1/11/25
- Decrypting a Defense
Digital License Plates, Encrypted Messaging, Drone Panic, State of the Surveillance State & More - Oleg Afonin at Elcomsoft
iPhone and iPad Acquisition Methods: Yet Another Comparison - Forensafe
Unlocking the Power of ArtiFast AI - Iram Jack
- Justin De Luna at ‘The DFIR Spot’
A BITS of a Problem – Investigating BITS Jobs - Oleg Skulkin at ‘Know Your Adversary’
- Salvation DATA
- Tarek Mostafa
Email Investigation
THREAT INTELLIGENCE/HUNTING
- Faan Rossouw at Active Countermeasures
Malware of the Day – Tunneling RDP with Microsoft Dev Tunnels - Antonio Formato
What’s new in TI Mindmap | Dec 2024 - Stefan Hostetler, Julian Tuin, Trevor Daher, Jon Grimm, Alyssa Newbury, Joe Wedderspoon, and Markus Neis at Arctic Wolf
Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls - ASEC
- Statistical Report on Malware Targeting Windows Web Servers in Q4 2024
- December 2024 Threat Trend Report on APT Attacks (South Korea)
- December 2024 Threat Trend Report on Ransomware
- Statistical Report on Malware Threat in Q4 2024
- Play Ransomware Attack Cases Detected by AhnLab EDR
- Increase in Distribution of AutoIt Compile Malware via Phishing Emails
- Francis Guibernau at AttackIQ
Emulating the Tenacious Ako Ransomware - Brad Duncan at Malware Traffic Analysis
2025-01-09: CVE-2017-0199 XLS –> HTA –> VBS –> steganography –> DBatLoader/GuiLoader style malware - Calum Hall at Cado Security
The Case for SOC Augmentation: Empowering Analysts, Not Replacing Them - CERT-AGID
- Check Point
- CISA
Ivanti Releases Security Updates for Connect Secure, Policy Secure, and ZTA Gateways - CrowdStrike
Recruitment Phishing Scam Imitates CrowdStrike Hiring Process - CTF导航
- Omer Grossman at CyberArk
CIO POV: Ransomware and Resilience—2024’s Biggest Cyber Stories - Cyfirma
Weekly Intelligence Report – 10 Jan 2025 - Roman Faithfull at Cyjax
The Great Morpheus: New Extortion Group DLS Emerges - Darktrace
Detecting and mitigating adversary-in-the-middle phishing attacks with Darktrace Services - Detect FYI
Hunting SVR — Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally - Disconinja
日本におけるC2サーバ調査(Week 1 2025) - Elastic Security Labs
Detonating Beacons to Illuminate Detection Gaps - Carl Windsor at Fortinet
Phish-free PayPal Phishing - John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, and Jacob Thompson at Google Cloud Threat Intelligence
Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation - Group-IB
Social Engineering in Action: How Fraudsters Exploit Trust with Fake Refund Schemes in the Middle East - Raj at Hacking Articles
Abusing AD-DACL: AddSelf - Halcyon
Ransomware on the Move: Cl0p, FunkSec, Akira, RansomHub - Hudson Rock
Telefonica Breach: Infostealer Malware Opens Door for Social Engineering Tactics - Hunt IO
- Greg Linares, Matt Anderson, and Alden Schmidt at Huntress
Hunt for RedCurl | Huntress - Infoblox
Muddling Malspam: The Use of Spoofed Domains in Malicious Spam - Inginformatico
Lista de grupos APT con motivaciones y métodos de ataque - Intel 471
What 2025 May Hold for Cybersecurity - Jeffrey Appel
How to check and block “malicious” browser extensions with Microsoft Defender and Intune? - Kandji
Behavioral Detections: Kandji EDR’s Latest Defense Update Against Threats - Brian Krebs at Krebs on Security
A Day in the Life of a Prolific Voice Phishing Crew - George Glass, Keith Wojcieszek, and Laurie Iacono at Kroll
November Threat Intelligence Spotlight Report - Ugur Koc and Bert-Jan Pals at Kusto Insights
Kusto Insights – December Update - Bibek Thapa Magar and Ujwal Thapa at Logpoint
EDR Killers: After All, EDRs Are Not Invincible - Malwarebytes
GroupGreeting e-card site attacked in “zqxq” campaign - Michalis Michalos
Five (plus one) notable cyber attacks in Greece during 2024 - Natto Thoughts
Chengdu: Teahouses, Hotpots, Universities and … Hackers - Recorded Future
Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain - Red Alert
Monthly Threat Actor Group Intelligence Report, November 2024 (KOR) - Brian Davis at Red Canary
Shrinking the haystack: The six phases of cloud threat detection - Alessio Stefan at Red Hot Cyber
The Story Of Conti Ransomware – The Last Ceremony (Final Episode) - John Doyle, Gert-Jan Bruggink, Steven Savoldelli, and Callie Guenther at SANS
Beyond Meh-trics: Examining How CTI Programs Demonstrate Value Using Metrics - SANS Internet Storm Center
- Security Investigation
Comprehensive List of APT Threat Groups, Motives, and Attack Methods - SOCRadar
- SpecterOps
- Sam Scholten at Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread - System Weakness
- Tomer Shloman at Trellix
Blurring the Lines: How Nation-States and Organized Cybercriminals Are Becoming Alike - Trend Micro
