A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

• The CrowdStrike 2020 Global Threat Report Reveals Troubling Advances in Cybercrime
  • https://www.crowdstrike.com/blog/global-threat-report-foreword-2020/
• Top 10 Malware January 2020
  • https://www.cisecurity.org/blog/top-10-malware-january-2020/
• Attackers Expand Coronavirus-Themed Attacks and Prey on Conspiracy Theories
  • https://twitter.com/threatinsight/status/1234466184310845442
• Coronavirus warning spreads computer virus
  • https://nakedsecurity.sophos.com/2020/03/05/coronavirus-warning-spreads-computer-virus/
• Attackers Taking Advantage of the Coronavirus/COVID-19 Media Frenz
  • https://www.fortinet.com/blog/threat-research/attackers-taking-advantage-of-the-coronavirus-covid-19-media-frenzy.html
• The CIA Hacking Group (APT-C-39) Conducts Cyber-Espionage Operation on China’s Critical Industries for 11 Years
  • https://blog.360totalsecurity.com/en/the-cia-hacking-group-apt-c-39-conducts-cyber-espionage-operation-on-chinas-critical-industries-for-11-years/
• State of the Phish: IBM X-Force Reveals Current Phishing Attack Trends
  • https://securityintelligence.com/posts/state-of-the-phish-ibm-x-force-reveals-current-phishing-attack-trends/
• APT34 (aka Helix Kitten, aka OilRig) Launches New Campaign Against Lebanese Government
  • https://blog.telsy.com/apt34-aka-oilrig-attacks-lebanon-government-entities-with-maildropper-implant/
• Let’s Encrypt Revoking 3 Million Certificates
  • https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864
• APWG Year-End Report: 2019 A Roller Coaster Ride for Phishing
  • https://info.phishlabs.com/blog/top-phishing-trends-2019
• Ransomware Threatens to Reveal Company’s ‘Dirty’ Secrets
  • https://www.bleepingcomputer.com/news/security/ransomware-threatens-to-reveal-companys-dirty-secrets/

Threat Research 

• The North Korean Kimsuky APT keeps threatening South Korea evolving its TTPs
  • https://blog.yoroi.company/research/the-north-korean-kimsuky-apt-keeps-threatening-south-korea-evolving-its-ttps/
• Ryuk Revisited – Analysis of Recent Ryuk Attack
  • https://www.fortinet.com/blog/threat-research/ryuk-revisited-analysis-of-recent-ryuk-attack.html
• Guildma: The Devil drives electric
  • https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/
• ELF_TSCookie – Linux Malware Used by BlackTech
  • https://blogs.jpcert.or.jp/en/2020/03/elf-tscookie.html
• Dissecting Geost: Exposing the Anatomy of the Android Trojan Targeting Russian Banks
  • https://blog.trendmicro.com/trendlabs-security-intelligence/dissecting-geost-exposing-the-anatomy-of-the-android-trojan-targeting-russian-banks/
• Bisonal: 10 years of play
  • https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html
• GuLoader: A Popular New VB6 Downloader that Abuses Cloud Services
  • https://www.proofpoint.com/us/threat-insight/post/guloader-popular-new-vb6-downloader-abuses-cloud-services
• Remco’s RAT, AMSI killing in the wild and defender evasion.
  • https://laskowski-tech.com/2020/03/03/remcos-rat-amsi-killing-in-the-wild-and-defender-evasion/
• Emotet Wi-Fi Spreader Upgraded
  • https://www.binarydefense.com/emotet-wi-fi-spreader-upgraded/
• Monster Lurking in Hidden Excel Worksheet
  • https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/monster-lurking-in-hidden-excel-worksheet/
• Breaking TA505’s Crypter with an SMT Solver
  • https://labs.sentinelone.com/breaking-ta505s-crypter-with-an-smt-solver/

