← Feed

Posts

• View post

  And of course, another great resource that you can use for your Intel-Driven threat hunting efforts from MITRE ATT&CK. There is enough intel here to create a bunch of different hypotheses and hunt queries! Salt Typhoon https://attack.mitre.org/groups/G1045/ #huntoftheday #gethunting

• View post

  First, we have created a Hunt Package Collection based on hashtag#SaltTyphoon behaviors which you can find here! There is a Community Edition hunt package in there that can get your hunting started! Salt Tyhpoon Hunt Package Collection https://hunter.cyborgsecurity.io/research/search?state=(compatible:!f,filters:(actors:!(%27Salt%20Typhoon%27)),library:!(cyborg_collections),page:0,size:10,sort:relevance,term:!(),touched:!t) #huntoftheday #gethunting

• View post

  To aid you in your Threat Hunting journey, check out this Threat Profile based on behaviors associated with Amadey! There are two Community Hunt Packages that can get you started! Now get hunting! Amadey https://hunter.cyborgsecurity.io/research/threat-profile/eb857bc3-9908-4356-95e8-4cbba7c64134 #huntoftheday #gethunting

• View post

  Good day everyone! A little while ago I stumbled across an article from Trend Micro that discussed the #Anubis ransomware and its abilities to act both as a ransomware and a wiper. Now it appears that the group has gained sensitive documents related to Disneyland Paris's plans for new rides and renovations (Anubis X post is in the article). Not trying to fear-monger or anything but it goes to show how these groups will adapt their TTPs and behaviors to get to any organization. Anubis...

• View post

  Happy Wednesday everyone! I came across this article from Check Point Software's research team where they discuss a malware "prototype" they found that contained prompt injection to trick any LLM that it may be interacting with while it is being analyzed, aptly named Skynet. It attempted to sue the "Ignore all previous instructions" command adding another layer of sandbox evasion but was unsuccessful in this instance. The malware also contained an emb...

• View post

  Happy Monday everyone and what a way to start it! I encourage you to read the latest report from The DFIR Report where they document an attack that started with a "password spray attack against an exposed RDP server" and ended in the #RansomHub ransomware strain being deployed in the victim's environment and spread over SMB. I am going to forgo the brief summary because I truly believe these reports need to be read by you! But a bunch of LOLBINs were leveraged, inclu...

• View post

  Happy Wednesday everyone! Elastic Security Labs researchers found a bunch of infostealers being spread by adversaries. In the past we have seen other tools like Brute Ratel and CobaltStrike but this time they decided to use a cracked version of #SHELLTER, another offensive security tool (OST). There are TONS of technical details about the tools they used during the investigation into the tool and what artifacts they found. Interestingly they are also releasing a "dynamic unpacker for b...

• View post

  Good day everyone! Morphisec released an insightful report covering Iranian Cyber Warfare that is targeting the West and other enemies of Iran. The APT involved is #Pay2Key, "an Iranian-backed ransomware-as-as-service (RaaS) operation" that is linked to the Fox Kitten APT group and "closely tied to the well-known #Mimic ransomware." Normally I call out behaviors and TTPs related but for this report I want to call out the completeness of the report. Not only...

• View post

  Happy Friday everyone! Researchers from the FortiCNAPP team, part of FortiGuard Labs identified a new variant of the #Lcryx ransomware called #Lcrypt0rx. The report states that it "is a relatively new VBScript-based ransomware strain first observed in November 2024" and "exhibits several unusual characteristics that suggest it may have been generated using AI." According to the researchers, it currently only targets Windows machines. Indicators that led th...

• View post

  Good day everyone! Somehow I missed this article when it first dropped but at least I found it! The DFIR Report published another great article that involved the #Bumblebee malware as the initial access vector that was installed after a user fell victim to an SEO poisoning campaign. The report states that "the threat actor moved laterally to a domain controller, dumped credentials, installed persistent remote access tools, and exfiltrated data using an SFTP client." The adver...

• View post

  Happy Friday everyone! Really thankful for the opportunity to join Arun Warikoo at the SANS Digital Forensics and Incident Response Summit to talk about my passion, Threat Hunting. We focused on how to prioritize a structured-hunt (hypothesis driven) and when to conduct an unstructured, or a data-structured hunt. A big thank you to Heather Barnhart and Phil Hagen for hosting and providing us the opportunity to speak at the event, it truly was an honor and an unforgettable experience! If you m...