Brand new report from yours truly:
Living Off the Web: How Trust Infrastructure Became a Malware Delivery Interface
ex_raritas
- 167 Followers
- 13 Following
- 27 Posts
Exciting news! 📣 Join me at ATT&CK CON 4.0 on October 24-25, 2023, in McLean, VA or online. I'll be presenting alongside my colleague Michael Raggi from Mandiant/Google Cloud. We're unveiling a groundbreaking technique, never seen before, exploiting the .lnk shortcut format. Don't miss out! Register here: [Registration Link](https://na.eventscloud.com/website/58627/) #ATTACKCON #malwareresearch
We will see if mastadon has any reach here.
Part 2 of my report on TA569 is out.
Co-authored by Kyle and another one of my peers who wishes to not be tagged.
Why this report is important:
Attribution of other prolific injects to ta569 NOT resulting in SocGholish.
A look at what is new with Socgholish.
Plus more…
https://www.proofpoint.com/us/blog/threat-insight/ta569-socgholish-and-beyond
Pictures of my cats for tax.
Found a new type of malware right before I took vacation. Psyched to write it up when I get back.
Hot take:
Too much emphasis is put on what flavor locker is being used in ransomware operations. Lockers aren’t particularly interesting imo. Maybe to someone studying speed or efficiency but in general they aren’t really that special.
1. Find folders and files, create index, populate tocrypt.
(Staging and exfil happens here)
2. Create threads to handle the following:
a.) read byte stream
b.) crypt
c.) write file
d.) delete original file
e.) if tocrypt eq done: write note buffer to folder.
Hot take:
Too much emphasis is put on what flavor locker is being used in ransomware operations. Lockers aren’t particularly interesting imo. Maybe to someone studying speed or efficiency but in general they aren’t really that special.
1. Find folders and files, create index, populate tocrypt.
(Staging and exfil happens here)
2. Create threads to handle the following:
a.) read byte stream
b.) crypt
c.) write file
d.) delete original file
e.) if tocrypt eq done: write note buffer to folder.
I’m presenting my work on TA569 tomorrow in a webinar.
It is about 77 slides in an hour so it’s a ton of content.
If you want to know all about SocGholish and see a bunch of memes please come watch.
I’m even going to be covering the supply chain attack. :)
