Mastodawn

Jérôme Segura Jul 18, 2023

There's a new player in the 'fake updates' arena. Thanks to @rmceoin for initially posting about it here.

Blog link: https://www.malwarebytes.com/blog/threat-intelligence/2023/07/socgholish-copycat-delivers-netsupport-rat

#FakeUpdates #FakeSG #SocGholish

FakeSG enters the 'FakeUpdates' arena to deliver NetSupport RAT

Over 5 years ago, we began tracking a new campaign that we called FakeUpdates (also known as SocGholish) that used compromised...

Malwarebytes

Show thread

Randy Jul 19, 2023

@jeromesegura Great write up! I like the name. My script had a lame name fakeupdate2.py. I'll be renaming that bad boy to fakesg.py !

BTW, I noticed that the various google-analytiks sites use Keitaro just like the normal SocGholish. Seems to be a fan favorite for TAs.

google-analytiks[.]com/admin/

Show thread

Jérôme Segura

@rmceoin the similarities are so striking. The blog does not cover any background intel on the threat actor, but I’m hoping others come forward with additional details.