APT & Threat Intel Hunter. Cyber Kill Chain practitioner. Find Evil! Solve Crime!
Melbourne, Victoria
Joined April 2016
- Tweets132
- Following57
- Followers819
- Likes45
The team @Crowdstrike Intelligence are attributing #whispergate wiper activityto Ember Bear (aka UAC-0056, Lorec53, Lorec Bear, Bleeding Bear, Saint Bear). The group does not present known links with previously tracked adversaries #APT
Blog
crowdstrike.com/blog/who-is-…
In light of recent events between the US & Iran the concern for #cyberwarfare retaliation is high.
@RecordedFuture posted a great overview of the current state, players in this space, their tools and suggested mitigations for your vigilance. #APT
recordedfuture.com/iranian-c…
#OperationWocao @foxit report and #APT20 (aka #Twivy #ViolinPanda) assessment align with @FireEye 2018 #MTrends which cited a return of the group and their signature malware #CETTRA (tunneler) & #COOKIECLOG
Report:
resources.fox-it.com/rs/170-…
M-Trends 2018:
investors.fireeye.com/static…
The @ESET team uncover previously unknown #backdoor #Okrum (which attempts to evade detection using #steganography) used by suspected #Ke3chang #APT to target diplomatic missions in Slovakia, Belgium, Chile, Guatemala, and Brazil
welivesecurity.com/wp-conten…
Recent research from @RecordedFuture shows #APT group #APT33 (#Elfin) continues to conduct and prepare for widespread #cyberespionage activity, with over 1,200 domains used since March 2019
Blog: recordedfuture.com/iranian-c…
I suspect more Elfin is coming ... and right on time!
ALT Ready to catch some bad guys @Symantec ?
4
With #FIN7 news last month and #FIN8 news this month, there's a bit of discussion around who's really responsible
zdnet.com/article/fin8-hacke…
The groups have some similar TTPs, even IOC overlap, however, there are still some differences in their tradecraft #APT
With #MuddyWater (aka #Seedworm) #APT group activity popping up over the last week, @TrendMicroRSRCH release blog and whitepaper highlighting several campaigns from first half of 2019
Blog: blog.trendmicro.com/trendlab…
WP: documents.trendmicro.com/ass…
3
Attribution lesson regarding #Ryuk #ransomware from 'North Korea' to 'Eastern Europe' shows that basing it on code similarities alone isn't high fidelity.
A caution when it comes to #attribution - whatever you decide, you will always be right ... until you find out you're not.
The #Sofacy (#FancyBear #APT28 #Sednit) #APT group continue to evolve their custom malware to evade detection by employing multiple languages. Updated #Zebrocy code written in Go programming included in recent "Dear Joohn" campaign.
threatpost.com/russia-linked…
1
The financially motivated #APT group within the North Korean regime has finally been given it's own official identity after being active for around 4 years: #APT38
@FireEye Blog:
fireeye.com/blog/threat-rese…
금융보안원은 2015년부터 2018년 상반기까지 알려진 악성 한글문서들에 대한 분석을 진행하여 특징점을 분류하고, 이에 따른 연관성 분석 결과와 변화 추이를 살펴보았다.
#도깨비 #Dokkaebi #블루노로프 #Bluenoroff #김수키 #Kimsuky #스카크러프트 #Scarcruft #APT
fsec.or.kr/common/proc/fsec/…
Artificial Intelligence-based Targeted Attack Analytics uncovers #Thrip #APT espionage group hitting Satellite, Telecoms, and Defence Companies.
@Symantec blog: symantec.com/blogs/threat-in…
3
#LuckyMouse #APT group (#EmissaryPanda #BronzeUnion #APT27) go after cheese in a Central Asian National Data Center in ongoing campaign of waterholing government websites.
@Securelist securelist.com/luckymouse-hi…
Recent #APT10 (#HogFish #StonePanda #MenuPass) (of #RedLeaves fame) group's latest campaign dubbed "New Battle" reviewed by the @iDefense team includes taunting messages for analysts #APT
accenture.com/t20180423T0550…
Suspected Chinese espionage #APT group #TEMP.Periscope (aka #Leviathan) targeting engineering and maritime entities with a focus on South China Sea issues.
@FireEye Blog: fireeye.com/blog/threat-rese…
1
6
#APT15 (#SocialNetworkTeam) deploys an updated arsenal to target UK government departments and military technology #APT
@NCCGroupInfosec report
nccgroup.trust/uk/about-us/n…
The #Sofacy #APT group (aka #APT28 #FancyBear #Strontium) was #Kaspersky GReAT's most reported APT activity for 2017
@Securelist securelist.com/a-slice-of-20…
2
Newest report from @FireEye uncovers their latest #APT group #APT37 (formerly TEMP.Reaper) (aka #LabyrinthChollima)
Blog fireeye.com/blog/threat-rese…
Report www2.fireeye.com/rs/848-DID-…
#Lazarus #APT (#SilentChollima #Unit121) resurfaces (not that they ever disappear) targeting Global Banks and Bitcoin users with "HaoBao" campaign
@McAfee Labs securingtomorrow.mcafee.com/…
Possible return of #IronTiger #APT group (aka #EmissaryPanda #APT27) with #OperationPZChao
@BitdefenderLabs go inside the espionage infrastructure
labs.bitdefender.com/2018/02…
