Network Security Research Lab at 360
Beijing
Joined January 2018
- Tweets423
- Following12
- Followers4.6K
- Likes55
360 Netlab retweeted
Analysing hundreds of billions of daily DNS queries to produce actionable threat intelligence. #Skidmap and malicious DNS data mining by @360Netlab's Zhang Zaifeng: blog.apnic.net/2021/04/19/sk…
#Malware #threatintelligence #Throwback
360 Netlab retweeted
Here at Quad9, we saw fridgexperts[.]cc skyrocket to our top blocked site with a whopping 30M+ blocks in just under 24 hours--starting ~noon UTC on the 14th!
#Fodcha #DDoS #botnet #DNS
New Fodcha DDoS botnet targets over 100 victims every day - @serghei
bleepingcomputer.com/news/se…
360 Netlab retweeted
Now Specter CC has been changed to securitycloud.symantec.com @ 85.159.233.158 lol
When you see a new sample only talking to api.github.com and ibm.com, you would quickly assume there is nothing to look at here, right? You might be wrong. Our new article blog.netlab.360.com/the-pitf…
360 Netlab retweeted
DGA and #fastflux were early examples of malicious threats detected in the #DNS. This post looks at #skidmap and malicious #DNS data mining, by @360Netlab's Zhang Zaifeng: blog.apnic.net/2021/04/19/sk…
#DNSSEC #Malware #threatintelligence
360 Netlab retweeted
Great～
the DGA part, we saw 4 steps from our data：
S1, 03.11, first seed is 0x7774DEAD, count to 0xCC
S2, 05.09, new seed is 0x7228827A, count to 0xCC
S3, 07.28, new seed is 0xFAFFDED00001, count to 0xCC
S4, 10.03, seed still is 0xFAFFDED00001, but count to 0xFD
#Necro Python #Botnet Goes After Vulnerable VisualTools DVR
cc: @360Netlab blogs.juniper.net/en-us/thre…
360 Netlab retweeted
#necro botnet update:
listen on 10 ports and turns self to be a http proxy
if the request url ends with .js or the response is html, inject with "http://CC_DOMAIN/campaign.js"
they also prepared an img link for "script kiddie", DO NOT LOOK!
hxxp[:]//23.94.186.34/setup.py
360 Netlab retweeted
At VB2021 #vblocalhost @QIHU_Official researchers Ye Jin and Lingming Tu provide an analysis of recent activity of Linux botnet operator keksec. For this and more register now for free. vblocalhost.com/presentation…
360 Netlab retweeted
published a new blog "Why using LSTM to detect DGA is a wrong idea"
toooold.com/2021/07/16/lstm_…
Happy to mention a better idea for online DGA detection from @360Netlab 's DGA presentation. #DGA #lstm #cybersecurity
360 Netlab retweeted
samples url pastebin.com/vF9U2wmL
360 Netlab retweeted
#necro update again
* more proxy nodes
* more scanning exploits
* drop DDNS #DGA, using hardcoded
bp65pce2vsk7wpvy2fyehel25ovw4v7nve3lknwzta7gtiuy6jm7l4yd\.onion\.ws (active since 5-11, huge spike at 5-14) as a gateway for #tor CC
#ThreatHunting #miner #XMRig
#necro update again
new active #DGA domain since 2021-05-09:
* can6dodp.servepics\.com
* ngiwge486ln9daoo.hopto\.org
decoded python scripts here:
pastebin.com/44Yca05Y
a new new DGA seed in it...
360 Netlab retweeted
#ThreatHunting #miner #XMRig
#necro update again
new active #DGA domain since 2021-05-09:
* can6dodp.servepics\.com
* ngiwge486ln9daoo.hopto\.org
decoded python scripts here:
pastebin.com/44Yca05Y
a new new DGA seed in it...
360 Netlab retweeted
Analysing a new type of #botnet (#ZHtrap) that uses a #honeypot to harvest infected devices, courtesy of @360Netlab blog.apnic.net/2021/05/04/zh…
#Malware #security
360 Netlab retweeted
[New Blog] Gain additional insight into the malware dubbed #RotaJakiro by @360Netlab with analysis by @piffey on additional infrastructure unearthed including IP addresses, C2 domains, and more: bit.ly/3gNZBj8
360 Netlab retweeted
#ThreatHunting
more infos:
1, there was a version of "a\.py" will also add a JS miner "hxxp://bmst.pw/6034003x100.js" which will talking with
* ws://ws1.bmst.pw/ws
* ws://ws2.bmst.pw/ws
2, over past month, we've seen 152 website had been hacked
files.slack.com/files-pri/T3…
The #crypto #mining botnet #sysrv-hello has upgraded again on April 20, 2021, with 2 new moduled added to modifiy the Linux victim machine's WEB files in order to infect more Windows machines with the iframe technique.
➡️[BLOG] blog.netlab.360.com/wei-xie-…
⬇️[IoC]
360 Netlab retweeted
On the blog today: #Skidmap and malicious #DNS data mining, by @360Netlab's Zhang Zaifeng: blog.apnic.net/2021/04/19/sk… #DNSSEC #Malware #threatintelligence
