Calendly being targeted recently. Here are the IOCs you may want to block:

calhellly[.]buzz
caltendly[.]xyz
calhellly[.]click
caltendly[.]click
callndaly[.]art
calendly[.]buzz
Calandly[.]one
calendllyn[.]com
Calendly[.]city
calendsly[.]cc
calindaly[.]com
caltendly[.]com
Caltendly[.]icu
Caltendly[.]life
154[.]82[.]93[.]96
78[.]24[.]180[.]93
92[.]246[.]136[.]89
#phishing
#threatintel
#threathunting

Those patching their PaloAlto CVE-2024-3400 should also consider performing a compromise assessment.

IOC:.https://github.com/volexity/threat-intel/blob/main/2024/2024-04-12%20Palo%20Alto%20Networks%20GlobalProtect/indicators/iocs.csv

OKTA Breached Again.
Threat hunting rules are pushed to @sigma_hq official repo.

Based on
#BeyondTrust
and
#cloudflare
investigation and threat hunting the IOC. A set of rules is published in the
@sigma_hq
repository to identify the IOCs in the environment.

https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Okta-Support-System-Breach/README.md
Rules:
1- rules-threat-hunting/cloud/okta/okta_password_health_report_query.yml
2- rules-emerging-threats/2023/TA/Okta-Support-System-Breach/okta_apt_suspicious_user_creation.yml
3- rules/cloud/okta/okta_admin_activity_from_proxy_query.yml

#OKTA #oktabreach

The detection rules are published in Sigma official repo for both Lin and Win OS based on
@Mitiga_io
report.

https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/

https://phish.ly An automated phishing analysis powered by
Tines
and
@urlscanio

https://www.tines.com/blog/phishly-democratizing-suspicious-email-analysis-tines-urlscan