Check out our latest #CTI report which highlights ThreeAM's new extortion scheme involving social media shaming, linked to #Russian #ransomware ecosystems and possibly #cyberespionage www.intrinsec.com/threeam-rans...
cc @lgde.bsky.social @r3dhash.bsky.social @stdal.bsky.social @gi7w0rm.bsky.social @olevilladsen.bsky.social @cryptolaemus.bsky.social @pr0xylife.bsky.social
SHA1:
f004c09428f2f18a145212a9e55eef3615858f9c 7d4a6976c1ece81e01d1f16ac5506266d5210734
Stay tuned for our report on Qakbot's comeback!
[CTI insights]
The latest Qakbot payload distributed happened to be packed by the Dave crypter. The DLL decrypts a resource containing Dave's encrypted shellcode and executes it! (cf. securityintelligence.com/x-force/tric...)
[𝙏𝙝𝙧𝙚𝙖𝙩 𝙇𝙖𝙣𝙙𝙨𝙘𝙖𝙥𝙚 #48] 📅 Dans l'actualité cyber de cette semaine :
🔹 Nouvelle campagne d’espionnage en #Ukraine utilisant le logiciel #Remcos
🔹 Checkpoint publie une nouvelle analyse du malware #SysJoker
La suite : ⤵️
[𝙏𝙝𝙧𝙚𝙖𝙩 𝙇𝙖𝙣𝙙𝙨𝙘𝙖𝙥𝙚 #𝟰𝟰]
Dans l'actualité cyber de cette semaine :
Des attaquants ukrainiens auraient collaboré avec le renseignement #ukrainien #SBU pour pirater la banque #russe Alfa-Bank
la suite ici : mailchi.mp/476c609c2668...
[𝙏𝙝𝙧𝙚𝙖𝙩 𝙇𝙖𝙣𝙙𝙨𝙘𝙖𝙥𝙚 #𝟰𝟯]
📅 Dans l'actualité cyber de cette semaine :
🔹 L'#ENISA publie la onzième édition de son rapport annuel sur l'état de la menace
🔹 Le mode opératoire d'attaque (MOA) #Sandworm aurait compromis 11 entreprises de télécommunications ukrainiennes
La suite : ⤵️
6/ @stdal.bsky.social
5/ @lgde.bsky.social @r3dhash.bsky.social
4/ Find the report here : www.intrinsec.com/wp-content/u...
Vue graphique d'une fonction d'obfuscation CFF, illustrant le fonctionnement du "morpher".
3/ Code analysis of different sample revealed the use of a “morpher”, an advanced tool to evade detection:
2/ Lumma is present on Russian-speaking forums and Telegram. In this report, we analyse the old and new C2 panels threat actors rely on.
Page de couverture du dernier rapport publié par Intrinsec sur le stealer Lumma.
1/ Intrinsec’s CTI team recently published a report on Lumma Stealer, the most active stealer of the last months
cc @lgde.bsky.social cc @gi7w0rm.bsky.social
The RAR archive contains a legitimate PDF taken from the New Zealand Foreign Affairs & Trade weekly global report of October 2023 which launches an EXE with the same name by leveraging CVE-2023-38831.
RAR archive :
www.virustotal.com/gui/file/35f...
Bumblebee EXE :
www.virustotal.com/gui/file/60f...
New #Bumblebee campaign leveraging CVE-2023-38831
Botnet ID : is0210
RC4 key : NEW_BLACK
C2 : g7qf7ew5c[.]life
TTPs : .RAR -> .EXE
6/6 RAR archive :
www.virustotal.com/gui/file/19b...
5/6
4/6
3/6 Domains contacted :
itszko2ot5u[.]life
3v1n35i5kwx[.]life
newdnq1xnl9[.]life
cmid1s1zeiu[.]life
2/6 Name of the unpacked payload : “LdrAddx64.exe”. RC4 key used to decrypt the configuration : “NEW\_BLACK”. Botnet : "rar0409".
1/6 Intrinsec CTI's team is investigating an ongoing 📷#Bumblebee campaign spreading via Html smuggling downloading RAR archive with European Central Bank PDF lure and folder containing Bumblebee EXE payload.
Our Job ? Protecting yours ! And that's what we stand for 💪
Intrinsec is excited to join BlueSky and share our cybersecurity insights with our community !
