Hello and welcome to Sec Soup, where the weekly newsletter has a collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

• The Beirut Port Explosion: Analysis of Potential Causes
  • https://www.flashpoint-intel.com/blog/the-beirut-port-explosion-analysis-of-potential-causes/
• Global Threat Landscape Report – Fortinet
  • https://www.fortinet.com/blog/threat-research/fortiguard-labs-global-threat-landscape-report-2020-key-insights
• DDoS attacks in Q2 2020
  • https://securelist.com/ddos-attacks-in-q2-2020/98077/
• Attribution: A Puzzle
  • https://blog.talosintelligence.com/2020/08/attribution-puzzle.html
• Response When Minutes Matter: RDP — Remote Desktop Pwnage, Part 1
  • https://www.crowdstrike.com/blog/how-falcon-complete-team-stopped-an-rdp-attack-part-1/
• Response When Minutes Matter: RDP — Remote Desktop Pwnage, Part 2
  • https://www.crowdstrike.com/blog/how-falcon-complete-team-stopped-an-rdp-attack-part-2/
• SANS Data Incident 2020 – Indicators of Compromise
  • https://www.sans.org/blog/sans-data-incident-2020-indicators-of-compromise/
• NSA and FBI Expose Russian Previously Undisclosed Malware Drovorub in Cybersecurity Advisory
  • https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/
• Code-Signing: How Malware Gets a Free Pass
  • https://www.gdatasoftware.com/blog/how-malware-gets-a-free-pass
• ScamNation: Monetizing the Pandemic Through Partisan Content Farms and Subscription Traps (email Registration Required)
  • https://www.riskiq.com/resources/research/scamnation/

Threat Research 

• Smoker Backdoor: Evasion Techniques in Webshell Backdoors
  • https://blog.sucuri.net/2020/08/smoker-backdoor-evasion-techniques-in-webshell-backdoors.html
• PurpleWave—A New Infostealer from Russia
  • https://www.zscaler.com/blogs/research/purplewave-new-infostealer-russia
• Mekotio: These aren’t the security updates you’re looking for…
  • https://www.welivesecurity.com/2020/08/13/mekotio-these-arent-the-security-updates-youre-looking-for/
• Internet Explorer and Windows zero-day exploits used in Operation PowerFall
  • https://securelist.com/ie-and-windows-zero-day-operation-powerfall/97976/
• CactusPete APT group’s updated Bisonal backdoor
  • https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/
• XCSSET Mac Malware: Infects Xcode Projects, Performs UXSS Attack on Safari, Other Browsers, Leverages Zero-day Exploits
  • https://blog.trendmicro.com/trendlabs-security-intelligence/xcsset-mac-malware-infects-xcode-projects-performs-uxss-attack-on-safari-other-browsers-leverages-zero-day-exploits/
• EmoCrash: Exploiting A Vulnerability In Emotet Malware For Defense
  • https://www.binarydefense.com/emocrash-exploiting-a-vulnerability-in-emotet-malware-for-defense/
• Office Drama on macOS: infecting macOS via macro-laden documents and 0days
  • https://objective-see.com/blog/blog_0x4B.html
• Case Study: Catching a Human-Operated Maze Ransomware Attack In Action
  • https://labs.sentinelone.com/case-study-catching-a-human-operated-maze-ransomware-attack-in-action/
• Script-Based Malware: A New Attacker Trend on Internet Explorer
  • https://unit42.paloaltonetworks.com/script-based-malware/
• Ursa Loader and the many rabbit holes
  • https://pcsxcetrasupport3.wordpress.com/2020/08/10/ursa-loader-and-the-many-rabbit-holes
• How Malicious Tor Relays are Exploiting Users in 2020 (Part I)
  • https://medium.com/@nusenu/how-malicious-tor-relays-are-exploiting-users-in-2020-part-i-1097575c0cac

