The Threat CodexApr 25, 2025
The Massive, Hidden Infrastructure Enabling Big Game Hunting at Scale
#TAG_124 #TA866 #AsylumAmbuscade
https://www.recordedfuture.com/blog/massive-hidden-infrastructure-enabling-big-game-hunting-at-scale
How TAG-124 Enables Targeted Malware Attacks via Traffic Distribution Systems

Discover how cybercriminals use malicious Traffic Distribution Systems like TAG-124 to deliver ransomware and malware to high-value targets in healthcare and critical infrastructure.

ITSEC NewsOct 30, 2024
Highlighting TA866/Asylum Ambuscade Activity Since 2021 - TA866 (also known as Asylum Ambuscade) is a threat actor that has been conducting intrusi... https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/ #threatspotlight #asylumambuscade #securex #ta866
Highlighting TA866/Asylum Ambuscade Activity Since 2021

TA866 (also known as Asylum Ambuscade) is a threat actor that has been conducting intrusion operations since at least 2020.

Cisco Talos Blog
b4n1shedOct 23, 2024

Super excited to share research that we just published related to activity associated with #TA866 #AsylumAmbuscade since 2021 as well as links to recent #WarmCookie/#BadSpace activity. Check it out!

https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/

We also did an comparative analysis of the code execution flow in #Resident backdoor and #WarmCookie and took a look at recent changes in #WarmCookie functionality!

https://blog.talosintelligence.com/warmcookie-analysis/

Highlighting TA866/Asylum Ambuscade Activity Since 2021

TA866 (also known as Asylum Ambuscade) is a threat actor that has been conducting intrusion operations since at least 2020.

Cisco Talos Blog
Selena LarsonJan 18, 2024

New research published today on #TA866 making their return to email. Interesting new TTPs to deliver the custom WasabiSeed and Screenshotter toolkit. This is yet another actor that uses #TA571 for payload delivery.

https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta866-returns-large-email-campaign

Security Brief: TA866 Returns with a Large Email Campaign  | Proofpoint US

What happened  Proofpoint researchers identified the return of TA866 to email threat campaign data, after a nine-month absence. On January 11, 2024, Proofpoint blocked a large volume campaign consi...

Proofpoint
Opalsec Feb 12, 2023

This week's newsletter is hot off the press, get it here: https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-b16

The #ESXiArgs escapades have gone from bad to okay and back to bad again, after attackers revised their encryption routine to bypass CISA's recovery script, and launched a 2nd wave of attacks that resulted in the reinfection of hundreds of hosts. Worst yet - we don't know how they're doing it, as the OpenSLP service (believed to be their method of ingress) has been disabled in a number of reported infections.

PowerShell isn't dead - The DFIR Report published their analysis of an apparent attack by Iran's Oilrig/APT34, whose initial infection relied exclusively on PowerShell and remained undetected for a significant period of time.

Proofpoint have unveiled #TA866, a savvy threat group that leverages the 404 Traffic Distribution System and little known AutoHotKey scripting language to cherry pick their targets.

#RedTeam members might find the BokuLoader Reflective Loader for #CobaltStrike useful in their next engagements, as well as #LocalPotato - the latest PrivEsc technique to join the Potato family.

#BlueTeam - check out a list of resources that popped up last week to help analyse #ASyncRAT malware and infections, as well as some helpful how-tos on hunting IIS backdoors and DLL abuse techniques

Happy reading, and happy Monday!

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-b16

#infosec #CyberAttack #Hacked #cyber #news #cybernews #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #redteam #soc #threatintel #threatintelligence #vmware #ESXi

SOC Goulash: Weekend Wrap-Up

06/02/2023 - 12/02/2023

Opalsec
Andrea Fortuna Feb 9, 2023
A Russian threat group, dubbed #TA866 by #Proofpoint, is suspected of using a new technique to steal sensitive information. The group has been taking screenshots of infected devices and uploading them to a remote server. #cybersecurity https://andreafortuna.org/2023/02/08/russian-threat-group-steal-screenshots-from-victims-devices?utm_source=dlvr.it&utm_medium=mastodon
Russian threat group steal screenshots from victims devices

A Russian threat group, dubbed TA866 by Proofpoint, is suspected of using a new technique to steal sensitive information. The group has been taking screenshots of infected devices and uploading them to a remote server.

Andrea Fortuna