We have just posted our latest research with our observations and analysis into ConnectWise ScreenConnect attacks.

We’ve observed multiple attacks in the past 48 hours. This has included a malware that was built using the LockBit 3 ransomware builder tool leaked in 2022: this may not have originated with the actual LockBit developers.

But we’re also seeing RATS, infostealers, password stealers and other ransomware. All of this shows that many different attackers are targeting ScreenConnect.

Anyone using ScreenConnect should take steps to immediately isolate vulnerable servers and clients, patch them and check for any signs of compromise.

We have extensive guidance and threat hunting material from our teams to help.

We’ll provide updates to our blog with more information as appropriate.

#Sophosxops #threatintel

https://news.sophos.com/en-us/2024/02/23/connectwise-screenconnect-attacks-deliver-malware/

​Would you catch this as an malicious ad?
1️⃣​ Google ad spoofing "dropbox.com"
2️⃣​ Click & redirection involving l.hyros[.]com -> drcpbox[.]net
3️⃣ Fake Dropbox Download "Dropbox-x64.msix"
4️⃣ Powershell execution of #LummaStealer

This campaign is also targeting:
🎯 Zoom (windows only)
🎯 Streamlabs (windows only)
🎯 Telegram (windows & mac)
🎯 TradingView (windows & mac)
🎯 Basecamp (windows only)

#IOCs:
🔗​https://www.virustotal.com/gui/file/60acae4c1ab23e506468ae1995868e8f76f9e7f25439fb154f987ea2e2a9b9cd
🔗​ https://virustotal.com/gui/file/264b1e91bdc38110ee707a4fb7e772433d7a6a17c2ab2d552eb5c4abbe450147

It's copycat season with fake updates. (This was reported earlier).

Loaded via: itsdigitalshiva[.]com/cdn-js/wds.min.php

Payload is again NetSupport RAT after malicious JS execution.

Added regexes for detection in EKfiddle and calling it SmartApeSG (after the hosting company name).

#SocGholish

In mid-June, Sophos identified a previously unnoted initial-access campaign targeting IT users via malicious advertising (malvertising) – one that uses interesting export forwarding and DLL pre-loading techniques to mask malicious activity, hinder analysis, and generally support its foothold once on the target network. Our colleagues at Trend are watching this adversary too, and have some thoughts on what we’re tracking as “Nitrogen,” after we observed a string in the PDB path commonly used among the samples. As we continue our own research, we are sharing early findings with the community. (1/4)

#threatintel #sophosxops

Recently I spent about a week focusing on popular Google search terms and discovered that brand impersonation via malicious ads is still very much a problem.

I've documented my findings and some suggestions in this blog post: https://www.malwarebytes.com/blog/threat-intelligence/2023/05/malvertising-its-a-jungle-out-there

#malvertising

Hi everyone. It's the X-Ops team with another research update.

We've been looking at the fallout of an advisory published by #PaperCut, a print-management software company.

The update to their initial posting about CVE-2023-27350 (https://www.papercut.com/kb/Main/PO-1216-and-PO-1219) reported that they're aware of attacks in the wild targeting their PaperCut MF and NG Application and Site Server software, version 8.0 and newer.

We're publishing some research today into attacks we've observed targeting this platform.

The company (and Sophos) recommend that anyone using this software patch immediately; the patch (https://www.papercut.com/kb/Main/Upgrading#application-server-upgrade) has been available since March 8th. We began to see attackers abusing the unpatched servers on April 13.

Here's a short version of our findings, with the rest published on our blog:

https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/

#malware #worms #malminers #exploit #ransomware

1/6

Hey there. @threatresearch here again, taking over the X-Ops Mastadon to talk about some research we posted this week.

We stumbled upon a malicious tool earlier this year, while our EDR and incident response teams were called in to perform postmortem investigations of ransomware attacks.

While reviewing logs, we found that the threat actors had used a custom-designed #malware we're calling #AuKill as a way to terminate the #EDR agent and endpoint security software the target had installed.

https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver

A short 🧵 begins here