Co-Founder @MalBeacon https://xitter.cf/t.co/e9YTNSPUI5 | Board Member @BSidesCHS. Tweets are mine & should be dismissed as bourbon-fueled ramblings.
Charleston, SC
Joined July 2014
- Tweets2.2K
- Following956
- Followers3.3K
- Likes5.8K
Paul Burbage retweeted
New Op Report with @proofpoint PackClient, a new C2 framework from Chinese speaking actor TA4922, detonated in a live DeceptionPro honeynet.
The RAT was just the doorman. 4.5 hours in, the operator enrolled the victim into an attacker owned ManageEngine Endpoint Central server.
Paul Burbage retweeted
New Op Report: an operator took the bait on one of our honeynets and ran the whole chain.
Phishing lure to batch script to silent ScreenConnect install, hands-on-keyboard then XLoader / FormBook.
Interactive RMM + automated stealer in one op. Not a pairing we'd seen before.
New blog: EDR telemetry links a ClickFix-style lure to Velvet Tempest → hands-on-keyboard activity consistent w/ Termite ransomware tradecraft.
Timeline + IOCs + defender takeaways (hunts/detections/hardening).
(link in thread)
check out the full Deception.Pro operation report:
blog.deception.pro/blog/cast…
Paul Burbage retweeted
Remote Monitoring and Management (RMM) tooling is taking over the cybercrime landscape. And it keeps growing. 🤖
In partnership with DeceptionPro, we observed follow-on activity from a Bluetrait campaign in an environment built to resemble a travel company.
The result? Even more RMMs. blog.deception.pro/blog/hok-…
Paul Burbage retweeted
Indtroducing: What is this stealer?
A new repository that allows for you to identify Stealer malware by the system information text file format commonly included in stealer malware exfiltration.
We encourage everyone to check it out and contribute!
github.com/MalBeacon/what-is…
Some major feature additions coming to #MalBeacon portal this weekend thanks to @fr3dhk!
For now, here's a little teaser:
YouTube continued to be used to load malware.
Take a look at this #StealC and #Laplas campaign:
linkedin.com/posts/paul-k-bu…
Paul Burbage retweeted
If you use 3CX software, I highly recommend looking for these indicators and also looking for suspicious activity from any 3CX processes. If you aren't sure if you use this software, check! reddit.com/r/crowdstrike/com…
Quick writeup on some recent #MalBeacon activity..
linkedin.com/pulse/cyber-dec…
Paul Burbage retweeted
Free tickets for the Malware & Reverse Engineering Conference 2023. This is great, and special thanks to @oceania_cyber for their generosity. DM OCSC for your free ticket. federation.edu.au/icsl @fancy_4n6 @GyledC @awsn_au @hexlax @DefenceScience @DSI_VIC @MattTett @push_pnx
As part of our sponsorship of @FedUniAustralia's Malware & Reverse Engineering Conference we are giving away free tickets for interested students and researchers ⬇️
brace yo self!
#Emotet
100% this!
2/2
If you are an org that is using AteraAgent for remote administration, you should consider alerting on all emails that don't match your org's domain.
Here is the Emotet report:
thedfirreport.com/2022/09/12…
Pretty apparent that indicator feeds are having a hard time spotting the actual #formbook / #xLoader C2s amongst the decoys..
🤔🤔🤔🤔
#MalBeacon
Congrats to @skier_t and @hatching_io team!
@RecordedFuture picked up some amazing talent here!
prnewswire.com/news-releases…
Looking for an excuse to have a Charleston beach getaway?
Look no further..
Call for papers opened:
cfp.bsidescharleston.org
Out-freaking-standing @TheJusticeDept!
👏👏👏👏👏👏
justice.gov/opa/pr/departmen…
