Summary

— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not intended to be an exhaustive source, but simply a collection of items I found interesting throughout my weekly research. The summaries are provided with links for the reader to drill down into particular topics according to their own interests. Thank you to all of the contributors for this great content!

Industry News and Reports

FBI’s IC3 Report: Losses from BEC Scams to Reach $1.2 Billion
- https://www.ic3.gov/media/annualreport/2018_IC3Report.pdf
Proofpoint — 2019 State of the Phish Report
- https://www.proofpoint.com/us/resources/threat-reports/state-of-phish?utm_source=twitter&utm_medium=cpc&utm_campaign=2019_sotp_na
Malwarebytes Labs — Cybercrime Tactics and Techniques Q1 2019
- https://blog.malwarebytes.com/cybercrime/2019/04/labs-cybercrime-tactics-and-techniques-report-finds-businesses-hit-with-235-percent-more-threats-in-q1/
The 2019 Trustwave Global Security Report
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/announcing-the-2019-trustwave-global-security-report/
Cisco Talos — Threat Roundup for April 19 to April 26
- https://blog.talosintelligence.com/2019/04/threat-roundup-0419-to-0426.html
The Economy of Credential Stuffing Attacks
- https://www.recordedfuture.com/credential-stuffing-attacks/
Metrics and Maturity: Benchmarking Your Cyber Exposure Over Time
- https://www.tenable.com/blog/metrics-and-maturity-benchmarking-your-cyber-exposure-over-time

Tools, Tips, and Other Resources

Threat Hunting Using Yeti and Elastic Stack
- https://blog.ensilo.com/threat-hunting-tips
Deobfuscating APT32 Flow Graphs with Cutter and Radare2
- https://research.checkpoint.com/deobfuscating-apt32-flow-graphs-with-cutter-and-radare2/
Supercharged certificate monitoring with Faust
- https://www.d3vzer0.com/supercharged-certificate-monitoring-with-faust/amp/?__twitter_impression=true
Microsoft Defender ATP API updates
- https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Announcing-Microsoft-Defender-ATP-API-updates/ba-p/473462
A few Ghidra tips for IDA users, part 2 – strings and parameters
- https://digital-forensics.sans.org/blog/2019/04/22/a-few-ghidra-tips-for-ida-users-part-2-strings-and-parameters
Analyzing Emotet with Ghidra — Part 2
- https://medium.com/@0xd0cf11e/analyzing-emotet-with-ghidra-part-2-9efbea374b14
Termshark: A terminal UI for tshark, inspired by Wireshark
- https://termshark.io/
Windows EVTX Samples: a container for windows events samples associated to specific attack and post-exploitation techniques.
- https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
The most common OAuth 2.0 Hacks
- https://m.habr.com/en/post/449182/
Munin: an online hash checker utility that retrieves valuable information from VirusTotal and other sources
- https://github.com/Neo23x0/munin
A look at Stomped VBA code and the P-Code in a Word Document
- https://pcsxcetrasupport3.wordpress.com/2019/04/25/a-look-at-stomped-vba-code-and-the-p-code-in-a-word-document/amp/?__twitter_impression=true
MalConfScan: a Volatility plugin that extracts configuration data of known malware.
- https://github.com/JPCERTCC/MalConfScan
Getting in the Zone: dumping Active Directory DNS using adidnsdump
- https://dirkjanm.io/getting-in-the-zone-dumping-active-directory-dns-with-adidnsdump/
SharpAdidnsdump: a c# implementation of Dirk-jan Mollema’s adidnsdump research
- https://github.com/b4rtik/SharpAdidnsdump
How You Can Set up Honeytokens Using Canarytokens to Detect Intrusions
- https://zeltser.com/honeytokens-canarytokens-setup/
How to Speed Up Incident Response: Collect Artifacts Faster
- https://www.cybertriage.com/2019/how-to-speed-up-incident-response-collect-artifacts-faster/
VMware Security Hardening Guides
- https://www.vmware.com/security/hardening-guides.html
Windows Process Injection: WordWarping, Hyphentension, AutoCourgette, Streamception, Oleum, ListPlanting, Treepoline
- https://modexp.wordpress.com/2019/04/25/seven-window-injection-methods/amp/?__twitter_impression=true
Active Directory Attacks
- https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md
Autopsy v4.11.0 is officially released for SleuthKit
- https://github.com/sleuthkit/autopsy/releases/tag/autopsy-4.11.0

