Elastic Security Labs · Published 26 Mar
The Shelby Strategy
By Salim Bitam
Excerpt
Key takeaways
The SHELBY malware family abuses GitHub for command-and-control, stealing data and retrieving commands The attacker’s C2 design has a critical flaw: anyone with the PAT token can control infected machines, exposing a significant security vulnerability
Unused code and dynamic payload loading suggest the malware is under active development, indicating future updates may address any issues with contemporary versions
Summary
As part of our ongoing research into emerging threats, we analyzed a potential phishing email sent from an email address belonging to an Iraqi telecommunications company and sent to ot…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Elastic Security Labs on elastic.co.
Mentioned in the excerpt1
More from Elastic Security Labs9
Elastic Security Labs · Web page · Published 12 Oct
Auditing the auditor: Unmasking Apex Accelerator
Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free…
Elastic Security Labs · Web page · Published 12 Oct
Auditing the auditor: Unmasking Apex Accelerator
Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free…
Elastic Security Labs · Web page · Published 14 Apr
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
If you're interested in a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail, check out this follow-on analysis of the PHANTOMPULSE malware. Preamble Elastic Security Labs…
Elastic Security Labs · Web page · Published 2 Sep
Credential harvesting that survives takedowns: REVSTEALER
Elastic Security Labs is tracking an emerging infostealer, REVSTEALER, under REF2859. This family has gained momentum in recent months, with higher distribution volume, and has emerged as a formidable threat, featuring a comprehensive credential harvester, an…
On the same topics
papers.lisdex.sh · PDF · Added 31 Oct
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
Hermes is a commercial Windows malware platform that combines credential theft with interactive remote access. Advertisements on Russian-language cybercrime forums offer tiered subscriptions. The service has an operator web panel, worker accounts and a…
papers.lisdex.sh · PDF · Added 31 Oct
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
A Python repository advertised as an asynchronous scraper concealed a Windows malware loader in its import path. Following that loader led to Hermes, a subscription service combining credential collection, file access and interactive control of visible and…
K7 Labs · Web page · Published 21 Mar
Volume II: Who aM I? Confessions of an Obfuscated JS Worm
This is volume II of a three part series based on our (Kaarthik RM and Rajababu A) paper for AVAR 2013, discussing the prevalence of autorun malware in the Asian region, taking it further by analyzing an example of such a malware Carrying on from where we…
Kaspersky · Web page · Published 21 Oct
Operation FlashHole: Lazarus breaks security, defies control
In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole. In this new operation, the group employed an updated malware chain that included both their old and new malware, which we…