Research reports

GitHub · PDF · Added 27 Jun

payloads-in-malicious-onenote-samples-jp

ファイルを悪用するさいに使う埋め込みペイロードの種類について取り上げます。私たちが WildFire から得た約 6,000 件の悪質な OneNote サンプルを分析したところ、これらのサンプルにはフィッシングに似たテーマが存在することが明らかになりました。これらのサ ンプルでは、攻撃者らが、1 つ以上の画像を使ってユーザーに OneNote ファイルをクリックまたは操作させようとします。その後、そうしたやり取りが埋め込まれた悪意のあるペイロードを実行します 。 Office…

GitHub · PDF · Added 27 Jun

chinese-apts-target-asean-entities-jp

Stately Taurus (別名 Mustang Panda、BRONZE PRESIDENT、Red Delta、LuminousMoth、Earth Preta、Camaro Dragon) は少なくとも 2012 年から活動しています。私たちは同グループを「サイバースパイ活動を日常的に行っている中国の持続的標的型攻撃 (APT) グループ」と評価しています。このグループはこれまで北米やヨーロッパ、アジアの政府機関や非営利団体、宗教団体、そのほか の非政府組織を標的にしてきました。 私たちは最近、前述の…

GitHub · PDF · Added 27 Jun

payloads-in-malicious-onenote-samples-en

Next-Generation Firewall with cloud-delivered security services including WildFire. Prisma Access devices with cloud-delivered security services including WildFire. Cortex XDR and XSIAM agents help protect against post-exploitation activities using the…

GitHub · PDF · Added 26 Jun

(3) Kimsuky is targeting an arms manufacturer in Europe.

(3) Kimsuky is targeting an arms manufacturer in Europe. | LinkedIn Kimsuky is targeting an arms manufacturer in Europe. linkedin.com/pulse/kimsuky-targeting-arms-manufacturer-europe-dmitry-melikov-dquge Dmitry Melikov Dmitry Melikov Cyber threats researcher.…

GitHub · PDF · Added 26 Jun

100DaysofYARA - SpectralBlur

Today will be a quick post on a TA444 (aka Sapphire Sleet, BLUENOROFF, STARDUST CHOLLIMA) Macho family tracked as SpectralBlur we found in August, and how finding it led us to stumble upon an early iteration of KANDYKORN (aka SockRacket). Please read…

GitHub · PDF · Added 26 Jun

Objective-See's Blog

The first malware of 2024 is (already) here! by: Patrick Wardle / January 4, 2024 📝 👾 Want to play along? As ‘Sharing is Caring’ I’ve uploaded a sample of the malware SpectralBlur.zip to our public macOS malware collection. The password is: infect3d…

GitHub · PDF · Added 25 Jun

SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques

Cisco Talos recently discovered an ongoing campaign from SneakyChef, a newly discovered threat actor using SugarGh0st malware, as early as August 2023. In the newly discovered campaign, we observed a wider scope of targets spread across countries in EMEA and…

GitHub · PDF · Added 25 Jun

In-Depth Analysis: Velvet Ant's Prolonged Cyber Attack on a Large Organization

Discover the detailed forensic investigation by Sygnia into the sophisticated cyber attack by Velvet Ant on a major organization. Sygnia Team 16 June 2024 Key Takeaways In late 2023, a large organization was the victim of a serious cyber attack. Sygnia’s…

GitHub · PDF · Added 25 Jun

Attachment 1 - Night Dragon Specific Protection Measures for Consideration

The exploits and methods contained in Night Dragon’s attack set are not new or unique to our industry, nor are the approaches or methods to combat it. However NERC issues this Advisory in response to an identified pattern of activity that has been directed…

GitHub · PDF · Added 25 Jun

Flax Typhoon using legitimate software to quietly access Taiwanese organizations

Flax Typhoon using legitimate software to quietly access Taiwanese organizations | Microsoft Security Blog August 24, 2023 Flax Typhoon using legitimate software to quietly access Taiwanese organizations…

sstic.org · PDF · Added 25 Jun

SSTIC2024 - Rétro-ingénierie de code malveillant dans la CTI

Introduction > TA410 > Analyse initiale > Signature > Pivot > Analyse variants > Nouvelle signature > Nouveau variant > Stage final > Bilan > Conclusion Cyber Threat Intelligence Renseignement sur la menace cyber Introduction > TA410 > Analyse initiale >…

sstic.org · PDF · Added 25 Jun

SSTIC2024-Article-la_retro-ingnierie_de_code_malveillant_dans_la_cti_-_analyse_de_levolution_dune_chaine_dinfection-meslay.pdf

Résumé. Cet article a pour but de présenter le rôle de la rétro-ingénierie des codes malveillants dans le domaine du renseignement sur la menace cyber ou Cyber Threat Intelligence (CTI). Après un bref rappel de ce qu’est que la CTI, nous partirons d’un cas…

incibe.es · PDF · Added 21 Jun

incibe-cert_estudio_analisis_nobelium_2022_v1.pdf

La presente publicación pertenece a INCIBE (Instituto Nacional de Ciberseguridad) y está bajo una licencia Reconocimiento-No comercial 3.0 España de Creative Commons. Por esta razón, está permitido copiar, distribuir y comunicar públicamente esta obra bajo…

US Department of Defense · PDF · Added 20 Jun

CSA-NORTH-KOREAN-ACTORS-EXPLOIT-WEAK-DMARC.PDF

To report suspicious or criminal activity related to information found in the Joint Cybersecurity Advisory, contact your local FBI field office or submit a report to the FBI Internet Crime Complaint Center (IC3). When available, please include the following…

Bitdefender · PDF · Added 20 Jun

Bitdefender-Report-Confidential-DeepDive-creat7721-en_EN

All trademarks, trade names, and products referenced herein are the property of their respective owners. Deep Dive into the Unfading Sea Haze A technical look at a threat actor’s ever-evolving tools and tactics Bitdefender® Whitepaper Deep Dive into the…

CISA · PDF · Added 20 Jun

Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity

Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity Overview • Immediately change all default passwords of OT devices (including PLCs and HMIs), and use strong, unique passwords. • Limit exposure of OT systems to the internet. • Implement…

Mandiant (Google) · PDF · Added 20 Jun

Snowflake Threat Hunting Guide

This document contains threat hunting guidance and queries for detecting abnormal and malicious activity across Snowflake customer database instances. Default retention policies for the relevant views enable threat hunting across the past 1 year (365 days).…

Recorded Future · PDF · Added 20 Jun

GRU's BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaigns

Azerbaijani think tank. Operational infrastructure was continuously evolved to deploy Headlace malware through three distinct phases, abusing legitimate services such as GitHub, Mocky, and InfinityFree. Credential harvesting campaigns targeted webmail service…

Intrinsec · PDF · Added 6 Jun

TLP-CLEAR-Matanbuchus-Co-Code-Emulation-and-Cybercrime-Infrastructure-Discovery-1.pdf

esentire-dot-com-assets.s3.amazonaws.com · PDF · Added 6 Jun

eSentire-Unraveling_BatLoader_and_FakeBat.pdf

BatLoader and FakeBat are two competing, Russian-speaking Malware-as-a-Service (MaaS) crime groups that specialize in infecting corporate employees with malware. These services are known to infect their targets with every type of malware from the Royal…