Threat Research – Malware, Phishing, and other Campaigns in the Wild

FINTEAM: Trojanized TeamViewer Against Government Targets
- https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Analyzing C/C++ Runtime Library Code Tampering in Software Supply Chain Attacks
- https://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-c-c-runtime-library-code-tampering-in-software-supply-chain-attacks/

CARBANAK Week: FireEye week-long analysis series on Carbanak Malware
- https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-one-a-rare-occurrence.html
- https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-two-continuing-source-code-analysis.html
- https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-three-behind-the-backdoor.html
- https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-four-desktop-video-player.html
Analysis: Abuse of Custom Actions in Windows Installer MSI to Run Malicious JavaScript, VBScript, and PowerShell Scripts
- https://blog.trendmicro.com/trendlabs-security-intelligence/analysis-abuse-of-custom-actions-in-windows-installer-msi-to-run-malicious-javascript-vbscript-and-powershell-scripts/
Malicious VBA Office Document Without Source Code
- https://isc.sans.edu/forums/diary/Malicious+VBA+Office+Document+Without+Source+Code/24870/
Rules to Protect Against Azure Blog Phishing in Outlook 365
- https://malware-research.org/simple-rule-to-protect-against-spoofed-windows-net-phishing-attacks/
DNSpionage brings out the Karkoff
- https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html
A Malicious Sight in Google Sites
- https://www.netskope.com/blog/malicious-google-sites
APT34: webmask project
- https://marcoramilli.com/2019/04/23/apt34-webmask-project/
NovaLoader, yet another Brazilian banking malware family
- https://www.zscaler.com/blogs/research
Back (Again): Uncovering the Latest Qbot Banking Trojan
- https://jask.com/back-again-uncovering-the-latest-qbot-banking-trojan/
Threat actors abuse GitHub service to host a variety of phishing kits
- https://www.proofpoint.com/us/threat-insight/post/threat-actors-abuse-github-service-host-variety-phishing-kits
Brand Impersonation Attacks on Law Firms Harm Clients and Cost Millions
- https://www.agari.com/email-security-blog/brand-impersonation-attacks-law-firms-cost-millions/
RadRAT: An all-in-one toolkit for complex espionage ops
- https://labs.bitdefender.com/2018/04/radrat-an-all-in-one-toolkit-for-complex-espionage-ops/
Emotet Adds New Evasion Technique and Uses Connected Devices as Proxy C&C Servers
- https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-adds-new-evasion-technique-and-uses-connected-devices-as-proxy-cc-servers/
JasperLoader Emerges, Targets Italy with Gootkit Banking Trojan
- https://blog.talosintelligence.com/2019/04/jasperloader-targets-italy.html
Beapy: Cryptojacking Worm Hits Enterprises in China
- https://www.symantec.com/blogs/threat-intelligence/beapy-cryptojacking-worm-china
Beapy Cryptominer Targets Corporate Networks
- https://www.bluvector.io/threat-report-beapy-cryptominer/
Takedowns and Adventures in Deceptive Affiliate Marketing
- https://unit42.paloaltonetworks.com/takedowns-and-adventures-in-deceptive-affiliate-marketing/
Five High-Profile Watering Hole Attacks Highlight Importance of Network Security
- https://www.lastline.com/blog/five-high-profile-watering-hole-attacks-highlight-importance-of-network-security/
Threat Actor TA505 Targets Financial Enterprises Using LOLBINS and a New Backdoor
- https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware
BabyShark Malware Part Two – Attacks Continue Using KimJongRAT and PCRat
- https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Bitcoin: The Next Evolution in BEC Cash Out Methods?
- https://www.agari.com/email-security-blog/bitcoin-bec-cash-out-method/
Dissecting Emotet’s network communication protocol
- https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol

