Summary

— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. The summaries are provided with links for the reader to drill down into particular topics according to their own interests.

Industry Reports, News, and Miscellany

Palo Alto Networks acquires cybersecurity startup Twistlock
- https://www.cisomag.com/palo-alto-networks-acquires-cybersecurity-startup-twistlock
Menlo Security Secures $75 Million Funding Round to Deliver Zero Trust Internet
- https://www.menlosecurity.com/blog/menlo-security-secures-75-million-funding-round
Should governments pay extortion payments after a ransomware attack?
- https://blog.talosintelligence.com/2019/07/ransomware-extortion-roundtable-government-payments.html
Canonical GitHub account hacked, Ubuntu source code safe
- https://www.zdnet.com/google-amp/article/canonical-github-account-hacked-ubuntu-source-code-safe
Train maker’s coder goes loco, choo-choo-chooses to flee to China with top-secret code – allegedly
- https://www.theregister.co.uk/2019/07/12/train_software_theft/
Threat Actors are Increasing Their Use of Free Hosts
- https://info.phishlabs.com/blog/threat-actors-increasing-use-free-hosts
The Future of Adversaries is Software Development
- https://medium.com/@malcomvetter/the-future-of-adversaries-is-software-development-f599c3da2a9f
Endpoint Hunting in an AntiEDR World
- https://mgreen27.github.io/projects/AntiEDRWorld/
End Users as the Strongest Link
- https://www.tripwire.com/state-of-security/security-data-protection/end-users-strongest-link
Ransomware Recovery Firms Who Secretly Pay Hackers
- https://www.schneier.com/blog/archives/2019/07/ransomware_reco.html
Who’s Behind the GandCrab Ransomware?
- https://krebsonsecurity.com/2019/07/whos-behind-the-gandcrab-ransomware/
From exploits to honeypots: How the security community is preparing for BlueKeep’s moment of truth
- https://www.cyberscoop.com/bluekeep-removal-remote-desktop-wannacry-notpetya/
Most SMB devices run Windows versions that are expired or will expire by January 2020
- https://www.helpnetsecurity.com/2019/07/09/outdated-windows-versions/
July 9: Microsoft Forces Update to Changes to Ticket-Granting Ticket (TGT) Delegation Across Trusts in Windows Server (PFE edition)
- https://techcommunity.microsoft.com/t5/Premier-Field-Engineering/Changes-to-Ticket-Granting-Ticket-TGT-Delegation-Across-Trusts/ba-p/440283
- https://twitter.com/harmj0y/status/1148790723837386756?s=19
What’s Next? Infosec Careers, Cognitive Dissonance, and Tours of Duty
- https://chrissanders.org/2019/07/infosec-tour-of-duty/

