— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

• APT review: what the world’s threat actors got up to in 2019
  • https://securelist.com/ksb-2019-review-of-the-year/95394/
• Interactive Microsoft Security Intelligence Report Dashboard
  • https://www.microsoft.com/securityinsights/Outgoing
• Microsoft Security Intelligence Report Volume 24 (registration required)
  • https://info.microsoft.com/ww-landing-M365-SIR-v24-Report-eBook.html
• Spear phishing campaigns—they’re sharper than you think
  • https://www.microsoft.com/security/blog/2019/12/02/spear-phishing-campaigns-sharper-than-you-think
• The “Great Cannon” has been deployed again
  • https://cybersecurity.att.com/blogs/labs-research/the-great-cannon-has-been-deployed-again
• End-of-Support Software Report List
  • https://www.cisecurity.org/blog/end-of-support-software-report-list-2/
• Industrial Cyber Attacks: A Humanitarian Crisis in the Making
  • https://dragos.com/blog/industry-news/industrial-cyber-attacks-a-humanitarian-crisis-in-the-making/
• Detection déjà vu: a tale of two incident response engagements
  • https://redcanary.com/blog/a-tale-of-two-incident-response-engagements/
• Incident Response Casefile – A successful BEC leveraging lookalike domains
  • https://research.checkpoint.com/2019/incident-response-casefile-a-successful-bec-leveraging-lookalike-domains/
• Forums are Forever – Part 1: Cybercrime Never Dies
  • https://www.digitalshadows.com/blog-and-research/forums-are-forever-part-1-cybercrime-never-dies/
• Misconceptions: Unrestricted Release of Offensive Security Tools
  • https://medium.com/@QW5kcmV3/misconceptions-unrestricted-release-of-offensive-security-tools-789299c72afe
• Challenging Your Forensic Readiness with an Application-Level Ransomware Attack
  • https://blog.compass-security.com/2019/11/challenging-your-forensic-readiness-with-an-application-level-ransomware-attack/
• Emotet’s Central Position in the Malware Ecosystem
  • https://news.sophos.com/en-us/2019/12/02/emotets-central-position-in-the-malware-ecosystem

Threat Research – Malware, Phishing, and other Campaigns in the Wild

• Buer, a new loader emerges in the underground marketplace
  • https://www.proofpoint.com/us/threat-insight/post/buer-new-loader-emerges-underground-marketplace
• Meet PyXie: A Nefarious New Python RAT
  • https://threatvector.cylance.com/en_us/home/meet-pyxie-a-nefarious-new-python-rat.html
• Another Fake Google Domain: fonts.googlesapi.com
  • https://blog.sucuri.net/2019/12/another-fake-google-domain-fonts-googlesapi-com.html
• A Big Day for Phishing
  • https://www.zscaler.com/blogs/research/big-day-phishing
• New version of IcedID Trojan uses steganographic payloads
  • https://blog.malwarebytes.com/threat-analysis/2019/12/new-version-of-icedid-trojan-uses-steganographic-payloads/
• Obfuscation Tools Found in the Capesand Exploit Kit Possibly Used in “KurdishCoder” Campaign
  • https://blog.trendmicro.com/trendlabs-security-intelligence/obfuscation-tools-found-in-the-capesand-exploit-kit-possibly-used-in-kurdishcoder-campaign/
• Phishing with a self-contained credentials-stealing webpage
  • https://isc.sans.edu/forums/diary/Phishing+with+a+selfcontained+credentialsstealing+webpage/25580/
• Analysis of LooCipher, a New Ransomware Family Observed This Year
  • https://securingtomorrow.mcafee.com/blogs/other-blogs/mcafee-labs/analysis-of-loocipher-a-new-ransomware-family-observed-this-year/
• Breaking the Rules: A Tough Outlook for Home Page Attacks (CVE-2017-11774)
  • https://www.fireeye.com/blog/threat-research/2019/12/breaking-the-rules-tough-outlook-for-home-page-attacks.html
• Malware creators trying to avoid detection. Spy.GmFUToMitm as an example
  • http://blog.ptsecurity.com/2019/12/malware-creators-trying-to-avoid.html
• Malware analysis – varenyky
  • https://w3ndige.com/blog/2019-11-30-varenyky-analysis/
• Threat Actor Targeting Hong Kong Pro-Democracy Figures
  • https://threatrecon.nshc.net/2019/12/03/threat-actor-targeting-hong-kong-activists/
• Lazarus Group Goes ‘Fileless’: an implant w/ remote download & in-memory execution
  • https://objective-see.com/blog/blog_0x51.html
• TrickBot Widens Infection Campaigns in Japan Ahead of Holiday Season
  • https://securityintelligence.com/posts/trickbot-widens-infection-campaigns-in-japan-ahead-of-holiday-season/
• APT28 Attacks Evolution
  • https://marcoramilli.com/2019/12/05/apt28-attacks-evolution

