Okla.Social

2 posts2 participants0 posts today

ANY.RUN👾 Cactus is a <a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ransomware</a> that encrypts not only your data, but its own binaries It uses triple-extortion tactics and abuses <a href="https://infosec.exchange/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerabilities</a> days after they’re exposedLearn more & collect <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a>: <a href="https://any.run/malware-trends/cactus/?utm_source=mastodon&utm_medium=post&utm_campaign=cactus&utm_content=tracker&utm_term=170325" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://any.run/malware-trends/cactus/?utm_source=mastodon&utm_medium=post&utm_campaign=cactus&utm_content=tracker&utm_term=170325</a><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/cyber" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cyber</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a>

FunesYo <a href="https://infosec.exchange/tags/HijackLoader" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HijackLoader</a> to <a href="https://infosec.exchange/tags/RedLineStealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RedLineStealer</a> incidents all over the place today. Make sure you're blocking 92.255.85[.]36 at the fw and bitly[.]cx unless you need to use that specific url shortening service for some strange reason.<a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/iocs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iocs</a>

ANY.RUN⚠️ It may seem that <a href="https://infosec.exchange/tags/rootkits" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rootkits</a> golden age has passed, but they are still present and dangerous. Keep in mind what they are and how not to let them into your system. 🎯 Learn more & collect <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a>: <a href="https://any.run/malware-trends/rootkit/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_content=tracker&utm_term=110325" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://any.run/malware-trends/rootkit/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_content=tracker&utm_term=110325</a><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>

ANY.RUN🚨 Fake Booking.com phishing pages used to deliver malware and steal data ⚠️ Attackers use <a href="https://infosec.exchange/tags/cybersquatting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersquatting</a>, mimicking Booking website to create legitimate-looking phishing pages that trick users into executing malicious actions. Leveraging <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ANYRUN</a>'s interactivity, security professionals can follow the entire infection chain and gather <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a>.👨‍💻 Case 1: The user is instructed to open the Run tool by pressing Win + R, then Ctrl + V to paste the script, and hit Enter. This sequence of actions executes a <a href="https://infosec.exchange/tags/malicious" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malicious</a> script that downloads and runs malware, in this case, <a href="https://infosec.exchange/tags/XWorm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#XWorm</a>. Take a look at the analysis: <a href="https://app.any.run/tasks/61fd06c8-2332-450d-b44b-091fe5094335/?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_term=060325&utm_content=linktoservice" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://app.any.run/tasks/61fd06c8-2332-450d-b44b-091fe5094335/?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_term=060325&utm_content=linktoservice</a>🔍 TI Lookup request to find domains, IPs, and analysis sessions related to this campaign: <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522domainName:%255C%2522mktoresp.com%255C%2522%2520AND%2520domainName:%255C%2522booking.*.%255C%2522%2522,%2522dateRange%2522:30%7D%20%20" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522domainName:%255C%2522mktoresp.com%255C%2522%2520AND%2520domainName:%255C%2522booking.*.%255C%2522%2522,%2522dateRange%2522:30%7D%20%20</a>🎯 Use this search query to find more examples of this fake <a href="https://infosec.exchange/tags/CAPTCHA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CAPTCHA</a> technique and enhance your organization's security response: <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522commandLine:%5C%2522" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522commandLine:%5C%2522</a>👨‍💻 Case 2: In this scenario, threat actors aim to steal victims’ banking information. It’s a typical phishing site that mimics Booking website and, after a few steps, prompts users to enter their card details to ‘verify’ their stay. See example: <a href="https://app.any.run/tasks/87c49110-90ff-4833-8f65-af87e49fcc8d/?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_term=060325&utm_content=linktoservice" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://app.any.run/tasks/87c49110-90ff-4833-8f65-af87e49fcc8d/?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_term=060325&utm_content=linktoservice</a>📌 A key domain in this campaign, Iili[.]io, was also used by <a href="https://infosec.exchange/tags/Tycoon2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tycoon2FA</a> <a href="https://infosec.exchange/tags/phishkit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishkit</a>. 🔍 Use this TI Lookup query to find more examples: <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522domainName:%255C%2522bzib.nelreports.net%255C%2522%2520AND%2520domainName:%255C%2522xpaywalletcdn.azureedge.net%255C%2522%2520AND%2520domainName:%255C%2522cdnjs.cloudflare.com%255C%2522%2520AND%2520domainName:%255C%2522xpaycdn.azureedge.net%255C%2522%2520AND%2520domainName:%255C%2522iili.io%255C%2522%2522,%2522dateRange%2522:180%7D%20" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522domainName:%255C%2522bzib.nelreports.net%255C%2522%2520AND%2520domainName:%255C%2522xpaywalletcdn.azureedge.net%255C%2522%2520AND%2520domainName:%255C%2522cdnjs.cloudflare.com%255C%2522%2520AND%2520domainName:%255C%2522xpaycdn.azureedge.net%255C%2522%2520AND%2520domainName:%255C%2522iili.io%255C%2522%2522,%2522dateRange%2522:180%7D%20</a>Investigate the latest <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> and <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> attacks with <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ANYRUN</a> 🚀<a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