Tools and Tips

A Top 10 Reading List if You’re Getting Started in Cyber Threat Intelligence
- https://medium.com/katies-five-cents/a-top-10-reading-list-if-youre-getting-started-in-cyber-threat-intelligence-c11a18fc9798
Cyber Hygiene Guidance for Windows 10
- https://www.cisecurity.org/blog/cyber-hygiene-guidance-for-windows-10/
A peek into malware analysis tools
- https://www.alienvault.com/blogs/labs-research/a-peek-into-malware-analysis-tools
Flirting With IDA and APT28
- https://threatvector.cylance.com/en_us/home/flirting-with-ida-and-apt28.html
Security Showcase: Open source projects to help build and operate more secure systems, along with tools for security monitoring and incident response.
- https://github.com/showcases/security
Logging made easy (LME): How to set up your own basic security logging system
- https://www.ncsc.gov.uk/blog-post/logging-made-easy
My-arsenal-of-aws-security-tools: List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
- https://github.com/toniblyx/my-arsenal-of-aws-security-tools
NetKatz, Mimikatz to Hex and Defender groans but shrugs
- https://medium.com/@markmotig/netkatz-mimikatz-to-hex-and-defender-groans-but-shrugs-157fe8d67bdf
DeTT&CT is now available as a Docker Image and Dockerfile
- https://github.com/rabobank-cdc/DeTTECT/wiki/Installation-and-requirements#docker
Seven ways to spot a business email compromise in Office 365
- https://expel.io/blog/seven-ways-to-spot-business-email-compromise-office-365/
Introduction to Networking | Network Basics for Beginners – OSI Model (YouTube video by Vinsloev Academy)
- https://www.youtube.com/watch?list=PLR0bgGon_WTKY2irHaG_lNRZTrA7gAaCj&feature=youtu.be&v=rIZ61PyDkH8&app=desktop
Machine Learning Explained in 12 minutes
- https://towardsdatascience.com/machine-learning-explained-in-12-minutes-db34860383c4
Bypassing Beaconing Detection with Metasploit
- https://www.activecountermeasures.com/bypassing-beaconing-detection-with-metasploit/
Organizing your OSINT Investigation Tools
- https://medium.com/@raebaker/organizing-your-osint-investigation-tools-a94d3f707571
Learn regex the easy way
- https://github.com/ziishaned/learn-regex
Instagram OSINT Tool
- https://github.com/sc1341/InstagramOSINT
Deploying Security Onion for Monitoring HIDS (AmherstSec July 2019)
- https://seangoodwin.blog/2019/07/10/amherstsec-july-2019
Regipy — An OS Independent Python Library for Parsing Offline Registry Hives
- https://amp.kitploit.com/2019/07/regipy-os-independent-python-library.html
A gentle introduction to Linux Kernel fuzzing
- https://blog.cloudflare.com/a-gentle-introduction-to-linux-kernel-fuzzing
Hiding in the shadows at Members attribute
- https://medium.com/@huykha10/hiding-in-the-shadows-e3c32b89fc1c
EVERYTHING YOU NEED TO KNOW TO GET STARTED IN CYBERSECURITY
- https://www.sentinelone.com/blog/everything-need-know-get-started-cybersecurity/
Swimlane research team open sources pyattack
- https://swimlane.com/blog/swimlane-research-team-open-sources-pyattack
Beyond good ol’ Run key, Part 108
- http://www.hexacorn.com/blog/2019/07/11/beyond-good-ol-run-key-part-108-2/
Notes for Beginner Network Pentesting Course
- https://github.com/hmaverickadams/Beginner-Network-Pentesting

Threat Research – Malware, Phishing, and other Campaigns in the Wild

BitPaymer Source Code Fork: Meet DoppelPaymer Ransomware and Dridex 2.0
- https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/
Spotting RATs: Tales from a Criminal Attack
- https://blog.yoroi.company/research/spotting-rats-tales-from-a-criminal-attack/
UK Banking Phish Targets 2-Factor Information
- https://cofense.com/uk-banking-phish-targets-2-factor-information/
Double Duty: Dridex Banking Malware Delivered with RMS RAT
- https://cofense.com/double-duty-dridex-banking-malware-delivered-rms-rat/
‘Til Death Do Us Part… Romance Scams and the BEC Game
- https://www.agari.com/email-security-blog/romance-scams-and-bec-connection/
Buhtrap group uses zero‑day in latest espionage campaigns
- https://www.welivesecurity.com/2019/07/11/buhtrap-zero-day-espionage-campaigns/
Magento Killer
- https://blog.sucuri.net/2019/07/magento-killer.html
Spray and Pray: Magecart Campaign Breaches Websites En Masse Via Misconfigured Amazon S3 Buckets
- https://www.riskiq.com/blog/labs/magecart-amazon-s3-buckets/
Taking Over the Overlay: Reconstructing a Brazilian Remote Access Trojan (RAT)
- https://securityintelligence.com/posts/taking-over-the-overlay-reconstructing-a-brazilian-remote-access-trojan-rat/
Windows zero‑day CVE‑2019‑1132 exploited in targeted attacks
- https://www.welivesecurity.com/2019/07/10/windows-zero-day-cve-2019-1132-exploit/
A Deep Dive Into IcedID Malware: Part I – Unpacking, Hooking and Process Injection
- https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-one.html
New FinSpy iOS and Android implants revealed ITW
- https://securelist.com/new-finspy-ios-and-android-implants-revealed-itw/91685/
Powload Loads Up on Evasion Techniques
- https://blog.trendmicro.com/trendlabs-security-intelligence/powload-loads-up-on-evasion-techniques/
The 2019 Resurgence of Smokeloader
- https://research.checkpoint.com/2019-resurgence-of-smokeloader/
Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques
- https://blog.talosintelligence.com/2019/07/sea-turtle-keeps-on-swimming.html
Russian Dolls Malicious Script Delivering Ursnif
- https://isc.sans.edu/forums/diary/Russian+Dolls+Malicious+Script+Delivering+Ursnif/25126/
Threat Actor Profile: TA544 targets geographies from Italy to Japan with a range of malware
- https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta544-targets-geographies-italy-japan-range-malware
Targeted TrickBot activity drops ‘PowerBrace’ backdoor
- https://technical.nttsecurity.com/post/102fnog/targeted-trickbot-activity-drops-powerbrace-backdoor
Threat actors using HEX encoded links to bypass phishing defenses
- https://www.esentire.com/blog/threat-actors-using-hex-encoded-links-to-bypass-phishing-defenses/
Hijack My, Hijack My, Hijack My DLL
- https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/
Dismantling a fileless campaign: Microsoft Defender ATP next-gen protection exposes Astaroth attack
- https://www.microsoft.com/security/blog/2019/07/08/dismantling-a-fileless-campaign-microsoft-defender-atp-next-gen-protection-exposes-astaroth-attack/
How We Seized 15 Active Ransomware Campaigns Targeting Linux File Storage Servers
- https://www.intezer.com/blog-seizing-15-active-ransomware-campaigns-targeting-linux-file-storage-servers/
Strange Bits: Skull and Crossbones, Bloated Malware, and All-In-One Solution for Ransomware
- https://www.gdatasoftware.com/blog/2019/07/35035-strange-bits-3
A New Ransomware Is Targeting Network Attached Storage (NAS) Devices
- https://thehackernews.com/2019/07/ransomware-nas-devices.html
TrickBooster – TrickBot’s Email-Based Infection Module
- https://www.deepinstinct.com/2019/07/12/trickbooster-trickbots-email-based-infection-module/

