Hello and welcome to Sec Soup, where the weekly newsletter has a collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

Resource Guide for Cybersecurity During the COVID-19 Pandemic
- https://www.cisecurity.org/blog/resource-guide-for-cybersecurity-during-the-covid-19-pandemic/
COVID-19 Key Developments: April 14-17
- https://www.flashpoint-intel.com/blog/covid-19-key-developments-april-14-17/
A look at the ATM/PoS malware landscape from 2017-2019
- https://securelist.com/atm-pos-malware-landscape-2017-2019/96750/
Findings on COVID-19 and online security threats
- https://blog.google/technology/safety-security/threat-analysis-group/findings-covid-19-and-online-security-threats/
Zoom Hits Milestone on 90-Day Security Plan, Releases Zoom 5.0
- https://blog.zoom.us/wordpress/2020/04/22/zoom-hits-milestone-on-90-day-security-plan-releases-zoom-5-0/
Weekly Threat Intelligence Bulletin: COVID-19
- https://www.secureworks.com/blog/weekly-threat-intelligence-bulletin-covid-19
Understanding the relationship between Emotet, Ryuk and TrickBot
- https://blog.intel471.com/2020/04/14/understanding-the-relationship-between-emotet-ryuk-and-trickbot
Joint NSA and ASD Report: Detect and Prevent Web Shell Malware
- https://media.defense.gov/2020/Apr/22/2002285959/-1/-1/0/DETECT%20AND%20PREVENT%20WEB%20SHELL%20MALWARE.PDF

Threat Research

Malspam in the Time of COVID-19
- https://www.crowdstrike.com/blog/covid19-and-malspam/
Nazar: A Lost Amulet
- https://www.epicturla.com/blog/the-lost-nazar
Obfuscated WordPress Malware Dropper
- https://blog.sucuri.net/2020/04/obfuscated-wordpress-malware-dropper.html
New Distribution Mechanism for the NanoCore RAT
- https://www.zscaler.com/blogs/research/new-distribution-mechanism-nanocore-rat
New Android Banking Trojan Targets Spanish, Portuguese Speaking Users
- https://securityintelligence.com/posts/new-android-banking-trojan-targets-spanish-portuguese-speaking-users/
Following ESET’s discovery, a Monero mining botnet is disrupted
- https://www.welivesecurity.com/2020/04/23/eset-discovery-monero-mining-botnet-disrupted/
Deconstructing an Evasive Formbook Campaign Leveraging COVID-19 Themes
- https://www.fortinet.com/blog/threat-research/deconstructing-an-evasive-formbook-campaign-leveraging-covid-19-themes.html
Threat Spotlight: MedusaLocker
- https://blog.talosintelligence.com/2020/04/medusalocker.html
Malicious Excel With a Strong Obfuscation and Sandbox Evasion
- https://isc.sans.edu/forums/diary/Malicious+Excel+With+a+Strong+Obfuscation+and+Sandbox+Evasion/26048/
Remote Video Conferencing Themes in Credential Theft and Malware Threats
- https://www.proofpoint.com/us/threat-insight/post/remote-video-conferencing-themes-credential-theft-and-malware-threats
Malicious APKs share code during Covid-19 pandemic
- https://intezer.com/android/malicious-apks-share-code-during-covid-19-pandemic/
Vietnamese Threat Actors APT32 Targeting Wuhan Government and Chinese Ministry of Emergency Management in Latest Example of COVID-19 Related Espionage
- https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html
WINNTI GROUP: Insights From the Past
- https://quointelligence.eu/2020/04/winnti-group-insights-from-the-past/
Excel Malspam: Password Protected … Not!
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/excel-malspam-password-protected-not/
Gorgon uses COVID-19 outbreak to launch cyber attacks on Canada and other regions
- https://blog.360totalsecurity.com/en/gorgon-uses-covid-19-outbreak-to-launch-cyber-attacks-on-canada-and-other-regions/
IcedID Botnet | The Iceman Goes Phishing for US Tax Returns
- https://labs.sentinelone.com/icedid-botnet-the-iceman-goes-phishing-for-us-tax-returns/
BazarBackdoor: TrickBot gang’s new stealthy network-hacking malware
- https://www.bleepingcomputer.com/news/security/bazarbackdoor-trickbot-gang-s-new-stealthy-network-hacking-malware/
VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus
- https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/
Ursnif via LOLbins
- https://thedfirreport.com/2020/04/24/ursnif-via-lolbins/

