— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

• W2 Scams and BEC: 3 Reasons Advanced Email Threats Are About to Get Worse
  • https://www.agari.com/email-security-blog/w2-scams-business-email-compromise/
• New Ryuk Info Stealer Targets Government and Military Secrets
  • https://www.bleepingcomputer.com/news/security/new-ryuk-info-stealer-targets-government-and-military-secrets/
• 2019 Holiday Shopping Season Threat Review: A Post-mortem of E-commerce Threats
  • https://www.riskiq.com/blog/external-threat-management/2019-holiday-shopping-threat-review/
• Has Necurs Fallen From (Cybercrime) Grace? Elite Malware Botnet Now Distributes Clunky Scams
  • https://securityintelligence.com/posts/has-necurs-fallen-from-cybercrime-grace-elite-malware-botnet-now-distributes-clunky-scams/
• Common Attacks and Effective Mitigation: 2020 CrowdStrike Services Report Key Findings (Part 2 of 2)
  • https://www.crowdstrike.com/blog/2019-services-report-key-findings-part-2/
• Network Security Perspective on Coronavirus Preparedness
  • https://isc.sans.edu/forums/diary/Network+Security+Perspective+on+Coronavirus+Preparedness/25750/
• Cyber Threat Intelligence Frameworks: 5 Rules for Integrating These Frameworks
  • https://www.digitalshadows.com/blog-and-research/cyber-threat-intelligence-frameworks-5-rules-for-integrating-these-frameworks/

Threat Research – Malware, Phishing, and other Campaigns in the Wild

• Aggah: How to run a botnet without renting a Server (for more than a year)
  • https://blog.yoroi.company/research/aggah-how-to-run-a-botnet-without-renting-a-server-for-more-than-a-year/
• New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset
  • https://intezer.com/blog-new-iranian-campaign-tailored-to-us-companies-uses-updated-toolset/
• Frenchy – Shellcode in the Wild
  • https://www.zscaler.com/blogs/research/frenchy-shellcode-wild
• Winnti Group targeting universities in Hong Kong
  • https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong/
• Android Malware Targets Diabetic Patients
  • https://www.fortinet.com/blog/threat-research/android-malware-targets-diabetic-patients.html
• RATs in the Library – Remote Access Trojans Hide in Plain “Public” Site
  • https://blog.reversinglabs.com/blog/rats-in-the-library
• Is That Really Your AV Company? (Trickbot gtag mor85)
  • https://laskowski-tech.com/2020/01/29/is-that-really-your-av-company-trickbot-gtag-mor85/
• An Overhead View of the Royal Road
  • https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html
• Tracking Down REvil’s “Lalartu” by utilizing multiple OSINT methods
  • https://medium.com/@underthebreach/tracking-down-revils-lalartu-by-utilizing-multiple-osint-methods-2bf3a6c65a80

Tools and Tips

• Detection Engineering using Apple’s Endpoint Security Framework
  • https://posts.specterops.io/detection-engineering-using-apples-endpoint-security-framework-affdbcb18b02
• 7 Steps to Help Prevent & Limit the Impact of Ransomware
  • https://www.cisecurity.org/blog/7-steps-to-help-prevent-limit-the-impact-of-ransomware/
• Introducing Chain Reactor: an open source tool for adversary simulations on Linux
  • https://redcanary.com/blog/chain-reactor-framework-for-linux/
• Route to the DFIR Career
  • https://www.peerlyst.com/posts/route-to-the-dfir-career-mike-art-rebultan
• Memhunter – Live Hunting Of Code Injection Techniques
  • https://www.kitploit.com/2020/01/memhunter-live-hunting-of-code.html
• WhatsApp messages in Non-Rooted Android Devices
  • https://gforce4n6.blogspot.com/2020/01/whatsapp-messages-in-non-rooted-android_25.html

Breaches, Government, and Law Enforcement 

• Raytheon engineer arrested for taking US missile defense secrets to China
  • https://qz.com/1795127/raytheon-engineer-arrested-for-taking-us-missile-defense-secrets-to-china/
• Wawa’s massive card breach: 30 million customers’ details for sale online
  • https://www.zdnet.com/article/wawa-card-breach-may-rank-as-one-of-the-biggest-of-all-times/
• Operation Night Fury: Group-IB helps take down a cybergang behind the infection of hundreds of websites all over the world
  • https://www.group-ib.com/media/night-fury/
• The cyber attack the UN tried to keep under wraps
  • https://www.thenewhumanitarian.org/investigation/2020/01/29/united-nations-cyber-attack
• Dozens of companies have data dumped online by ransomware ring seeking leverage
  • https://arstechnica.com/information-technology/2020/01/dozens-of-companies-have-data-dumped-online-by-ransomware-ring-seeking-leverage/
• Iowa Prosecutors Drop Charges Against Men Hired to Test Their Security
  • https://krebsonsecurity.com/2020/01/iowa-prosecutors-drop-charges-against-men-hired-to-test-their-security/

Vulnerabilities and Exploits

• IE and FIREFOX-Patching nightmare begins in 2020…
  • https://www.menlosecurity.com/blog/ie-and-firefox-patching-nightmare-begins-in-2020
• Trend Micro antivirus zero-day used in Mitsubishi Electric hack
  • https://www.zdnet.com/article/trend-micro-antivirus-zero-day-used-in-mitsubishi-electric-hack/
• US-CERT Bulletin (SB20-027) – Vulnerability Summary for the Week of January 20, 2020
  • https://www.us-cert.gov/ncas/bulletins/sb20-027
• US-CERT Alert (AA20-031A) – Detecting Citrix CVE-2019-19781
  • https://www.us-cert.gov/ncas/alerts/aa20-031a