Yonatan K retweeted
Short “RegreSSHion” (CVE-2024-6387) hunting TL;DR based on the work we did at Hunters’ team Axon:
1. Look for spikes of incoming network connections towards “sshd” from public IPs using EDR Logs
2. Significant amount of “timeout before authentication” SSHD log entries
Links 👇
Yonatan K retweeted
📢 We’ve identified a new and massive #ransomware campaign targeting external facing #Postgres servers. IOCs below and more details coming soon.
IOCs:
185[.]225.75.188
185[.]225.75.189
194[.]180.49.20
194[.]180.49.9
Yonatan K retweeted
#InfoStealer Campaign targeting Mexico🇲🇽
Phishing Website (impersonating Mexico billing/goverment sites) -> .zip -> .url (file:// URI scheme in URL parameter) -> #WebDAV hosted .jse/.exe
#opendir with various samples at:
172.86.68[.]194:80
Yonatan K retweeted
Some of our team's recent research on S3 ransomware is featured in @AwsSecDigest!
Go check it out plus other great content from expert AWS researchers 👇
💌 AWS Security Digest 133 is out!
1️⃣ The Rising Threat of S3 Ransomware: Mastering Detection @team__axon
2️⃣ AWS Security Monitoring in 2023: Untangle the chaos @cloudonaut_io
3️⃣ Security Hub gives me imposter syndrome @jcfarris
asd.zph.app/63C
Fully EDR Bypass initial access vector using #cmdl32.exe (??)
weaponized LNK object with cmdl32’s settings file inside RAR.
#pentesting #edr #redteam #purpleteam @ElliotKillick
BUT the key thing here is... does someone understand why we're having the double ampersand without space after the cmdl32.exe command line? (hint: it won't work without that..)
kudos to @ElliotKillick on finding this #Lolbin last year, he also published a fantastic blogpost on the internals of the binary elliotonsecurity.com/living-….
I'll may also publish a blog on some insights I took from reverse engineering the #lolbin