Tools and Tips

5 Tips for Effective Threat Hunting
- https://www.fidelissecurity.com/threatgeek/threat-hunting/5-tips-effective-threat-hunting/
What does it take to become a good reverse engineer?
- https://securelist.com/become-a-good-reverse-engineer/96743/
OptOut – Compiler Undefined Behavior Optimizations
- https://research.checkpoint.com/2020/optout-compiler-undefined-behavior-optimizations/
SpectX: Log Parser for DFIR
- https://isc.sans.edu/forums/diary/SpectX+Log+Parser+for+DFIR/26040/
Comparing open source adversary emulation platforms for red teams
- https://redcanary.com/blog/comparing-red-team-platforms/
10 tips for protecting computer security and privacy at home
- https://expel.io/blog/10-tips-protecting-computer-security-privacy-at-home/
Video conferencing: new guidance for individuals and for organisations
- https://www.ncsc.gov.uk/blog-post/video-conferencing-new-guidance-for-individuals-and-for-organisations
LogonTracer v1.4 Released
- https://blogs.jpcert.or.jp/en/2020/04/logontracer-1-4.html
BlackBag Announces Release of BlackLight 2020 R1
- https://www.forensicfocus.com/News/article/sid=3906/
Ghost In The Logs – allows you to evade sysmon and windows event logging
- https://github.com/bats3c/ghost-in-the-logs/
XLMMacroDeobfuscator – Extracts and Deobfuscates XLM macros (a.k.a Excel 4.0 Macros)
- https://github.com/DissectMalware/XLMMacroDeobfuscator
ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra disassemblers.
- https://github.com/bootleg/ret-sync
Forensic Walkthrough: QBot Infection
- https://cyberforensicator.com/2020/04/12/forensic-walkthrough-qbot-infection/
Ebfuscation: Abusing system errors for binary obfuscation
- https://www.d00rt.eus/2020/04/ebfuscation-abusing-system-errors-for.html
Zloader-extractor: A script to extract network IOCs from Zloader xls droppers
- https://github.com/Heat-Miser/zloader-extractor
Unhide.py – A script of unhiding hidden Excel sheets
- https://gist.github.com/bontchev/8dc7f37207ba76ed71a9576ad65e0dcd
Career Hacking: Tips and Tricks to Making the Most of your Career
- https://medium.com/@andy.c.piazza/career-hacking-tips-and-tricks-to-making-the-most-of-your-career-6c5bcc0eda31
The Simple Path Towards Cybersecurity Expertise
- https://medium.com/netdef/the-simple-path-towards-cybersecurity-expertise-82dafabd53c5
How to Set Up a SpiderFoot Server for OSINT Research
- https://zeltser.com/spiderfoot-server-setup/
Analysis of Apple Unified Logs: Quarantine Edition [Entry 1] – Converting Log Archive Files on 10.15 (Catalina)
- https://www.mac4n6.com/blog/2020/4/20/analysis-of-apple-unified-log-quarantine-edition-entry-1-converting-log-archive-files-on-1015-catalina
Lynis – Auditing System Hardening and Compliance Testing
- https://sectechno.com/lynis-auditing-system-hardening-and-compliance-testing/
Windows DLL Hijacking (Hopefully) Clarified
- https://itm4n.github.io/windows-dll-hijacking-clarified/

Breaches, Government, and Law Enforcement

Report on unauthorized login to “Nintendo Network ID” and request for safe use of “Nintendo Account”
- https://translate.google.com/translate?sl=auto&tl=en&u=https%3A%2F%2Fwww.nintendo.co.jp%2Fsupport%2Finformation%2F2020%2F0424.html
Fight Back: How to Stop Cyber Criminals During the Pandemic
- https://www.aspeninstitute.org/events/fight-back-how-to-stop-cyber-criminals-during-the-pandemic/
Exposed Redis Instances Abused for Remote Code Execution, Cryptocurrency Mining
- https://blog.trendmicro.com/trendlabs-security-intelligence/exposed-redis-instances-abused-for-remote-code-execution-cryptocurrency-mining/
Unproven Coronavirus Therapy Proves Cash Cow for Shadow Pharmacies
- https://krebsonsecurity.com/2020/04/unproven-coronavirus-therapy-proves-cash-cow-for-shadow-pharmacies/
US-CERT Alert (AA20-107A): Continued Threat Actor Exploitation Post Pulse Secure VPN Patching
- https://www.us-cert.gov/ncas/alerts/aa20-107a
Department of Justice Announces Disruption of Hundreds of Online COVID-19 Related Scams
- https://www.justice.gov/opa/pr/department-justice-announces-disruption-hundreds-online-covid-19-related-scams

Vulnerabilities and Exploits

Multiple Vulnerabilities in Autodesk FBX-SDK library Could Allow for Arbitrary Code Execution
- https://www.cisecurity.org/advisory/draft-ms-isac-cybersecurity-advisory-multiple-vulnerabilities-in-autodesk-fbx-sdk-library-could-allow-for-arbitrary-code-execution-patch-now-tlp-white_2020-053/
You’ve Got (0-click) Mail!
- https://blog.zecops.com/vulnerabilities/youve-got-0-click-mail/
Multiple Vulnerabilities in IBM Data Risk Manager
- https://github.com/pedrib/PoC/blob/master/advisories/IBM/ibm_drm/ibm_drm_rce.md
Vulnerability Spotlight: Zoom Communications user enumeration
- https://blog.talosintelligence.com/2020/04/zoom-user-enumeration.html
US-CERT Bulletin (SB20-111): Vulnerability Summary for the Week of April 13, 2020
- https://www.us-cert.gov/ncas/bulletins/sb20-111
CVE-2020-0022 an Android 8.0-9.0 Bluetooth Zero-Click RCE – BlueFrag
- https://insinuator.net/2020/04/cve-2020-0022-an-android-8-0-9-0-bluetooth-zero-click-rce-bluefrag/

Weekly News Roundup — April 19 to April 25

Industry Reports, News, and Miscellany

Threat Research

Tools and Tips

Breaches, Government, and Law Enforcement

Vulnerabilities and Exploits

Leave a Reply Cancel reply