| Website | https://sekoia.io |
| Blog | https://blog.sekoia.io |
| GitHub | https://github.com/SEKOIA-IO |
#TDR analysts published a new report detailing #ErrTraffic, a widespread #ClickFix malware distribution framework.
ErrTraffic injects malicious JavaScript into compromised WordPress and malicious sites to serve ClickFix lures.
Our forensic analysis of compromised WordPress servers helped us to cluster ErrTraffic and map affiliates' TTPs and backdoors.
We notably identified two distinct clusters: "Analytics" operated by a single threat actor, and "Beer" likely operated by LenAI for affiliates.
The ErrTraffic MaaS offering includes:
- The EtherHiding technique to retrieve the C2 from Polygon smart contracts
- A Traffic Distribution System (TDS) to filter unwanted traffic
- Various ClickFix lures
LenAI, the operator behind ErrTraffic, sells subscriptions for $380/month
🇷🇺 Sekoia #TDR team has just released a comprehensive analysis of how #APT28's arsenal has evolved, from its early to its current operations.
The second and third parts of our investigation into the #Gamaredon, the cyberespionage group operated by the Russian #FSB, are live!
🪆Part 2 — The loaders https://buff.ly/bBYZSKa
🪆Part 3 — The stealer & full infrastructure https://buff.ly/74WHuPd
Russia's #FSB-linked #Gamaredon has been hammering Ukraine's government, military & critical infrastructure for over a decade. We went behind the scenes.
Tracked their infrastructure. Recovered artefacts from compromised machines. Here's what we found 🧵 https://buff.ly/6hR2IMj