Trend Micro Contributes and Maps Container Security to MITRE ATT&CK: A Game-Changer for Cyber Defense - Rodel Mendrez at Trustwave SpiderLabs
The State of Magecart: A Persistent Threat to E-Commerce Security - Sreekar Madabushi at Valdin
Tracking Threat Actors with Validin - Joseliyo Sánchez at VirusTotal
Research that builds detections - watchTowr Labs
- Phil Muncaster at WeLiveSecurity
State-aligned APT groups are increasingly deploying ransomware – and that’s bad news for everyone - Gal Nagli, Merav Bar, Gili Tikochinski, and Shaked Tanchuma at Wiz
Wiz Research Identifies Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603) - Wladimir Palant at ‘Almost Secure’
How extensions trick CWS search - Peter Girnus at Zero Day Initiative
ZDI Threat Hunting 2024: Highlights, Trends, & Challenges
UPCOMING EVENTS
- Jessica Hyde at Hexordia
Magnet Virtual Summit CTF Powered by Hexordia: Elevate Your Digital Forensics Skills! - Black Hills Information Security
BHIS – Talkin’ Bout [infosec] News 2025-01-13 #livestream #infosec #infosecnews - Cado Security
Defining the ‘R’ in CDR: A Realistic Approach to Responding to Cloud Detections - Eclypsium
2025 Threat Landscape Trends to Watch - Magnet Forensics
- Emma Burdett at Rapid7
Securing Success: Stories from the SOC Webinar Series - SANS
SANS Threat Analysis Rundown with Katie Nickels | January 2025
PRESENTATIONS/PODCASTS
- Black Hills Information Security
REKAST – Talkin’ Bout [infosec] News 2025-01-06 #infosecnews #cybersecurity #podcast #podcastclips - Breaking Badness
Cybersecurity Tales: Espionage, Ransomware, and the Stories Behind the Threats - Cellebrite
Tip Tuesday: Inseyets UFED - Dr Josh Stroschein
What To Look for in the Cyber Landscape 2025 with Ryan Chapman and Aaron Rosenmund - InfoSec_Bret
Challenge – Windows Theme Spoofing - John Hammond
- Magnet Forensics
- Mark Baggett
SEC573 Question and Answers - Microsoft Threat Intelligence Podcast
Threat Landscape Update: North Korean IT Workers, OSINT, and Remote Monitoring and Management Abuse - MSAB
XAMN 8.0 – Introducing the new Highlights Tab - MyDFIR
Practice KQL for FREE | Cybersecurity Training (KC7) - Paraben Corporation
Paraben’s E3 Forensic Platform for Digital Investigations - Richard Davis at 13Cubed
Be Kind, Rewind… The USN Journal - Sandfly Security
- SANS
- Security Conversations
Hijacking .gov backdoors, Ivanti 0days and a Samsung 0-click vuln - SentinelOne
LABScon24 Replay | The Real AI Race: Disinformation in the Taiwanese Election - The Citizen Lab
Sweet QuaDreams or Nightmare before Christmas? Bill Marczak on Dissecting an iOS 0-Day
MALWARE
- Alexandre Borges at ‘Exploit Reversing’
Malware Analysis Series (MAS): article 09 | Shellcode - Cyble
HexaLocker V2: Skuld Stealer Paving the Way prior to Encryption - Pulsedive
Assemblyline 101 – Open Source Malware Triage - Wang Hao, Alex.Turing, Acey9 at Qi’anxin X Lab
Gayfemboy: A Botnet Deliver Through a Four-Faith Industrial Router 0-day Exploit. - Saurabh Sharma and Vasily Berdnikov at Securelist
EAGERBEE, with updated and novel components, targets the Middle East - Kirill Boychenko at Socket
Gmail For Exfiltration: Malicious npm Packages Target Solana Private Keys and Drain Victims’ Wallets - Puja Srivastava at Sucuri
Stealthy Credit Card Skimmer Targets WordPress Checkout Pages via Database Injection - TRAC Labs
PEAKLIGHT: Illuminating the Shadows - Trend Micro
- بانک اطلاعات تهدیدات بدافزاری پادویش
Trojan_Android_MedusaV3
MISCELLANEOUS
- Yulia Samoteykina at Atola
2024. Year in Review - Brett Shavers
- Cellebrite
- Christopher Eng at Ogmini
- First Week Musings
- Expectations vs Reality – Digital Forensic Science Master’s Degree
- CISA IR Training – Defend Against Ransomware Attacks Cyber Range Training (IR209)
- Powerschool Hack
- K-12 Student Data – Why would anyone steal that?
- Forensics Software – Automated Regression/Version Testing Part 1
- Hex Editors for Digital Forensics and Reverse Engineering
- Craig Ball at ‘Ball in your Court’
Leery Lawyer’s Guide to AI - Danny Zendejas
Cybersecurity Career Path: Detection and Response - Forensic Focus
- Matt Shannon at F-Response
What is F-Response? - Oxygen Forensics
Oxygen Forensics and CloudNine: What is Modern Data ECA? - Amber Schroader at Paraben Corporation
2024 Digital Forensic Review - Plainbit
LogLayer: 개발자를 위한 혁신적인 통합 로깅 라이브러리 - Security Onion
- Tyler Brozek
GIAC Experienced Incident Handler Certification Preparation (GX-IH) - VMRay
Unveiling the Power of Threat Intelligence Platforms
SOFTWARE UPDATES
- Datadog Security Labs
GuardDog v2.2.0 - Digital Sleuth
- Eric Zimmerman
ChangeLog - IntelOwl
v6.2.1 - Manabu Niseki
Mihari v8.0.2 - OpenCTI
6.4.6 - Paraben Corporation
Starting 2025 with E3 Forensic Platform version 4.2 - Xways
X-Ways Forensics 21.4 Preview 6
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 