Tools and Tips

• Engineering Process Injection Detections – Part 1: Research
  • https://posts.specterops.io/engineering-process-injection-detections-part-1-research-951e96ad3c85
• Leaky Groups: Accidental Exposure in Google Groups
  • https://www.netskope.com/blog/leaky-groups-accidental-exposure-in-google-groups
• Intel Insight: How to Disable Macros
  • https://www.cisecurity.org/white-papers/intel-insight-how-to-disable-macros/
• Offense and Defense – A Tale of Two Sides: PowerShell
  • https://www.fortinet.com/blog/threat-research/offense-and-defense-a-tale-of-two-sides-powershell.html
• U.S. Department of Justice Shares Best Practices for Gathering Threat Intelligence
  • https://www.flashpoint-intel.com/blog/doj-best-practices-for-threat-intelligence/
  • https://www.justice.gov/criminal-ccips/page/file/1252341/download
• Gamification of Incident Response in the Cyber Range (Podcast)
  • https://www.recordedfuture.com/podcast-episode-148/
• Code INtegrity in the Kernel: A Look into ci.dll
  • https://www.cybereason.com/blog/code-integrity-in-the-kernel-a-look-into-cidll
• Wireshark 3.2.2 Released: Windows’ Users Pay Attention Please
  • https://isc.sans.edu/forums/diary/Wireshark+322+Released+Windows+Users+Pay+Attention+Please/25874/#comments
• Chain Reactor: Simulate Adversary Behaviors on Linux
  • https://isc.sans.edu/forums/diary/Chain+Reactor+Simulate+Adversary+Behaviors+on+Linux/25872/
• Unlocking Heaven’s Gate on Linux
  • https://redcanary.com/blog/heavens-gate-technique-on-linux/
• Accelerate Reverse Engineering with Intezer’s IDA Pro Plugin
  • https://intezer.com/blog-accelerate-reverse-engineering-with-intezers-ida-pro-plugin/
• Extracting Embedded Payloads From Malware
  • https://medium.com/@ryancor/extracting-embedded-payloads-from-malware-aaca8e9aa1a9
• Statically Reverse Engineering Shellcode: Emulation
  • https://0ffset.net/reverse-engineering/malware-analysis/emulating-shellcode-communications/
• The Cyber Intelligence Analyst Cookbook Volume 1 2020.pdf
  • https://github.com/open-source-rs/The-Cyber-Intelligence-Analyst-Cookbook/blob/master/The%20Cyber%20Intelligence%20Analyst%20Cookbook%20Volume%201%202020.pdf
• ELASTIC FOR SECURITY ANALYSTS. PART 1: SEARCHING STRINGS.
  • https://socprime.com/en/blog/elastic-for-security-analysts-part-1-searching-strings/
• Course Repository for University of Cincinnati Malware Analysis Class (CS7038)
  • https://class.malware.re/
  • https://github.com/ckane/CS7038-Malware-Analysis

Breaches, Government, and Law Enforcement 

• Joint Statement From DOS, DOJ, DOD, DHS, ODNI, FBI, NSA, and CISA on Preparations for Super Tuesday
  • https://www.defense.gov/Newsroom/Releases/Release/Article/2099533/joint-statement-from-dos-doj-dod-dhs-odni-fbi-nsa-and-cisa-on-preparations-for/
• Super Tuesday voting so far free of cyber meddling, U.S. officials say
  • https://uk.reuters.com/article/us-usa-election-cyber-idUKKBN20Q1AD
• Former DHS official charged with theft of confidential government software, databases
  • https://www.zdnet.com/article/former-dhs-official-charged-with-theft-of-confidential-government-databases/
• Ryuk ransomware hits Fortune 500 company EMCOR
  • https://www.zdnet.com/article/ryuk-ransomware-hits-fortune-500-company-emcor/
• Two Chinese Nationals Charged with Laundering Over $100 Million in Cryptocurrency From Exchange Hack
  • https://www.justice.gov/opa/pr/two-chinese-nationals-charged-laundering-over-100-million-cryptocurrency-exchange-hack
• T-Mobile reveals data breach, customer account info accessed
  • https://www.tmonews.com/2020/03/t-mobile-reveals-data-breach-customer-account-info-accessed/
• French Firms Rocked by Kasbah Hacker?
  • https://krebsonsecurity.com/2020/03/french-firms-rocked-by-kasbah-hacker/

Vulnerabilities and Exploits

• Multiple Vulnerabilities in Cisco Webex Network Recording Player and Cisco Webex Player Could Allow for Arbitrary Code Execution
  • https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-webex-network-recording-player-and-cisco-webex-player-could-allow-for-arbitrary-code-execution_2020-032/
• Multiple Vulnerabilities in Google Android OS Could Allow for Arbitrary Code Execution
  • https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-android-os-could-allow-for-arbitrary-code-execution_2020-031/
• Zoho zero-day published on Twitter
  • https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/
• Hackers Scanning for Vulnerable Microsoft Exchange Servers, Patch Now!
  • https://www.bleepingcomputer.com/news/security/hackers-scanning-for-vulnerable-microsoft-exchange-servers-patch-now/
• Critical Netgear Bug Impacts Flagship Nighthawk Router
  • https://threatpost.com/critical-netgear-bug-impacts-nighthawk-router/153445/
• US-CERT: Bulletin (SB20-062) – Vulnerability Summary for the Week of February 24, 2020
  • https://www.us-cert.gov/ncas/bulletins/sb20-062
• Intel x86 Root of Trust: loss of trust
  • http://blog.ptsecurity.com/2020/03/intelx86-root-of-trust-loss-of-trust.html
• Positive Technologies: Unfixable vulnerability in Intel chipsets threatens users and content rightsholders
  • https://www.ptsecurity.com/ww-en/about/news/unfixable-vulnerability-in-intel-chipsets-threatens-users-and-content-rightsholders/
• MediaTek Bug Actively Exploited, Affects Millions of Android Devices
  • https://threatpost.com/mediatek-bug-actively-exploited-android/153408/