Summary

— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

Emotet Botnet Is Back, Servers Active Across the World
- https://www.bleepingcomputer.com/news/security/emotet-botnet-is-back-servers-active-across-the-world
VMware acquires Carbon Black for $2.1B and Pivotal for $2.7 billion
- https://techcrunch.com/2019/08/22/vmware-acquires-carbon-black-for-2-1b-and-pivotal-for-2-7-billion/
ATT&CK Sub-Techniques Preview
- https://medium.com/mitre-attack/attack-sub-techniques-preview-b79ff0ba669a
Intel, IBM, Google, Microsoft & others join new security-focused industry group
- https://www.zdnet.com/article/intel-ibm-google-microsoft-others-join-new-security-focused-industry-group/
Chinese State Media Seeks to Influence International Perceptions of Hong Kong Protests
- https://www.recordedfuture.com/chinese-state-media-influence/
The State of Threat Detection 2019
- https://www.fidelissecurity.com/threatgeek/threat-detection-response/the-state-of-threat-detection-2019/
Purple Teaming ICS Networks: Part 1 of 3
- https://dragos.com/blog/industry-news/purple-teaming-ics-networks-part-1-of-3/
Beyond Compliance:Cyber Threats and Healthcare
- https://content.fireeye.com/cyber-security-for-healthcare/rpt-beyond-compliance-cyber-threats-and-healthcare
Supply Chain Attacks: Controls and Processes
- https://blog.reversinglabs.com/blog/supply-chain-attacks
Week in OSINT #2019–33
- https://medium.com/week-in-osint/week-in-osint-2019-33-754a6faeec93
Cheap Fakes beat Deep Fakes
- https://medium.com/@thegrugq/cheap-fakes-beat-deep-fakes-b1ac91e44837
Protecting Chrome users in Kazakhstan
- https://security.googleblog.com/2019/08/protecting-chrome-users-in-kazakhstan.html
Cobalt Strike’s Process Injection: The Details
- https://blog.cobaltstrike.com/2019/08/21/cobalt-strikes-process-injection-the-details/

Threat Research – Malware, Phishing, and other Campaigns in the Wild

First‑of‑its‑kind spyware sneaks into Google Play
- https://www.welivesecurity.com/2019/08/22/first-spyware-android-ahmyth-google-play/
The Gamaredon Group: A TTP Profile Analysis
- https://www.fortinet.com/blog/threat-research/gamaredon-group-ttp-profile-analysis.html
Agent 1433: remote attack on Microsoft SQL Server
- https://securelist.com/malicious-tasks-in-ms-sql-server/92167/
Magecart criminals caught stealing with their poker face on
- https://blog.malwarebytes.com/threat-analysis/2019/08/magecart-criminals-caught-stealing-poker-face/
Asruex Backdoor Variant Infects Word Documents and PDFs Through Old MS Office and Adobe Vulnerabilities
- https://blog.trendmicro.com/trendlabs-security-intelligence/asruex-backdoor-variant-infects-word-documents-and-pdfs-through-old-ms-office-and-adobe-vulnerabilities/
Agent Tesla: Evading EDR by Removing API Hooks
- https://www.bromium.com/agent-tesla-evading-edr-by-removing-api-hooks/
It’s all fun and games until ransomware deletes the shadow copies
- https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/
Trickbot Analysis – Part 1: Macro Analysis
- https://clickallthethings.wordpress.com/2019/08/21/trickbot-analysis-part-1-macro-analysis/
Attacks by Silence: technical analysis of Silence’s tools, tactics, and evolution
- https://www.group-ib.com/resources/threat-research/silence-attacks.html

Tools and Tips

Triage Collection and Timeline Generation with KAPE
- https://digital-forensics.sans.org/blog/2019/08/22/triage-collection-and-timeline-generation-with-kape
KAPE vs Commando, another Red vs Blue vignette
- https://holisticinfosec.io/post/kape/
Solving RE tasks the crypto way
- https://bitsdeep.com/posts/solving-re-tasks-the-crypto-way/
Updates released for “Tsurugi” Linux, a DFIR Distro
- https://tsurugi-linux.org/index.php
MacOS Incident Response | Part 1: Collecting Device , File & System Data
- https://www.sentinelone.com/blog/macos-incident-response-part-1-collecting-device-file-system-data/
iOS 12 – Delivered Notifications and a new way to parse them
- https://blog.d204n6.com/2019/08/ios-12-delivered-notifications-and-new.html
Using CloudFront to Relay Cobalt Strike Traffic
- https://www.blackhillsinfosec.com/using-cloudfront-to-relay-cobalt-strike-traffic/
HacktheBox – Lame Writeup
- https://www.pathtoroot.net/l/hackthebox-lame-writeup/
Unpacking Remcos Quick Tip Tutorial (Video)
- https://www.youtube.com/watch?v=DIH4SvKuktM&feature=youtu.be

Breaches, Government, and Law Enforcement

BEC Takedown: Massive International Fraud and Money Laundering Conspiracy Detailed in Federal Grand Jury Indictment that Charges 80 Defendants
- https://www.justice.gov/usao-cdca/pr/massive-international-fraud-and-money-laundering-conspiracy-detailed-federal-grand-jury
Hackers seek total of $2.5 million in ransomware attack on Texas government agencies
- https://www.houstonchronicle.com/news/politics/texas/article/Hackers-seek-total-of-2-5-million-in-ransomware-14368812.php
Big data company Palantir renews its controversial contract with ICE that is worth nearly $50 million
- https://www.businessinsider.com/palantir-renews-ice-government-contract-gotham-amid-protests-2019-8
MoviePass left customers’ credit cards exposed online
- https://www.cnet.com/news/moviepass-reportedly-left-customers-credit-cards-exposed-online/
Breach at Hy-Vee Supermarket Chain Tied to Sale of 5M+ Stolen Credit, Debit Cards
- https://krebsonsecurity.com/2019/08/breach-at-hy-vee-supermarket-chain-tied-to-sale-of-5m-stolen-credit-debit-cards/

Vulnerabilities and Exploits

Microsoft launches bug bounty for new Chromium Edge browser, with $30,000 top reward
- https://www.zdnet.com/article/microsoft-launches-bug-bounty-for-new-chromium-edge-browser-with-30000-top-reward/
Researcher Discloses Second Steam Zero-Day After Valve Bug Bounty Ban
- https://threatpost.com/researcher-discloses-second-steam-zero-day-after-valve-bug-bounty-ban/147593/
Key Negotiation Of Bluetooth (KNOB) attack: Major Bluetooth Security Flaw
- https://news.softpedia.com/news/major-bluetooth-security-flaw-discovered-leaves-millions-of-devices-vulnerable-527038.shtml
Facebook expands its Data Abuse Bounty program to Instagram
- https://www.engadget.com/2019/08/19/facebook-data-abuse-bounty-program-instagram-checkout/
DotNet Core: A Vector For AWL Bypass & Defense Evasion
- https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
DejaBlue: Analyzing a RDP Heap Overflow
- https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Weekly News Roundup — August 18 to August 24