Hello and welcome to Sec Soup, where the weekly newsletter has a collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

• Cybersecurity Quarterly Summer 2020
  • https://www.cisecurity.org/white-papers/cybersecurity-quarterly-summer-2020/
• US-CERT Alert (AA20-183A): Defending Against Malicious Cyber Activity Originating from Tor
  • https://www.us-cert.gov/ncas/alerts/aa20-183a
• Elastic Security opens public detection rules repo
  • https://www.elastic.co/blog/elastic-security-opens-public-detection-rules-repo

Threat Research 

• EKANS Ransomware Targeting OT ICS Systems
  • https://www.fortinet.com/blog/threat-research/ekans-ransomware-targeting-ot-ics-systems
• New Mac ransomware spreading through piracy
  • https://blog.malwarebytes.com/mac/2020/06/new-mac-ransomware-spreading-through-piracy/
• Threat Spotlight: Valak Slithers Its Way Into Manufacturing and Transportation Networks
  • https://blog.talosintelligence.com/2020/07/valak-emerges.html
• Aggah Campaign’s Latest Tactics: Victimology, PowerPoint Dropper and Cryptocurrency Stealer
  • https://threatresearch.ext.hp.com/aggah-campaigns-latest-tactics-victimology-powerpoint-dropper-and-cryptocurrency-stealer/
• Try2Cry: Ransomware tries to worm
  • https://www.gdatasoftware.com/blog/2020/07/36200-ransomware-tries-to-worm
• GoldenSpy Chapter 3: New and Improved Uninstaller
  • https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/goldenspy-chapter-3-new-and-improved-uninstaller/
• XMRig variant mining Trojan rampantly doing evil
  • https://blog.360totalsecurity.com/en/xmrig-variant-mining-trojan-rampantly-doing-evil/
• Living Off Windows Land – A New Native File “downldr”
  • https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/

Tools and Tips

• Automating DLL Hijack Discovery
  • https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0
• Securing Check Point Firewall
  • https://www.cisecurity.org/benchmark/checkpoint_firewall/
• Into the Rabbit Hole – Offensive DNS Tunneling Rootkits
  • https://www.fortinet.com/blog/threat-research/into-the-rabbit-hole-offensive-dns-tunneling-rootkits
• Python 2to3: Tips From the CrowdStrike Data Science Team
  • https://www.crowdstrike.com/blog/how-crowdstrike-upgraded-from-python-2-to-3/
• Get The Most Out Of Your IoC: The Beginner’s Guide
  • https://inquest.net/blog/2020/06/30/Get-The-Most-Out-Of-Your-IoC-The-Beginners-Guide
• Level up your YARA game
  • https://blog.reversinglabs.com/blog/level-up-your-yara-game
• Capture the Flag 101
  • https://blog.onfvp.com/post/ctf101/
• Mining DNS MX Records for Fun and Profit
  • https://medium.com/@jason_trost/mining-dns-mx-records-for-fun-and-profit-7a069da9ee2d
• fvol: Fast volatility script (fvol) is a wrapper script that will run volatility plugins against a memory dump
  • https://github.com/debernal/fvol

Breaches, Government, and Law Enforcement 

• University of California SF pays ransomware hackers $1.14 million to salvage research
  • https://www.zdnet.com/article/university-of-california-sf-pays-ransomware-hackers-1-14-million-to-salvage-research/
• Australia to spend nearly $1 billion to boost cyber security
  • https://www.reuters.com/article/us-australia-cyber/australia-to-spend-nearly-1-billion-to-boost-cyber-security-idUSKBN2410JB
• COVID-19 ‘Breach Bubble’ Waiting to Pop?
  • https://krebsonsecurity.com/2020/06/covid-19-breach-bubble-waiting-to-pop/
• NTT Com confirms possible information leak due to unauthorized access
  • https://www.ntt.com/en/about-us/press-releases/news/article/2020/0702.html

Vulnerabilities and Exploits

• CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication
  • https://security.paloaltonetworks.com/CVE-2020-2021
• K52145254: TMUI RCE vulnerability CVE-2020-5902
  • https://support.f5.com/csp/article/K52145254
• F5 fixes critical vulnerability discovered by Positive Technologies in BIG-IP application delivery controller
  • https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
• Would you like some RCE with your Guacamole?
  • https://research.checkpoint.com/2020/apache-guacamole-rce/
• US-CERT Bulletin (SB20-181): Vulnerability Summary for the Week of June 22, 2020
  • https://www.us-cert.gov/ncas/bulletins/sb20-181