Tools and Tips

• Attacking FreeIPA — Part II Enumeration
  • https://posts.specterops.io/attacking-freeipa-part-ii-enumeration-ad27224371e1
• Dissecting Tor Bridges and Pluggable Transport – Part I: Finding the Built-in Tor Bridges and How Tor Browser Works
  • https://www.fortinet.com/blog/threat-research/dissecting-tor-bridges-pluggable-transport.html
• Dissecting Tor Bridges and Pluggable Transport – Part II: How Obfs4 Bridges Defeats Censorship
  • https://www.fortinet.com/blog/threat-research/dissecting-tor-bridges-pluggable-transport-part-2.html
• ClamAV team shows off new Mussels dependency build automation tool
  • https://blog.talosintelligence.com/2019/12/clamav-team-shows-off-new-mussels.html
• Tracking Malware Campaigns Using String Metrics
  • https://www.bromium.com/tracking-malware-campaigns-using-string-metrics/
• Excelerating Analysis – Tips and Tricks to Analyze Data with Microsoft Excel
  • https://www.fireeye.com/blog/threat-research/2019/12/tips-and-tricks-to-analyze-data-with-microsoft-excel.html
• Getting a Grasp on GoogleID’s
  • https://medium.com/week-in-osint/getting-a-grasp-on-googleids-77a8ab707e43
• How to Use OODA Loop in Your Incident Response Process in 2020
  • https://www.cybertriage.com/2019/how-to-use-ooda-loop-in-your-incident-response-process/
• A Threat Intelligence Analyst’s Guide to Today’s Sources of Bias
  • https://www.digitalshadows.com/blog-and-research/a-threat-intelligence-analysts-guide-to-todays-sources-of-bias/
• AWS Traffic Mirroring
  • https://blog.malware.re/2019/11/30/AWS-Traffic-Mirroring/index.html
• Forensics traces of NTDS.dit dumping using ntdsutil utility
  • https://blog.menasec.net/2019/11/forensics-traces-of-ntdsdit-dumping.html
• Advanced Powershell Hunting with the Splunk Decrypt App
  • https://blu3-team.blogspot.com/2019/11/advanced-powershell-hunting-with-splunk.html
• Pypykatz: Mimikatz implementation in pure Python
  • https://github.com/skelsec/pypykatz
• What’s new in Volatility 3?
  • https://www.andreafortuna.org/2019/11/28/whats-new-in-volatility-3
• Use Sysmon DNS data for incident response
  • https://www.vanimpe.eu/2019/12/02/use-sysmon-dns-data-for-incident-response/
• WEASEL: A Stealthy DNS Beacon
  • https://github.com/facebookincubator/WEASEL
• Awesome TheHive: A curated list of awesome things related to TheHive & Cortex
  • https://github.com/TheHive-Project/awesome
• NTLMRecon: A fast NTLM reconnaissance tool without external dependencies.
  • https://github.com/sachinkamath/ntlmrecon

Breaches, Government, and Law Enforcement 

• Ransomware attack hits major US data center provider
  • https://www.zdnet.com/article/ransomware-attack-hits-major-us-data-center-provider/
• Auto industry in the sights of hackers: BMW spied out
  • https://www.br.de/nachrichten/wirtschaft/fr-autoindustrie-im-visier-von-hackern-bmw-ausgespaeht,RjnLkD4
• US charges two members of the Dridex malware gang
  • https://arstechnica.com/information-technology/2019/12/members-of-evil-corp-the-cybercrime-group-that-lived-in-luxury-are-indicted/
• Spying tools website taken down after UK raids
  • https://www.bbc.com/news/technology-50601905
• Hackers Trick Venture Capital Firm Into Sending Them $1 Million
  • https://www.vice.com/en_us/article/mbmmaq/hackers-trick-venture-capital-firm-into-sending-them-dollar1-million
• Freedom Fighter or Fool? Jury’s Out on Arrested Ethereum Developer Virgil Griffith
  • https://www.coindesk.com/freedom-fighter-or-fool-jurys-out-on-arrested-ethereum-developer-virgil-griffith
  • https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-announces-arrest-united-states-citizen-assisting-north-korea
• Health Data Breaches: 3 Lessons Learned
  • https://www.databreachtoday.co.uk/blogs/health-data-breaches-3-lessons-learned-p-2824
• N.J.’s largest health network was hit with major computer disruptions. Officials won’t say if it was ransomware.
  • https://www.nj.com/healthfit/2019/12/njs-largest-health-network-was-hit-with-major-computer-disruptions-officials-wont-say-if-it-was-ransomware.html

Vulnerabilities and Exploits

• US-CERT Bulletin (SB19-336): Vulnerability Summary for the Week of November 25, 2019
  • https://www.us-cert.gov/ncas/bulletins/sb19-336
• Multiple Vulnerabilities in Mozilla Firefox Could Allow for Arbitrary Code Execution
  • https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-firefox-could-allow-for-arbitrary-code-execution_2019-126/
• Multiple Vulnerabilities in Google Android OS Could Allow for Arbitrary Code Execution
  • https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-android-os-could-allow-for-arbitrary-code-execution_2019-125/
• New vulnerability lets attackers sniff or hijack VPN connections
  • https://www.zdnet.com/article/new-vulnerability-lets-attackers-sniff-or-hijack-vpn-connections/
• CVE-2019-1429: (Another) Microsoft Internet Explorer 0-Day
  • https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2019-1429-another-microsoft-internet-explorer-0-day/
• Severe Auth Bypass and Priv-Esc Vulnerabilities Disclosed in OpenBSD
  • https://thehackernews.com/2019/12/openbsd-authentication-vulnerability.html