Vulnerabilities and Exploits

A Zoom Flaw Gives Hackers Eas Access to your Webcam
- https://www.wired.com/story/zoom-bug-webcam-hackers/
Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website!
- https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
Response to Video-On Concern
- https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/
July’s Patch Tuesday Fixes Critical Flaws in Microsoft Edge and Internet Explorer, Including 2 Exploited Vulnerabilities
- https://blog.trendmicro.com/trendlabs-security-intelligence/julys-patch-tuesday-fixes-critical-flaws-in-microsoft-edge-and-internet-explorer-including-windows-dhcp-server/
Microsoft Patch Tuesday – July 2019
- https://www.symantec.com/blogs/threat-intelligence/microsoft-patch-tuesday-july-2019
VMWare Security Advisory on DoS Vulnerability in ESXi
- https://isc.sans.edu/forums/diary/VMWare+Security+Advisory+on+DoS+Vulnerability+in+ESXi/25112/
Bulletin (SB19-189): Vulnerability Summary for the Week of July 1, 2019
- https://www.us-cert.gov/ncas/bulletins/sb19-189

Breaches, Government, and Law Enforcement

Bitpoint cryptocurrency exchange hacked for $32 million
- https://www.zdnet.com/article/bitpoint-cryptocurrency-exchange-hacked-for-32-million/
- -to-deliver-zero-trust-internet
US mayors group adopts resolution not to pay any more ransoms to hackers
- https://www.zdnet.com/article/us-mayors-group-adopts-resolution-not-to-pay-any-more-ransoms-to-hackers/
Huawei Technologies’ Links to Chinese State Security Services
- https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3415726
Statement: Intention to fine Marriott International, Inc more than £99 million under GDPR for data breach
- https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/statement-intention-to-fine-marriott-international-inc-more-than-99-million-under-gdpr-for-data-breach/
After ‘significant’ malware attack, U.S. Coast Guard issues maritime security advisory
- https://www.cyberscoop.com/coast-guard-significant-malware-attack/
Premera Blue Cross to Pay $10 Million for Leaked Health Records
- https://news.bloomberglaw.com/privacy-and-data-security/blue-cross-subsidiary-to-pay-10m-for-leaked-health-records

Weekly News Roundup — July 7 to July 13