A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

Remote Work Increasing Exponentially Due to COVID-19
- https://www.netskope.com/blog/remote-work-increasing-exponentially-due-to-covid-19
Investigate | COVID-19 Cybercrime Daily Update
- https://www.riskiq.com/blog/analyst/covid19-cybercrime-update/
Capitalizing on Coronavirus Panic, Threat Actors Target Victims Worldwide
- https://www.recordedfuture.com/coronavirus-panic-exploit/
SANS Security Awareness Work-from-Home Deployment Kit
- https://www.sans.org/security-awareness-training/sans-security-awareness-work-home-deployment-kit
Coronavirus Threat Landscape Update
- https://www.proofpoint.com/us/threat-insight/post/coronavirus-threat-landscape-update
Worms shape the narrative in Red Canary’s 2020 Threat Detection Report
- https://redcanary.com/blog/worms-dominate-2020-threat-detection-report/
US-CERT Alert (AA20-073A): Enterprise VPN Security
- https://www.us-cert.gov/ncas/alerts/aa20-073a
They Come in the Night: Ransomware Deployment Trends
- https://www.fireeye.com/blog/threat-research/2020/03/they-come-in-the-night-ransomware-deployment-trends.html
Threat Intel Update | Cyber Attacks Leveraging the COVID-19/CoronaVirus Pandemic
- https://labs.sentinelone.com/threat-intel-update-cyber-attacks-leveraging-the-covid-19-coronavirus-pandemic/
Awesome-video-chat-backgrounds
- https://github.com/MSAdministrator/awesome-video-chat-backgrounds
How Microsoft Dismantled the Infamous Necurs Botnet
- https://www.wired.com/story/microsoft-necurs-botnet-takedown

Threat Research

Stantinko’s new cryptominer features unique obfuscation techniques
- https://www.welivesecurity.com/2020/03/19/stantinko-new-cryptominer-unique-obfuscation-techniques/
EnigmaSpark: Politically Themed Cyber Activity Highlights Regional Opposition to Middle East Peace Plan
- https://securityintelligence.com/posts/enigmaspark-politically-themed-cyber-activity-highlights-regional-opposition-to-middle-east-peace-plan/
APT36 jumps on the coronavirus bandwagon, delivers Crimson RAT
- https://blog.malwarebytes.com/threat-analysis/2020/03/apt36-jumps-on-the-coronavirus-bandwagon-delivers-crimson-rat/
The Inside Scoop on a Six-Figure Nigerian Fraud Campaign
- https://research.checkpoint.com/2020/the-inside-scoop-on-a-six-figure-nigerian-fraud-campaign/
New RedLine Stealer Distributed Using Coronavirus-themed Email Campaign
- https://www.proofpoint.com/us/threat-insight/post/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign
Getting Sneakier: Hidden Sheets, Data Connections, and XLM Macros
- https://inquest.net/blog/2020/03/18/Getting-Sneakier-Hidden-Sheets-Data-Connections-and-XLM-Macros
Breakout Time: Trickbot edition (Gtags QWE, lib693, tt0002)
- https://laskowski-tech.com/2020/03/16/breakout-time-trickbot-edition/
Weaponized Coronavirus Maps Distribute Malware
- https://blog.reasonsecurity.com/2020/03/09/covid-19-info-stealer-the-map-of-threats-threat-analysis-report/
CrazyCoin, the master of double mining, double white utilization, and resource utilization
- https://blog.360totalsecurity.com/en/crazycoin-the-master-of-double-mining-double-white-utilization-and-resource-utilization/
Parallax: The New RAT on the Block
- https://blog.morphisec.com/parallax-rat-active-status
Dark Matter: Uncovering the DarkComet RAT Ecosystem (PDF)
- https://www.sysnet.ucsd.edu/sysnet/miscpapers/darkmatter-www20.pdf
Vicious Panda: The COVID Campaign
- https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/
3/20/2020 – Hancitor Infection w/Coronavirus Themed Malspam
- https://huntops.blue/2020/03/20/hancitor.html
New version of chinoxy backdoor using COVID19 alerts document lure
- https://medium.com/@Sebdraven/new-version-of-chinoxy-backdoor-using-covid19-document-lure-83fa294c0746