Breaches, Government, and Law Enforcement

Operation ShadowHammer: a high-profile supply chain attack
- https://securelist.com/operation-shadowhammer-a-high-profile-supply-chain-attack/90380/
Doctors’ Management Service hit with GandCrab ransomware attack compromising patient data
- https://cyware.com/news/doctors-management-service-hit-with-gandcrab-ransomware-attack-compromising-patient-data-b6eebd02
Ransomware attack hits Cleveland Airport crippling email services and information screens
- https://cyware.com/news/ransomware-attack-hits-cleveland-airport-crippling-email-services-and-information-screens-3666699e
U.S. charges American engineer, Chinese businessman with stealing GE’s trade secrets
- https://www.washingtonpost.com/world/national-security/us-charges-american-engineer-chinese-businessman-with-stealing-ges-trade-secrets/2019/04/23/cb32c78a-65f5-11e9-82ba-fcfeff232e8f_story.html?noredirect=on&utm_term=.426461e2c94d
Former State Department Employee Pleads Guilty to Conspiring with Foreign Agents
- https://www.justice.gov/opa/pr/former-state-department-employee-pleads-guilty-conspiring-foreign-agents
Docker Hub hack exposed data of 190,000 users
- https://www.zdnet.com/google-amp/article/docker-hub-hack-exposed-data-of-190000-users/?__twitter_impression=true

Vulnerabilities and Exploits

Detailed Analysis of macOS Vulnerability CVE-2019-8507
- https://www.fortinet.com/blog/threat-research/detailed-analysis-mac-os-vulnerability-cve-2019-8507.html
Uncovering CVE-2019-0232: A Remote Code Execution Vulnerability in Apache Tomcat
- https://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-cve-2019-0232-a-remote-code-execution-vulnerability-in-apache-tomcat/
Vulnerability Spotlight: Symantec Endpoint Protection kernel memory information disclosure vulnerability
- https://blog.talosintelligence.com/2019/04/vulnerability-spotlight-symantec.html
Unpatched Vulnerability Alert – WebLogic Zero Day
- https://isc.sans.edu/forums/diary/Unpatched+Vulnerability+Alert+WebLogic+Zero+Day/24880/
Oracle WebLogic Affected by Unauthenticated Remote Code Execution Vulnerability (CVE-2019-2725)
- https://www.tenable.com/blog/oracle-weblogic-affected-by-unauthenticated-remote-code-execution-vulnerability-cve-2019-2725
AESDDoS Botnet Malware Exploits CVE-2019-3396 to Perform Remote Code Execution, DDoS Attacks, and Cryptocurrency Mining
- https://blog.trendmicro.com/trendlabs-security-intelligence/aesddos-botnet-malware-exploits-cve-2019-3396-to-perform-remote-code-execution-ddos-attacks-and-cryptocurrency-mining/
Threats and Vulnerabilities: What’s Old is New Again
- https://www.fidelissecurity.com/threatgeek/threats-and-vulnerabilities
Vulnerable Confluence Servers Get Infected with Ransomware, Trojans
- https://www.bleepingcomputer.com/news/security/vulnerable-confluence-servers-get-infected-with-ransomware-trojans/
Pillaging Passwords from Service Accounts
- https://isc.sans.edu/forums/diary/Pillaging+Passwords+from+Service+Accounts/24886/
SMBdoor: a new backdoor proof of concept (POC) inspired by the NSA’s leaked DoublePulsar
- https://www.zdnet.com/article/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware/
RAR Files and ACE Exploit CVE-2018-20250
- https://isc.sans.edu/forums/diary/rar+Files+and+ACE+Exploit+CVE201820250/24864/
Flashpoint Remediation of 0-Day Exploit on their Public-Facing Website
- https://www.flashpoint-intel.com/blog/after-action-report-flashpoint-remediation-of-0-day-exploit-on-our-public-facing-website/

Weekly News Roundup — April 21 to 27