Jérôme SeguraI made this page to track current fake browser updates campaigns:
mithrandir
- 114 Followers
- 62 Following
- 240 Posts
Malware Analysis
Colin Cowienewest #solarmarker infostealer malware:
#SEOPoisoning -> Fake Sites -> download via diggiski[.]com
If you are interested in steganography and browser fingerprinting, I wrote a follow up blog on a scam campaign that I've tracked for several years.
Reproducing & capturing this attack chain is quite difficult because of the number of checks performed. No doubt it contributes to why this scheme is working so well.
https://www.malwarebytes.com/blog/threat-intelligence/2023/08/wooflocker2
If you track #malvertising campaigns, you may need to adjust your environment to account for more advanced fingerprinting techniques.
More details in this blog: https://www.malwarebytes.com/blog/threat-intelligence/2023/08/malvertisers-up-the-game-against-researchers
Monitor SGNew #SocGholish C2:
hXXps://bvpix.photo.beyoudcor[.]com/editContent
bvpix.photo.beyoudcor[.]com
185[.]225.70.190
Added #EKFiddle rules to detect Google DNS injections used in tech support scam redirects.
Based on this Sucuri blog: https://blog.sucuri.net/2023/08/from-google-dns-to-tech-support-scam-sites-unmasking-the-malware-trail.html
From Google DNS to Tech Support Scam Sites: Unmasking the Malware Trail
Bad actors are elevating their malware campaigns by leveraging the DNS protocol to hide requests to their infrastructure. Learn how hackers are injecting malicious JavaScript to send requests to Google DNS, then using the responses to redirect users to tech support scams and adult websites.
#SocGholish is currently delivering a JS based beacon.
I've been attempting use an AD lab environment to coax responses from the C2.
So far I have only received the following commands, which are sometimes delivered together, and sometimes delivered separately:
nltest /dclist:
nltest /domain_trusts
cmdkey /list
Once my victim machine responds with the command outputs, the C2 either kills the WScript process with another response, or just doesn't respond at all.
My bait must either not be attractive enough or not disguised well enough..
Sophos X-OpsAfter a three-months long investigation into four ransomware attackers from the first half of 2023, Sophos X-Ops has uncovered new connections between Black Basta, Hive, and Royal Ransomware based on granular similarities in the forensics of the attacks.
Digital assets like NFTs are a prime target for #phishing scams.
In this quick blog I go over a recent #malvertising campaign via Bing ads.
#FakeSG / #RogueRaticate leading to #netsupportrat
ebodyfit[.]com/wp-content/uploads/ultimatemember/58/downloading-(114.0.522735.199%20(Official%20Build).url
ebodyfit[.]com/wp-content/uploads/ultimatemember/57/consciousnessx.hta
ebodyfit[.]com/wp-content/uploads/ultimatemember/56/housealba.zip
ebodyfit[.]com/wp-content/uploads/ultimatemember/56/clients32.exe