Summary
— Welcome to Security Soup’s continuing news coverage of highlights from the previous week. This list is not intended to be an exhaustive source, but simply a collection of items I found interesting throughout my weekly research. The summaries are provided with links for the reader to drill down into particular topics according to their own interests. Thank you to all of the contributors for this great content!
Industry News and Reports
- UK Government: Cyber Security Breaches Survey 2019
- Google: Android Security 2018 Year In Review
- Bugcrowd: Security Leadership Study – Trends in Application Security
- Debunking the Hacker Hype: The Reality of Widespread Blackouts – RSA 2019 Recap
- Effectively Applying Threat Intelligence: Trends From the 2019 SANS CTI Survey
Tools and Tips
- A few Ghidra tips for IDA users, part 0 – automatic comments for API call parameters
- Beagle: Graph transforms for DFIR data & logs
- Step By Step Office Dropper Dissection
- Ghidra SRE: The AZORult Field Test
- RPC Bug Hunting Case Studies
- Presentation: Powering Up on PowerShell
- Shodan Seeker: Command-line tool using Shodan API.
- How I use Any.Run
- Introducing the Web Security Academy
- Introducing PoshC2 v4.8 – includes C# dropper, task management and more! – Part One
- Ghidra Plugin Development for Vulnerability Research – Part-1
- Simulating MITRE ATT&CK with RE:TERNAL
- Assess your data potential with ATT&CK Datamap
Threat Research – Malware, Phishing, and other campaigns
- Mapping Out a Malware Distribution Network
- Ongoing DNS hijacking campaign targeting consumer routers
- ‘Broken’ File Hides Malware Designed to Break Its Targets
- Fake AV is Back: LaCie Network Drives Used to Spread Malware
- Emotet, Ryuk, and TrickBot join hands in new information stealing campaign
- Actors Using New File Hosting Service to Launch Attacks
- Ransomware Attackers turn to Google Ads after Dream Market Take Down
- Evolving tactics of London Blue, a BEC threat group
- Xwo a python based Bot-scanner
- IcedID Banking Trojan Spruces Up Injection Tactics to Add Stealth
- Phishing Attack Uses SingleFile Browser Extension Tool to Obfuscate Malicious Log-in Pages
- Tax-themed Email Campaigns Target 2019 Filers
- Ursnif: The Latest Evolution of the Most Popular Banking Malware
- Hiding in Plain Sight: Researchers unearth Facebook cybercrime groups
- “Fake Updates Campaign” pushes Chthonic banking trojan
- Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware
- Malware Campaigns Sharing Network Resources: r00ts.ninja
- The Social Engineering Behind Operation Sharpshooter, Rising Sun
- A ONE-TWO PUNCH OF EMOTET, TRICKBOT, & RYUK STEALING & RANSOMING DATA
- Threat Actor Group using UAC Bypass Module to run BAT File
- Ammyy RAT Hide its Macro in Hidden WorkSheet…
- Paliz, the PowerShell downloader in a ZIP and beyond
- Mimikatz in the Wild: Bypassing Signature-Based Detections Using the “AK47 of Cyber”
- Emotet malware analysis. Part 2.
- CB TAU Threat Intelligence Notification: Hunting APT28 Downloaders
Breaches, Government, and Law Enforcement
- Bayer Reveals Detection and Containment of Winnti Digital Attack
- 540 million records on Facebook users exposed by third-party apps
- New York State Capital of Albany Hit by Ransomware Attack
Vulnerabilities and Exploits
- Microsoft Edge and Internet Explorer Zero-Days
- Multiple Vulnerabilities in Magento
- Researcher publishes Google Chrome exploit
- Analysis of a VB Script Heap Overflow (CVE-2019-0666)
- CARPE (DIEM): CVE-2019-0211 Apache Root Privilege Escalation