Summary

— Welcome to Security Soup’s continuing coverage of infosec highlights from the previous week. The highlights include a collection of links relating to news, tools, threat research, and more! The focus trends toward DFIR and threat intelligence, but other hacking-related topics are included as well. This list is not intended to be an exhaustive source, but simply a collection of items I found interesting throughout my weekly research. The summaries are provided with links for the reader to drill down into particular topics according to their own interests. Thank you to all of the contributors for this great content!

Industry News and Reports

Year-End Review: Business Email Compromise in 2018
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/year-end-review-business-email-compromise-in-2018?_ga=2.97668127.1481016316.1555526643-53314921.1502130533
Talos Threat Source (April 18): Newsletter
- https://blog.talosintelligence.com/2019/04/threat-source-april-18-new-attacks.html
2019 Phishing Trends & Intelligence Report: The Growing Social Engineering Threat
- https://info.phishlabs.com/blog/2019-phishing-trends-intelligence-report-the-evolving-threat
APT34 (aka Oil Rig) — Tool Leak, context, and analysis

Breaches, Government, and Law Enforcement

Microsoft reveals breach affecting webmail users
- https://www.welivesecurity.com/2019/04/15/microsoft-breach-outlook-webmail-users/
Coverages of WiPro Breaches:
Asynchronous Warfare, Part 2: Strategy and Phases
- https://www.lastline.com/blog/asynchronous-warfare-part-2-strategy-and-phases/
Marcus Hutchins pleads guilty to malware charges
- https://arstechnica.com/information-technology/2019/04/marcus-hutchins-slayer-of-wannacry-worm-pleads-guilty-to-malware-charges/
- https://www.malwaretech.com/public-statement

Tools and Tips

A few Ghidra tips for IDA users, part 2 – strings and parameters
- https://isc.sans.edu/forums/diary/A+few+Ghidra+tips+for+IDA+users+part+2+strings+and+parameters/24848/
Merlin v0.7.0 — an updated version of the HTTP/2 post-exploitation framework
- https://posts.specterops.io/merlin-v0-7-0-release-roll-up-717739cde77a
How To: get started with Cobalt Strike
- https://www.pentestpartners.com/security-blog/cobalt-strike-walkthrough-for-red-teamers/
Reverse Engineering Reference Manual (beta)
- https://github.com/yellowbyte/reverse-engineering-reference-manual
ripgrep (rg) — a line-oriented search tool that recursively searches your current directory for a regex pattern.
- https://github.com/BurntSushi/ripgrep
Revisiting TTPs: TimeStomper
- https://posts.specterops.io/revisiting-ttps-timestomper-622d4c28a655
Four tools to consider if you’re adopting ATT&CK
- https://redcanary.com/blog/four-tools-to-consider-if-youre-adopting-attck/?utm_content=89707270&utm_medium=social&utm_source=twitter&hss_channel=tw-2349092263
BlueCommand: a dashboard and tooling front-end for PowerShell Empire
- https://github.com/leeberg/BlueCommand
Basic OPSEC Tips & Tricks for OSINT researchers
- https://osintcurio.us/2019/04/18/basic-opsec-tips-and-tricks-for-osint-researchers/amp/?__twitter_impression=true
Ursnif beacon decryptor
- https://github.com/mlodic/ursnif_beacon_decryptor
Boss of the SOC 2.0 Dataset, Questions and Answers Open-Sourced and Ready for Download
- https://www.splunk.com/blog/2019/04/18/boss-of-the-soc-2-0-dataset-questions-and-answers-open-sourced-and-ready-for-download.html
Analyzing Emotet with Ghidra — Part 1
- https://medium.com/@0xd0cf11e/analyzing-emotet-with-ghidra-part-1-4da71a5c8d69
Revisiting Known Perps: Behavioral Profiling for Continuous Monitoring of Threat Actors (Video)
- https://www.youtube.com/watch?v=t5xd5drCPT0

Threat Research – Malware, Phishing, and other campaigns in the wild.

Potential Targeted Attack Uses AutoHotkey and Malicious Script Embedded in Excel File to Avoid Detection
- https://blog.trendmicro.com/trendlabs-security-intelligence/potential-targeted-attack-uses-autohotkey-and-malicious-script-embedded-in-excel-file-to-avoid-detection/
DNS Hijacking Abuses Trust In Core Internet Service
- https://blog.talosintelligence.com/2019/04/seaturtle.html
Spear Phishing Campaign Targets Ukraine Government and Military; Infrastructure Reveals Potential Link to So-Called Luhansk People’s Republic
- https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html
Silence Group Playbook
- https://www.fortinet.com/blog/threat-research/silence-group-playbook.html
From .tk Redirects to PushKa Browser Notification Scam
- https://blog.sucuri.net/2019/04/from-tk-redirects-to-pushka-browser-notification-scam.html
Emotet Makes Good Websites Go Bad – Uniden Edition
- https://www.bluvector.io/threat-report-emotet-uniden/
Inside Scranos – A Cross Platform, Rootkit-Enabled Spyware Operatio
- https://labs.bitdefender.com/2019/04/inside-scranos-a-cross-platform-rootkit-enabled-spyware-operation/
Account With Admin Privileges Abused to Install BitPaymer Ransomware via PsExec
- https://blog.trendmicro.com/trendlabs-security-intelligence/account-with-admin-privileges-abused-to-install-bitpaymer-ransomware-via-psexec/
Top Stories: Malware in Moscow and Tal Mahal Spyware
- https://www.deepinstinct.com/2019/04/15/top-stories-malware-in-moscow-and-taj-mahal-spyware/
New HawkEye Reborn Variant Emerges Following Ownership Change
- https://blog.talosintelligence.com/2019/04/hawkeye-reborn.html
FLASHMINGO: The FireEye Open Source Automatic Analysis Tool for Flash
- https://www.fireeye.com/blog/threat-research/2019/04/flashmingo-open-source-automatic-analysis-tool-for-flash.html
Silence Group Playbook
- https://www.fortinet.com/blog/threat-research/silence-group-playbook.html
Flash Update: Emotet Gang Distributes First Japanese Campaign
- https://cofense.com/flash-update-emotet-gang-distributes-first-japanese-campaign/
The Rising Threat of Business Email Compromise (BEC) and How to Stay Safe
- https://heimdalsecurity.com/blog/the-rising-threat-of-business-email-compromise-bec/
Malware Sample Delivered Through UDF Image
- https://isc.sans.edu/forums/diary/Malware+Sample+Delivered+Through+UDF+Image/24854/
New HawkEye Reborn Variant Emerges Following Ownership Change
- https://blog.talosintelligence.com/2019/04/hawkeye-reborn.html
PreAMo – A Clicker Campaign found on Google Play
- https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Funky malware format found in Ocean Lotus sample
- https://blog.malwarebytes.com/threat-analysis/2019/04/funky-malware-format-found-in-ocean-lotus-sample/
Predator the Thief: New Routes of Delivery
- https://www.fortinet.com/blog/threat-research.html

Vulnerabilities and Exploits

New zero-day vulnerability CVE-2019-0859 in win32k.sys
- https://securelist.com/new-win32k-zero-day-cve-2019-0859/90435/
VPN applications insecurely store session cookies
- https://www.kb.cert.org/vuls/id/192371/
“Zero-day”(XXE) Injection Vulnerability in Internet Explorer

Weekly News Roundup — April 14 to 20