Hello and welcome to Sec Soup, where the weekly newsletter has a collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

• Cybersecurity Quarterly – Spring 2020
  • https://www.cisecurity.org/white-papers/cybersecurity-quarterly-spring-2020/
• Security and Privacy Implications of Zoom
  • https://www.schneier.com/blog/archives/2020/04/security_and_pr_1.html
• Zoom privacy and security issues: Here’s everything that’s wrong (so far)
  • https://www.tomsguide.com/news/zoom-security-privacy-woes
• Defense Evasion Dominant in Top MITRE ATT&CK Tactics of 2019
  • https://www.recordedfuture.com/mitre-attack-tactics/
• COVID-19 Outbreak Prompts Opportunistic Wave of Malicious Email Campaigns
  • https://symantec-blogs.broadcom.com/blogs/threat-intelligence/covid-19-outbreak-prompts-opportunistic-wave-malicious-email-campaigns
• Trickbot: A primer
  • https://blog.talosintelligence.com/2020/03/trickbot-primer.html#more
• Coronavirus/COVID-19 Payment Lures on the Rise
  • https://www.proofpoint.com/us/threat-insight/post/coronaviruscovid-19-payment-lures-rise
• Life Has No Ctrl+Alt+Del – The New DFIR Online Meetup
  • https://smarterforensics.com/2020/04/life-has-no-ctrlaltdel-the-new-dfir-online-meetup/
• Pluralsight Free for Month of April
  • https://www.pluralsight.com/offer/2020/free-april-month
• Threat Intel Update | Cyber Attacks Leveraging the COVID-19/CoronaVirus Pandemic
  • https://labs.sentinelone.com/threat-intel-update-cyber-attacks-leveraging-the-covid-19-coronavirus-pandemic/
• Emotet Leads to Full Operational Shutdown
  • https://www.microsoft.com/security/blog/2020/04/02/full-operational-shutdown-another-cybercrime-case-microsoft-detection-and-response-team/

Threat Research 

• Multi-Step Phishing Kit Targeting Credit Union
  • https://blog.sucuri.net/2020/04/multi-step-phishing-kit-targeting-credit-union.html
• Targeted Attack on Indian Financial Institution Delivers Crimson RAT
  • https://www.zscaler.com/blogs/research/targeted-attack-indian-financial-institution-delivers-crimson-rat
• Breaking the Ice: A Deep Dive Into the IcedID Banking Trojan’s New Major Version Release
  • https://securityintelligence.com/posts/breaking-the-ice-a-deep-dive-into-the-icedid-banking-trojans-new-major-version-release/
• New Agent Tesla Variant Spreading by Phishing
  • https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html
• Loncom packer: from backdoors to Cobalt Strike
  • https://securelist.com/loncom-packer-from-backdoors-to-cobalt-strike/96465/
• Raccoon Stealer’s Abuse of Google Cloud Services and Multiple Delivery Techniques
  • https://blog.trendmicro.com/trendlabs-security-intelligence/raccoon-stealers-abuse-of-google-cloud-services-and-multiple-delivery-techniques/
• AZORult brings friends to the party
  • https://blog.talosintelligence.com/2020/04/azorult-brings-friends-to-party.html
• Nemty Ransomware – Learning by Doing
  • https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/
• Guloader: The RAT Downloader
  • https://blog.morphisec.com/guloader-the-rat-downloader
• The Dukes of Moscow
  • https://www.carbonblack.com/2020/03/26/the-dukes-of-moscow/
• An old enemy – Diving into QBot part 1
  • https://malwareandstuff.com/an-old-enemy-diving-into-qbot-part-1/
• REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation
  • https://blog.intel471.com/2020/03/31/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation
• It’s Your Money and They Want It Now — The Cycle of Adversary Pursuit
  • https://www.fireeye.com/blog/threat-research/2020/03/the-cycle-of-adversary-pursuit.html
• Nanocore & CypherIT
  • https://malwareindepth.com/defeating-nanocore-and-cypherit/

