DomainTools Investigations’ (DTI) latest analysis uncovers a technically sophisticated malware campaign that uses fake CAPTCHAs and spoofed document verification pages (like Docusign) to trick users into self-infecting their machines with the NetSupport RAT.

Key tactics include:

🔹 Clipboard poisoning via fake CAPTCHA pages
🔹Multi-stage PowerShell downloaders
🔹Spoofed Gitcodes and Docusign domains
🔹Infrastructure overlap with known threat groups like SocGholish, FIN7 and STORM-0408

Read the full breakdown including security recommendations here: https://dti.domaintools.com/how-threat-actors-exploit-human-trust/?utm_source=Mastodon&utm_medium=Social&utm_campaign=Prove-You-Are-Human

#ThreatIntelligence #CyberSecurity #SocGholish #Malware

🚨New ransom group blog post!🚨

Group name: incransom
Post title: Sandhills Medical Foundation
Info: https://cti.fyi/groups/incransom.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: ransomblog_noname
Post title: Mulia Raya
Info: https://cti.fyi/groups/ransomblog_noname.html

Group name: blacksuit
Post title: http://metromont.com
Info: https://cti.fyi/groups/blacksuit.html

Group name: blacksuit
Post title: http://www.innsofaurora.com
Info: https://cti.fyi/groups/blacksuit.html

Group name: incransom
Post title: Jordan Drug
Info: https://cti.fyi/groups/incransom.html

Group name: embargo
Post title: M&H Electric Fabricators
Info: https://cti.fyi/groups/embargo.html

Group name: ransomblog_noname
Post title: UnigazJordan
Info: https://cti.fyi/groups/ransomblog_noname.html

Group name: lockbit3
Post title: geruestba
Info: https://cti.fyi/groups/lockbit3.html

Group name: arcusmedia
Post title: Acorn Sales
Info: https://cti.fyi/groups/arcusmedia.html

Group name: arcusmedia
Post title: STANDBYTE
Info: https://cti.fyi/groups/arcusmedia.html

Group name: play
Post title: Anchor Industries
Info: https://cti.fyi/groups/play.html

Group name: play
Post title: Tri-Point Solutions
Info: https://cti.fyi/groups/play.html

Group name: play
Post title: W.E. Bowers
Info: https://cti.fyi/groups/play.html

Group name: incransom
Post title: mysfa.org
Info: https://cti.fyi/groups/incransom.html

Group name: incransom
Post title: sitro.com.au
Info: https://cti.fyi/groups/incransom.html

Group name: flocker
Post title: Trustgrp.ae
Info: https://cti.fyi/groups/flocker.html

Group name: flocker
Post title: Dcsdev.org
Info: https://cti.fyi/groups/flocker.html

Group name: incransom
Post title: Universidad Técnica del Norte Ecuador
Info: https://cti.fyi/groups/incransom.html

Group name: incransom
Post title: valuestoreit
Info: https://cti.fyi/groups/incransom.html

Group name: blacksuit
Post title: http://www.kcac.com
Info: https://cti.fyi/groups/blacksuit.html

Group name: ransomhouse
Post title: Vinda Group
Info: https://cti.fyi/groups/ransomhouse.html

Group name: play
Post title: Capital Trade
Info: https://cti.fyi/groups/play.html

Group name: play
Post title: FLOE Internationa
Info: https://cti.fyi/groups/play.html

Group name: kairos
Post title: Jericho Fire Department
Info: https://cti.fyi/groups/kairos.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

Set up CrowdSec IPDEX on OPNsense to enhance threat detection, response, and intelligence gathering.

Follow this guide by CrowdSec Ambassador Flaviu to start running CrowdSec IPDEX, a simple CLI tool that gathers insights on IP addresses, on @opnsense, the open source FreeBSD-based firewall.

Get started 👉 https://vlaicu.io/posts/crowdsec-ipdex/

#opensource #opensourcesecurity #threatintelligence #firewall #cybersecurity

Microsoft and CrowdStrike are merging threat actor names—revealing that Volt Typhoon and VANGUARD PANDA are actually the same. This move could transform how we battle cyber threats. Curious how?

https://thedefendopsdiaries.com/strengthening-cybersecurity-microsoft-and-crowdstrikes-unified-approach/

#cybersecurity
#threatintelligence
#microsoft
#crowdstrike
#cyberdefense

Martyn Williams (Stimson Center’s Korea Program and 38 North) and Nick Roy (Silent Push) presented an interesting talk at THOTCON 0xD on a misconfigured DPRK server and the data they found. Cool to see everything that goes into getting online in DPRK and the tools used to do so. They posted their THOTCON slide deck at silibank.com/thotcon, which Nick apparently purchased after the domain was allowed to expire by DPRK entities.

Their NK Tech Lab site is a new center for investigation and analysis into how North Korea uses technology to serve and suppress its citizens.

Nktechlab.org
Silibank.com/thotcon

#thotcon #dprk #cti #ThreatIntelligence

Eat, Sleep, Scam, Repeat?

Losing your life savings to a crypto scam is devastating — but for many victims, the nightmare doesn’t end there.

While recently investigating a network of fake cryptocurrency exchanges, we uncovered something even more twisted: a cluster of scam websites posing as law firms offering 'crypto recovery' services.

Yep, the very same scammers who stole the funds are now posing as lawyers, pretending to help victims recover what they lost… for a fee, of course.

Preying on victim hope and desperation, these scammers have been known to:

- Contact victims directly using details obtained during the original scam
- Advertise openly on social media
- Lurk in public forums, targeting those seeking help from the community

Using a mix of lookalike sites impersonating legit legal firms and entirely fake entities, often with stolen names and photos of legitimate legal professionals, here are some recent examples of what we've encountered:

- Posing as 'Adam & Shawn Law Group'
- adamshawnllp[.]com
- adamshawnlaw[.]com
- Posing as 'Jefferson Caldwell International Law Firm'
- jeffersoncaldwelllawgroup[.]com
- Posing as 'Schlueter & Associates'
- schlueterlawfirm[.]it[.]com
- Posing as 'Zojz & Associates Legal Group'
- zojz[.]com
- zojz[.]cc

Not only do these domains share registration characteristics with fake crypto exchanges, but we've also observed site structures, content and design elements across fake law firms, crypto exchanges and task scam sites.

Aside from avoiding the initial scams, be cautious of any 'law firm' that:

- Sends unsolicited emails or DMs offering crypto recovery help
- Has a website with no verifiable legal credentials
- Pressures you to pay fees upfront, especially to a third-party entity or via crypto
- Uses vague or generic testimonials

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam