303: @ https://xitter.cf/t.co/I4aYuNOKKY Life long snowboarder and opportunist threat hunter | my views are my own
Joined July 2023
- Tweets70
- Following343
- Followers140
- Likes150
security_dumpster retweeted
Sophos analysts are investigating a new infection chain for the GOLD BLADE cybercriminal group’s custom RedLoader malware, which initiates command and control (C2) communications.
security_dumpster retweeted
Sophos MDR has observed 2 distinct social engineering campaigns using a technique referred to as ClickFix spiking during March. Both of these campaigns—one surging on 2 March & the other 12 March—attempted to deploy SecTopRAT malware. We are tracking this activity as STAC6380./1
security_dumpster retweeted
In November, Sophos MDR noted a rapid decline in detections for the Rockstar2FA phishing as a service platform. Its rise was documented in a report by Trustwave on November 26. /1
trustwave.com/en-us/resource…
security_dumpster retweeted
My @MSFTBlueHat talk "Deprecating Azure AD Graph API is Easy and Other Lies We Tell Ourselves" is now on Youtube!
Link to recording & slide deck at aadinternals.com/talks/
security_dumpster retweeted
🔥 New from @philofishal , @syrion89 and @TomHegel:
🇰🇵 BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence
sentinelone.com/labs/bluenor…
security_dumpster retweeted
"China’s ‘mind-boggling’ space capabilities worry US, says Space Force chief
Beijing’s tech is more concerning than reports of Russian space nukes, said General B. Chance Saltzman."
1/
politico.eu/article/china-mi…
security_dumpster retweeted
Hey :)
We published a blog talking about ORB networks and a summarise of the purpose, use cases and more:
team-cymru.com/post/an-intro…
This blog is also a teaser for more blogs to come 👀
@teamcymru_S2
security_dumpster retweeted
This has been one of my favorites for a while, but now it's time to let it go.
Here's my preferred way of getting the KeePass db that we often hunt for:
downgrade the executable to version 2.53, use CVE-2023-24055 and wait for the busy admin to trigger the dump of the database.
The target can remain clean and you can simply check for the dump creation.
KeePass version 2.53 can still open kdbx created with the version 2.57 and if using a proper xml the user will likely notice nothing.
Update alerts can also be disabled within the xml.
gist.github.com/naksyn/6d566…
security_dumpster retweeted
Sophos detailed to me its 5-year cat-and-mouse game with Chinese hackers repeatedly exploiting its firewalls. The company resorted to installing spy "implants" on devices the hackers were testing on—tracing them to a university and contractor in Chengdu. wired.com/story/sophos-cheng…
security_dumpster retweeted
Recent trick related to .RDP files used by the SVR 🇷🇺 is worth threat hunting for.
Basically they’re doing what this @BHinfoSecurity blog demoed in 2022: blackhillsinfosec.com/rogue-…
Reports:
1. cert.gov.ua/article/6281076
2. aws.amazon.com/blogs/securit…
3. microsoft.com/en-us/security…
security_dumpster retweeted
OK, I promise to stop spamming about relays with NTLM/Kerberos 😅. But if you're a member of the Distributed COM or Performance Log group, these juicy CLSIDs let you trigger remotely machine authentication of any computer, including DCs, and relay DCOM -> HTTP, SMB… 👇
security_dumpster retweeted
🚨 ITW Zero-Day Vulnerability Discovery: #APT37 (#Scarcruft) 🚨
For Responsible Disclosure, we disclose relevant details at this time: Unmasking CVE-2024-38178 The Silent Threat of Windows Scripting Engine
🔗 medium.com/s2wblog/unmasking…
🔍 Key findings:
- The attack used a freeware advertising module to exploit the vulnerability, marking a shift from previous methods.
- The shellcode execution bore striking similarities to tactics from three years ago, underscoring the importance of studying an attacker’s Tactics, Techniques, and Procedures (#TTPs).
A few months ago, this issue was shared exclusively with companies in the Joint Analysis Council led by the NCSC, and yesterday, the security advisory was released to the public.
Stay informed and vigilant!
#APT37 #ThreatHunting #ITW #ZeroDay #TTPs #ThreatIntel #ResponsibleDisclosure
security_dumpster retweeted
My DEF CON 32 talk "Behind Enemy Lines: Engaging and Disrupting Ransomware Web Panels" is up on YouTube!
youtube.com/watch?v=T5K4ABfz…
security_dumpster retweeted
📣SPEAKER ANNOUNCEMENT📣
We're excited to announce our next #BlueHat speakers: Mark Parsons (@securitydumpstr) and Colin Cowie from Sophos. They will be presenting a talk titled “Patterns in the Shadows: Scaling Threat Hunting and Intelligence for Modern Adversaries.”
Mark is a Threat Hunter for the Sophos Managed Detection and Response Team. He focuses on identifying and tracking nation-state related threats and has presented his findings at Black Hat USA and PivotCon 2024. Outside of work, he is a loving dog dad and avid backcountry snowboarder.
Colin is a Threat Intelligence Analyst for the Sophos Managed Detection and Response team. He focuses on detecting emerging threats, threat actor identification, and incident response. In past roles, he has worked in the financial sector performing penetration testing as well as in mobile forensics for law enforcement.
security_dumpster retweeted
The calendar for the Fall/Winter Virtual Research Workshop Series is out:
eccri.eu/eccri-virtual-resea…
security_dumpster retweeted
📝 Just published a quick blog post: "Unintentional Evasion: Investigating How CMD Fragmentation Hampers Detection & Response"
A recent investigation prompted me to share some quick thoughts on the topic of command line omission and fragmentation in Windows CMD, which can unintentionally create gaps in security monitoring.
We see many attackers prefer GUI access to the victim's host through RMMs or RDP. The commands they type through the interactive session often go unnoticed due to some logging gaps.
I wanted to highlight these often-overlooked issues hindering forensic analysis and threat detection. I hope you find it useful 🙂
Article🔗: kostas-ts.medium.com/uninten…
security_dumpster retweeted
At #PREDICT2024, we just presented a report on Rhysida's multi-tiered infrastructure. Combined with @RecordedFuture Network Intelligence, we identified #Rhysida #ransomware victims on average 30 days before they appeared on their extortion site (1/8).
recordedfuture.com/research/…
security_dumpster retweeted
The intruder used open-source tools, including the RingQ malware obfuscation tool and Impacket, manipulating Windows Accessibility features via the mklink command to elevate privileges to System using ATT&CK technique T1546.008 /4
attack.mitre.org/techniques/…
security_dumpster retweeted
The ShadowPad loader sample analyzed matched one in a recent case reported by Cisco Talos attributed to Chinese cyberespionage threat actor group APT41. The vulnerable binary, imecmnt.exe, looks for a for a specific byte sequence at offset 0xE367. /2
blog.talosintelligence.com/c…