ANY.RUN👾 <a href="https://infosec.exchange/tags/Akira" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Akira</a> <a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ransomware</a>-as-a-service has been used to extort over $40 million from businesses in finance, technology, and healthcare. ⚠️ It is operated by Howling Scorpius and uses double extortion.Learn more & collect <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a>: <a href="https://any.run/malware-trends/akira/?utm_source=mastodon&utm_medium=post&utm_campaign=akira&utm_content=tracker&utm_term=030325" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://any.run/malware-trends/akira/?utm_source=mastodon&utm_medium=post&utm_campaign=akira&utm_content=tracker&utm_term=030325</a><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

ANY.RUN🎯 <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ANYRUN</a> TI Feeds feature both fresh and unique <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a> extracted from malware configs and caught by <a href="https://infosec.exchange/tags/Suricata" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Suricata</a> rulesFind out what indicators they contain and how they can level up your org's threat detection 👇 <a href="https://any.run/cybersecurity-blog/indicators-in-ti-feeds/?utm_source=mastodon&utm_medium=post&utm_campaign=indicators_in_ti_feeds&utm_term=270225&utm_content=linktoblog" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://any.run/cybersecurity-blog/indicators-in-ti-feeds/?utm_source=mastodon&utm_medium=post&utm_campaign=indicators_in_ti_feeds&utm_term=270225&utm_content=linktoblog</a><a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

ANY.RUN🔔 Subscribe to threat updates in TI Lookup Regularly receive notifications about fresh intel of your interest, quickly track changes in <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a>, <a href="https://infosec.exchange/tags/IOAs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOAs</a>, & <a href="https://infosec.exchange/tags/IOBs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOBs</a>, and stay informed about evolving threats🚀 Streamline your work with <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ANYRUN</a>: <a href="https://intelligence.any.run/plans/?utm_source=mastodon&utm_medium=post&utm_campaign=notifications_video&utm_term=250225&utm_content=linktotiplans/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://intelligence.any.run/plans/?utm_source=mastodon&utm_medium=post&utm_campaign=notifications_video&utm_term=250225&utm_content=linktotiplans/</a><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>

The Spamhaus ProjectMirai is the #1 malware family on <a href="https://ioc.exchange/@abuse_ch" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@abuse_ch</a> URLhaus AND MalwareBazaar, with 5,363 sites reported and 3,210 samples shared.🔗 URLHaus: <a href="https://www.spamhaus.org/malware-digest/#urlhaus" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.spamhaus.org/malware-digest/#urlhaus</a> 👾 MalwareBazaar: <a href="https://www.spamhaus.org/malware-digest/#malwarebazaar" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.spamhaus.org/malware-digest/#malwarebazaar</a>But with 3,046 IOCs, find out which malware family is 🔝 of the charts on Threatfox👇 🦊 ThreatFox: <a href="https://www.spamhaus.org/malware-digest/#threatfox" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.spamhaus.org/malware-digest/#threatfox</a><a href="https://infosec.exchange/tags/Mirai" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mirai</a> <a href="https://infosec.exchange/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a> <a href="https://infosec.exchange/tags/abuseCH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#abuseCH</a>