Tools and Tips

• A Change of Mythic Proportions
  • https://posts.specterops.io/a-change-of-mythic-proportions-21debeb03617
• Defending MacOS Against Sophisticated Attacks (podcast)
  • https://www.recordedfuture.com/podcast-episode-170/
• Barbervisor: Journey developing a snapshot fuzzer with Intel VT-x
  • https://blog.talosintelligence.com/2020/08/barbervisor.html
• Forensic Disk Copies in Azure
  • https://osdfir.blogspot.com/2020/08/forensic-disk-copies-in-azure.html
• Ciphey: Fully automated decryption tool using natural language processing & artificial intelligence, along with some common sense.
  • https://github.com/Ciphey/Ciphey
• Guided Hunting Notebook: Base64-Encoded Linux Commands
  • https://techcommunity.microsoft.com/t5/azure-sentinel/guided-hunting-notebook-base64-encoded-linux-commands/ba-p/1579484
• Toolmarks and Intrusion Intelligence
  • http://windowsir.blogspot.com/2020/08/toolmarks-and-intrusion-intelligence.html
• 0xf0x – #6 Common Malware Persistence Techniques (video)
  • https://www.youtube.com/watch?v=0DJ7Zz7B1QU&feature=youtu.be
• Whoxyrm – A reverse whois tool based on Whoxy API
  • https://github.com/MilindPurswani/whoxyrm

Breaches, Government, and Law Enforcement 

• The skinny on the Instacart breach
  • https://blog.malwarebytes.com/hacking-2/2020/08/all-about-t-instacart-breach/
• Medical Debt Collection Firm R1 RCM Hit in Ransomware Attack
  • https://krebsonsecurity.com/2020/08/medical-debt-collection-firm-r1-rcm-hit-in-ransomware-attack/
• Justice Department Acts To Shut Down Fraudulent Websites Exploiting The Covid-19 Pandemic
  • https://www.justice.gov/opa/pr/justice-department-acts-shut-down-fraudulent-websites-exploiting-covid-19-pandemic
• Canon USA’s stolen files leaked by Maze ransomware gang
  • https://www.bleepingcomputer.com/news/security/canon-usas-stolen-files-leaked-by-maze-ransomware-gang/
• U.S. spirits and wine giant hit by cyberattack, 1TB of data stolen
  • https://www.bleepingcomputer.com/news/security/us-spirits-and-wine-giant-hit-by-cyberattack-1tb-of-data-stolen/
• Three Men Who Allegedly Used Existing Shell Companies and Prior Fraud Experience to Exploit Covid-19 Relief Programs Charged in South Florida Federal Court
  • https://www.justice.gov/usao-sdfl/pr/three-men-who-allegedly-used-existing-shell-companies-and-prior-fraud-experience

Vulnerabilities and Exploits

• A Vulnerability in IBM WebSphere Application Server Could Allow for Remote Code Execution
  • https://www.cisecurity.org/advisory/a-vulnerability-in-ibm-websphere-application-server-could-allow-for-remote-code-execution_2020-117/
• Exploiting vBulletin: “A Tale of a Patch Fail”
  • https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
• Shellshock In-Depth: Why This Old Vulnerability Won’t Go Away
  • https://securityintelligence.com/articles/shellshock-vulnerability-in-depth/
• Keeping the gate locked on your IoT devices: Vulnerabilities found on Amazon’s Alexa
  • https://research.checkpoint.com/2020/amazons-alexa-hacked/
• Old vulnerabilities die hard: researchers uncover 20-year-old code in Windows Print Spooler
  • https://www.cyberscoop.com/windows-print-spooler-safebreach-black-hat/
• Microsoft August 2020 Patch Tuesday
  • https://isc.sans.edu/forums/diary/Microsoft+August+2020+Patch+Tuesday/26452/
• US-CERT Bulletin (SB20-223) – Vulnerability Summary for the Week of August 3, 2020
  • https://us-cert.cisa.gov/ncas/bulletins/sb20-223
• PoC Exploit Targeting Apache Struts Surfaces on GitHub
  • https://threatpost.com/poc-exploit-github-apache-struts/158393/