πNew report out today!π
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion
β‘οΈ Fake tax form JS (Lunar Spider) β Brute Ratel
β‘οΈ Latrodectus β Cobalt Strike β BackConnect β .NET backdoor
β‘οΈ Cred theft: LSASS, browsers, plaintext DA creds
β‘οΈ Rclone exfil 20 days in
β‘οΈ Nearly 2 months of C2 before eviction β no ransomware, just deep persistence.
#DFIR #ThreatIntel #BruteRatel #CobaltStrike #IncidentResponse #DFIR
In the part two blog, Rapid7 provides a technical analysis of the typo squatted malvertising, PowerShell scripts, RAR contents, and the IDAT Loader. IOC provided. π https://www.rapid7.com/blog/post/2024/04/10/stories-from-the-soc-part-2-msix-installer-utilizes-telegram-bot-to-execute-idat-loader/
In part one of our blog series, we discussed how a Rust based application was used to download and execute the IDAT Loader. In part two of this series, we will be providing analysis of how an MSIX installer led to the download and execution of the IDAT Loader.
Rapid7 published a blog post (first of a two-part blog series) on a case study of IDAT Loader malware being distributed via a FakeUpdates campaign. The final payload is a Brute Ratel C4 badger. Rapid7 describes the attack chain, provides a technical analysis of the IDAT Loader, and provides IOC, MITRE ATT&CK TTPs and known sandbox usernames and analysis tools π https://www.rapid7.com/blog/post/2024/03/28/stories-from-the-soc-part-1-idat-loader-to-bruteratel/
[Threatview.io] β‘π Our proactive hunter C2 scan telemetry indicate 13.82.141[.]216 hosting #BruteRatel C2 on port 443 since atleast 07 July 2022 till date.
πThe oldest #BruteRatel we have
ποΈ11 Months π€―
The DFIR Report
ThreatCat.ch
The Threat Codex
Not Simon
Jesko HΓΌttenhain
Malwar3Ninja | Threatview.io
usl