ANY.RUN👾 <a href="https://infosec.exchange/tags/Ramnit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ramnit</a> is a modular banking <a href="https://infosec.exchange/tags/trojan" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#trojan</a> with botnet capabilitiesIt steals financial data and credentials, recruits infected devices into <a href="https://infosec.exchange/tags/botnets" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#botnets</a>, and is notably persistentLearn more, collect <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a> & samples: <a href="https://any.run/malware-trends/ramnit/?utm_source=mastodon&utm_medium=post&utm_campaign=ramnit&utm_content=mtt&utm_term=180225" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://any.run/malware-trends/ramnit/?utm_source=mastodon&utm_medium=post&utm_campaign=ramnit&utm_content=mtt&utm_term=180225</a><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a>

ANY.RUN🚨 Zhong Stealer is a new <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> targeting <a href="https://infosec.exchange/tags/crypto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#crypto</a> and <a href="https://infosec.exchange/tags/fintech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fintech</a> sectorsIt infects orgs via support ticket systems and exfiltrates stolen data to C2 in Hong KongSee detailed technical analysis and collect <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a> 👇<a href="https://any.run/cybersecurity-blog/zhong-stealer-malware-analysis/?utm_source=mastodon&utm_medium=post&utm_campaign=zhong_malware_analysis&utm_term=180225&utm_content=linktoblog" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://any.run/cybersecurity-blog/zhong-stealer-malware-analysis/?utm_source=mastodon&utm_medium=post&utm_campaign=zhong_malware_analysis&utm_term=180225&utm_content=linktoblog</a><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

ANY.RUN📢 New! Threat Intelligence Reports from ANYRUNDiscover detailed research on active cyber threats and <a href="https://infosec.exchange/tags/APTs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#APTs</a> with actionable insights, <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a>, & <a href="https://infosec.exchange/tags/TTPs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TTPs</a> Enrich proactive security, report on <a href="https://infosec.exchange/tags/APT41" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#APT41</a> inside ⬇️ <a href="https://any.run/cybersecurity-blog/threat-intelligence-reports/?utm_source=mastodon&utm_medium=post&utm_campaign=ti_reports&utm_content=linktoblog&utm_term=130225" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://any.run/cybersecurity-blog/threat-intelligence-reports/?utm_source=mastodon&utm_medium=post&utm_campaign=ti_reports&utm_content=linktoblog&utm_term=130225</a><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a>

Infoblox Threat IntelStay alert! These disinformation campaigns affect all of us, no matter where we are! Traffic Distribution Systems (TDSs) run by malicious adtech companies are seen delivering disinformation in different languages, tailored to the country the victim accesses from. They utilize subdomains to differentiate their content. The landing pages impersonate well-known brands and celebrities, aiming to deceive users. It's crucial to block these TDS domains and prevent any content they deliver. Here are some examples of TDS domains that redirect to these disinformation campaigns:zoograithavaupy[.]net asjynxon[.]com phaunaitsi[.]net And here are some landing page domains associated with this campaign:cooknove[.]com healthbrit[.]com foodleas[.]com daily-web[.]live<a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#scam</a> <a href="https://infosec.exchange/tags/fraud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fraud</a> <a href="https://infosec.exchange/tags/disinformation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#disinformation</a> <a href="https://infosec.exchange/tags/threatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatIntel</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/threatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatIntelligence</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/iocs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iocs</a> <a href="https://infosec.exchange/tags/domains" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#domains</a> <a href="https://infosec.exchange/tags/impersonating" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#impersonating</a> <a href="https://urlscan.io/result/ef3f29ea-67df-4010-8a18-4638d401ab67/#summary" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://urlscan.io/result/ef3f29ea-67df-4010-8a18-4638d401ab67/#summary</a>

ANY.RUN▶️ Play is a <a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ransomware</a> active since 2022. It uses double extortion, exploits RDP servers, and targets companies in the US and EU 🎯 See how it operates and collect <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a> & samples 👉 <a href="https://any.run/malware-trends/play/?utm_source=mastodon&utm_medium=post&utm_campaign=play&utm_term=100225&utm_content=linktomtt" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://any.run/malware-trends/play/?utm_source=mastodon&utm_medium=post&utm_campaign=play&utm_term=100225&utm_content=linktomtt</a><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a>