Tools and Tips

Raising Your Own APT: Purple Team Exercises to Drive Security Program Maturity
- https://www.recordedfuture.com/security-program-maturity/
Hunting APTs with YARA
- https://securelist.com/hunting-apts-with-yara/96386/
Security tips for working from home (WFH)
- https://blog.malwarebytes.com/how-tos-2/2020/03/security-tips-for-working-from-home-wfh/
Logging Made Easy (LME)
- https://www.ncsc.gov.uk/information/logging-made-easy
How to Discover Artifacts in UFED Physical Analyzer – Part 2
- https://www.cellebrite.com/en/ask-the-expert/how-to-discover-artifacts-in-ufed-physical-analyzer-part-2/
The Complete Guide to Online Brand Protection
- https://www.digitalshadows.com/blog-and-research/the-complete-guide-to-online-brand-protection/
Wireless Penetration Tips
- https://medium.com/@adam.toscher/wireless-penetration-tips-c0ed0a6665fe
Overview of Free Online Malware Analysis Sandboxes
- https://untrustednetwork.net/en/sandboxes/
Trickbot Decoder Updated
- https://github.com/hasherezade/malware_analysis/tree/master/trickbot
Splunk BOTS — Setup
- https://medium.com/@haggis_m/splunk-bots-setup-be757f9d6a0f
Real-time file monitoring on Windows with osquery
- https://blog.trailofbits.com/2020/03/16/real-time-file-monitoring-on-windows-with-osquery/
Boss of the SOC v3 Dataset Released!
- https://www.splunk.com/en_us/blog/security/botsv3-dataset-released.html
Dovehawk is a Zeek module that automatically imports MISP indicators and reports Sightings
- https://github.com/tylabs/dovehawk
Kerberoasting: AES Encryption, Protected User Group and Group MSA
- https://dev-2null.github.io/Kerberoasting-AES-Encryption-Protected-Users-Group-and-gMSA/

Breaches, Government, and Law Enforcement

Security Breach Disrupts Fintech Firm Finastra
- https://krebsonsecurity.com/2020/03/security-breach-disrupts-fintech-firm-finastra/
Attorney General William P. Barr Urges American Public to Report COVID-19 Fraud
- https://www.justice.gov/opa/pr/attorney-general-william-p-barr-urges-american-public-report-covid-19-fraud
Hayward Resident Sentenced to Four Years for Acting as an Agent of the People’s Republic of China
- https://www.justice.gov/opa/pr/hayward-resident-sentenced-four-years-acting-agent-people-s-republic-china
FBI Warning: Phishing Emails Push Fake Govt Stimulus Checks
- https://www.bleepingcomputer.com/news/security/fbi-warning-phishing-emails-push-fake-govt-stimulus-checks/
Durham city, county governments hit by malware attack
- https://www.wral.com/durham-city-county-governments-hit-by-malware-attack/19000191/

Vulnerabilities and Exploits

Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution-apsb20-14-16-17_2020-039/
Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2020-040/
Two Trend Micro zero-days exploited in the wild by hackers
- https://www.zdnet.com/article/two-trend-micro-zero-days-exploited-in-the-wild-by-hackers/
Microsoft patches SMBv3 wormable bug that leaked earlier this week
- https://www.zdnet.com/article/microsoft-patches-smbv3-wormable-bug-that-leaked-earlier-this-week/
CVE-2020-0796 Memory Corruption Vulnerability in Windows 10 SMB Server
- https://www.fortinet.com/blog/threat-research/cve-2020-0796-memory-corruption-vulnerability-in-windows-10-smb-server.html
Apache Tomcat Vulnerability “Ghostcat” Attracting Threat Actor Attention
- https://www.flashpoint-intel.com/blog/ghostcat/
US-CERT Bulletin (SB20-076): Vulnerability Summary for the Week of March 9, 2020
- https://www.us-cert.gov/ncas/bulletins/sb20-076
SMBGhost (CVE-2020-0796): a Critical SMBv3 RCE Vulnerability
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/smbghost-cve-2020-0796-a-critical-smbv3-rce-vulnerability/
Sniffing Authentication References on macOS
- https://objective-see.com/blog.html

Weekly News Roundup — March 15 to March 21

Industry Reports, News, and Miscellany

Threat Research

Tools and Tips

Breaches, Government, and Law Enforcement

Vulnerabilities and Exploits

Leave a Reply Cancel reply