Summary
— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted or intended to be an exhaustive source, but simply a collection of items I found interesting throughout my weekly research. The summaries are provided with links for the reader to drill down into particular topics according to their own interests. Thank you to all of the contributors for this great content!
Industry Reports and Miscellany
- Verizon 2019 “Data Breach Investigations Report” (DBIR)
- FIN7.5: the infamous cybercrime rig “FIN7” continues its activities
- Introducing the Bromium Threat Insights Report
- F5 acquires NGINX: What to expect from the deal
- Threat Roundup for May 3 to May 10
- Hacking Collective Claims Breaches of Three Major Anti-Virus Companies
- Over 1,900 breaches reported in the first three months of 2019, a new Q1 record
Tools and Tips
- DSSuite – A Docker Container with Didier’s Tools
- Updates to ADB to support VBA stomping — Adaptive Document Builder: A framework for generating simulated malicious office documents.
- Microsoft recommended block rules
- Evil Clippy: MS Office maldoc assistant
- Virtually Physical Access – Exploiting Virtual Machine Files on Penetration Tests
- Using Linux Process Environment Variables for Live Forensics
- Submit malware samples to VMRay via MISP – Automation
- The new Windows Terminal, and the original Windows console host — all in the same place!
- Unveiling the newest architecture for the Windows Subsystem for Linux: WSL 2
- Finding Registry Malware Persistence with RECmd
- Darksearch – The 1st real Dark Web search engine (Darksearch vs Ahmia)
- Atomic Red Team: T1490 – Inhibit System Recovery
- Parsing carved evtx records using EvtxECmd
- Sysdig for malware unpacking
Threat Research – Malware, Phishing, and other Campaigns in the Wild
- CVE-2019-3396 Redux: Confluence Vulnerability Exploited to Deliver Cryptocurrency Miner With Rootkit
- Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak
- Going Beyond Malware: The Rise of “Living off the Land” Attacks
- ATMitch: New Evidence Spotted In The Wild
- GANDCRAB’S NEW EVASIVE INFECTION CHAIN
- Turla LightNeuron: An email too far
- Dharma Ransomware Uses AV Tool to Distract from Malicious Activities
- Vulnerable Apache Jenkins exploited in the wild
- New Spam Attack Targets Romanian Corporation
- New KPOT v2.0 stealer brings zero persistence and in-memory features to silently steal credentials
- SilverTerrier – 2018 Nigerian Business Email Compromise
- PlaNETWORK: Face to Face with Cyber Crime
- Sharepoint vulnerability exploited in the wild
- RobbinHood Ransomware
- A Pony Hidden in Your Secret Garden
Vulnerabilities and Exploits
- VMWare Fusion 11 Guest VM RCE
- Vulnerability Spotlight: Multiple bugs in several Jenkins plugins
- The worst of both worlds: Combining NTLM Relaying and Kerberos delegation
Breaches, Government, and Law Enforcement
- U.S. Charges Chinese Hacker For 2015 Anthem Data Breach
- Wolters Kluwer Incident
- Binance Security Breach Update – Hackers Stole 7000 BTC
- Administrators of DeepDotWeb Indicted for Money Laundering Conspiracy, Sales of Other Illegal Goods on the Darknet
- Crossing a Cyber Rubicon? Overreactions to the IDF’s Strike on the Hamas Cyber Facility
- CISA Alert (AA19-122A): New Exploits for Unsecure SAP Systems
- Iranian Nation-State APT Groups – “Black Box” Leak
- Malware Analysis Report (AR19-129A) | MAR-10135536-21 – North Korean Tunneling Tool: ELECTRICFISH