Sophos X-OpsYou should also pay attention to the Address Bar if you’re prompted to log in to a service you use after opening an email attachment. All of the <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> pages that loaded in our tests displayed the criminals’ website address, which was clearly not a <a href="https://infosec.exchange/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> website. The Russian URLs were pretty obvious, if you looked.We published the list of the <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> domains and other <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a> on our Github page.<a href="https://github.com/sophoslabs/IoCs/blob/master/20250205_SVGspam.csv" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/sophoslabs/IoCs/blob/master/20250205_SVGspam.csv</a>Stay safe, everyone.<a href="https://news.sophos.com/en-us/2025/02/05/svg-phishing/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://news.sophos.com/en-us/2025/02/05/svg-phishing/</a>9/9

ANY.RUN🌑 BlackMoon is a veteran banking <a href="https://infosec.exchange/tags/Trojan" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Trojan</a> that emerged more than a decade ago Today it is still evolving and remains a significant threat to businessesLearn more, get <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a>, and collect samples 👉 <a href="https://any.run/malware-trends/blackmoon/?utm_source=mastodon&utm_medium=post&utm_campaign=blackmoon&utm_content=tracker&utm_term=030225" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://any.run/malware-trends/blackmoon/?utm_source=mastodon&utm_medium=post&utm_campaign=blackmoon&utm_content=tracker&utm_term=030225</a><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

log4jmI've been enjoying infosec.exchange for the last month or so but have been putting off an <a href="https://infosec.exchange/tags/Introduction" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Introduction</a> because I'm awkward and anxious (<a href="https://infosec.exchange/tags/privacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#privacy</a> am I right?). I feel more comfortable talking about my cat than myself or my work on social media, so you'll probably mostly see him amongst my boosts and replies. He's a little hacker who tricks me into FaceID unlocking my iPad for him or hides my pouch of physical security keys to remind me not to be careless with them.See how I just went on about the cat? Yeah... I feel imposter syndrome about belonging in <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a>. I'm an IT <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> and <a href="https://infosec.exchange/tags/operations" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#operations</a> focused <a href="https://infosec.exchange/tags/SysAdmin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SysAdmin</a> (<a href="https://infosec.exchange/tags/BlueTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BlueTeam</a>) whose been fascinated/working with computers since I was 3, and have been doing it professionally for over 10 years now. Does that make me <a href="https://infosec.exchange/tags/SecOps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecOps</a>? I honestly don't know. I love this community though and want to make an effort to share what I do know more often besides the cat pics or conversations or boosting <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a> and news I think to share.If I had to sum up in a few hashtags and such, I know securing <a href="https://infosec.exchange/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> and <a href="https://infosec.exchange/tags/ActiveDirectory" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActiveDirectory</a> best but I use/protect <a href="https://infosec.exchange/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> and <a href="https://infosec.exchange/tags/macOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#macOS</a> if you'll forgive me for using <a href="https://infosec.exchange/tags/PowerShell" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PowerShell</a> there too. I love <a href="https://infosec.exchange/tags/scripting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#scripting</a> and <a href="https://infosec.exchange/tags/automation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#automation</a>, the <a href="https://infosec.exchange/tags/OSINT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OSINT</a> and <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a> and <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a> we share, <a href="https://infosec.exchange/tags/infrastructure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infrastructure</a> and <a href="https://infosec.exchange/tags/firewall" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#firewall</a> stuff, <a href="https://infosec.exchange/tags/logging" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#logging</a> and <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a>, and reading/writing reports just as much as code. I'm not super passionate about the <a href="https://infosec.exchange/tags/cloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cloud</a> but that's not a hill I'd die on and <a href="https://infosec.exchange/tags/Azure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Azure</a> is pretty cool.Did I mention I have one of the best <a href="https://infosec.exchange/tags/CatsOfInfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CatsOfInfoSec</a> ever?Anyway, "it's me, hi!"

Recent searches

Search options

Administered by:

Server stats:

#iocs