Tools and Tips

• The ATT&CK Rainbow of Tactics
  • https://medium.com/falconforce/the-att-ck-rainbow-of-tactics-5eb6f0bddebe
• Offense and Defense – A Tale of Two Sides: Bypass UAC
  • https://www.fortinet.com/blog/threat-research/offense-and-defense-a-tale-of-two-sides-bypass-uac.html
• A Matter of Trust: Remote Access for ICS
  • https://dragos.com/blog/industry-news/a-matter-of-trust-remote-access-for-ics/
• Fantastic payloads and where we find them
  • https://intezer.com/blog/intezer-analyze/fantastic-payloads-and-where-we-find-them/
• FakeNet Genie: Improving Dynamic Malware Analysis with Cheat Codes for FakeNet-NG
  • https://www.fireeye.com/blog/threat-research/2020/04/improving-dynamic-malware-analysis-with-cheat-codes-for-fakenet-ng.html
• Analyzing Malicious Emails and Attachments Using safe-mail
  • https://swimlane.com/blog/analyzing-malicious-emails-and-attachments-using-safe-mail/
• Opnsense and SSL decryption using sslsplit
  • https://laskowski-tech.com/2020/03/29/opnsense-and-ssl-decryption-using-sslsplit/
• Creating & Tracking Threat Hunting Metrics
  • https://medium.com/@jshlbrd/creating-tracking-threat-hunting-metrics-fc66e6b84076
• Chrome Extension Analysis
  • http://colin-cowie.com/2020/03/28/Chrome-Extension-Analysis.html
• mimikatz Is My New EICAR
  • https://blog.didierstevens.com/2020/03/30/mimikatz-is-my-new-eicar
• ATT&CK with Sub-Techniques — What You Need to Know
  • https://medium.com/mitre-attack/attack-subs-what-you-need-to-know-99bce414ae0b
• How to Deploy Your Own Algo VPN Server in the DigitalOcean Cloud
  • https://zeltser.com/deploy-algo-vpn-digital-ocean/
• Parsing unknown protobufs with python
  • https://www.swiftforensics.com/2020/03/parsing-unknown-protobufs-with-python.html
• Master Boot Record – Decoding BPB
  • https://www.mrhobbits.com/2020/04/03/master-boot-record-decoding-bpb/
• Attack matrix for Kubernetes
  • https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/

Breaches, Government, and Law Enforcement 

• Marriott International: Incident Notification
  • https://mysupport.marriott.com/
• MakeFrame: Magecart Group 7’s Latest Skimmer Has Claimed 19 Victim Sites
  • https://www.riskiq.com/blog/labs/magecart-makeframe/
• 42 million Iranian “Telegram” user IDs and phone numbers leaked online: report
  • https://www.comparitech.com/blog/information-security/iranian-telegram-accounts-leaked/
• Federal Government Warns of Potential Fraud Scams Surrounding COVID-19 Economic Impact Payments (PDF)
  • https://www.justice.gov/usao-edky/press-release/file/1265371/download

Vulnerabilities and Exploits

• Firefox gets fixes for two zero-days exploited in the wild
  • https://www.zdnet.com/article/firefox-gets-fixes-for-two-zero-days-exploited-in-the-wild/
• Twitter Data Cache on Mozilla Firefox
  • https://privacy.twitter.com/en/blog/2020/data-cache-firefox
• ‘War Dialing’ Tool Exposes Zoom’s Password Problems
  • https://krebsonsecurity.com/2020/04/war-dialing-tool-exposes-zooms-password-problems/
• US-CERT Bulletin (SB20-090): Vulnerability Summary for the Week of March 23, 2020
  • https://www.us-cert.gov/ncas/bulletins/sb20-090
• Windows Debugging & Exploiting Part 5: SMBGhost CVE-2020-0796 Technical Review
  • https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/windows-debugging-and-exploiting-part-5-smbghost-cve-2020-0796-technical-review/
• The ‘S’ in Zoom, Stands for Security – uncovering (local) security flaws in Zoom’s latest macOS client
  • https://objective-see.com/blog/blog_0x56.html
• Attacks Exploiting Vulnerabilities in Pulse Connect Secure
  • https://blogs.jpcert.or.jp/en/2020/04/attacks-exploiting-vulnerabilities-in-pulse-connect-secure.html