— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

• MS-ISAC – Top 10 Malware October 2019
  • https://www.cisecurity.org/blog/top-10-malware-october-2019/
• Business Email Compromise: Putting $26 Billion in Known Losses into Context
  • https://www.agari.com/email-security-blog/bec-putting-26-billion-losses-into-context/
• A decade of hacking: The most notable cyber-security events of the 2010s
  • https://www.zdnet.com/article/a-decade-of-hacking-the-most-notable-cyber-security-events-of-the-2010s/
• Insights from one year of tracking a polymorphic threat
  • https://www.microsoft.com/security/blog/2019/11/26/insights-from-one-year-of-tracking-a-polymorphic-threat
• Palo Alto Networks Announces Intent to Acquire Aporeto
  • https://www.prnewswire.com/news-releases/palo-alto-networks-announces-intent-to-acquire-aporeto-300964886.html
• Black Friday/Cyber Monday Ecommerce Security Threats
  • https://blog.sucuri.net/2019/11/black-friday-cyber-monday-ecommerce-security-threats.html
• Full(z) House: a digital crime group using a full deck to maximize profits
  • https://www.riskiq.com/blog/labs/fullz-house/
• A New Wave of Stalkerware Apps: Quick roundup of spyware activity following the US-CERT advisory
  • https://www.zscaler.com/blogs/research/new-wave-stalkerware-apps
• IT threat evolution Q3 2019
  • https://securelist.com/it-threat-evolution-q3-2019/95268/
• 10 Hackers Hacking: A Holiday Countdown of Retail Cybersecurity Threats
  • https://redcanary.com/blog/retail-cybersecurity-threats/
• OPCW, WikiLeaks, and Russian Influence Operations
  • https://pylos.co/2019/11/28/opcw-wikileaks-and-russian-influence-operations/
• Group-IB presents its annual report on global threats to stability in cyberspace
  • https://www.group-ib.com/media/gib-2019-2020-report/
• Unrestricted Release of Offensive Security Tools
  • https://medium.com/@QW5kcmV3/misconceptions-unrestricted-release-of-offensive-security-tools-789299c72afe
• The fall and rise of a spyware empire
  • https://www.technologyreview.com/s/614767/the-fall-and-rise-of-a-spyware-empire

Threat Research – Malware, Phishing, and other Campaigns in the Wild

• Stantinko botnet adds cryptomining to its pool of criminal activities
  • https://www.welivesecurity.com/2019/11/26/stantinko-botnet-adds-cryptomining-criminal-activities/
• Operation ENDTRADE: Finding Multi-Stage Backdoors that TICK
  • https://blog.trendmicro.com/trendlabs-security-intelligence/operation-endtrade-finding-multi-stage-backdoors-that-tick/
• Active TrickBot Campaign Observed Abusing SendGrid and Google Docs
  • https://info.phishlabs.com/blog/active-trickbot-campaign-sendgrid-google-docs
• Threat Spotlight: Machete Info-Stealer
  • https://threatvector.cylance.com/en_us/home/threat-spotlight-machete-info-stealer.html
• Studying Donot Team
  • http://blog.ptsecurity.com/2019/11/studying-donot-team.html
• TrickBot Trojan Getting Ready to Steal OpenSSH and OpenVPN Keys
  • https://www.bleepingcomputer.com/news/security/trickbot-trojan-getting-ready-to-steal-openssh-and-openvpn-keys/
• Emotet deep dive analysis
  • https://neil-fox.github.io/Emotet-Deep-Dive-Analysis/

Tools and Tips

• SauronEye is a search tool built to aid red teams in finding files containing specific keywords.
  • https://isc.sans.edu/forums/diary/ISC+Snapshot+Search+with+SauronEye/25558/
• My Little DoH Setup
  • https://isc.sans.edu/forums/diary/My+Little+DoH+Setup/25548/
• FIDL: FLARE’s IDA Decompiler Library
  • https://www.fireeye.com/blog/threat-research/2019/11/fidl-flare-ida-decompiler-library.html
• How To Build And Run A SOC for Incident Response – A Collection Of Resources
  • https://www.peerlyst.com/posts/how-to-build-and-run-a-soc-for-incident-response-and-enterprise-defensibility-a-collection-of-resources
• Chepy is a python library with a handy cli that is aimed to mirror some of the capabilities of CyberChef
  • https://github.com/securisec/chepy
• A First Responder Released for the HIVE Project
  • https://blog.agood.cloud/posts/2019/11/28/releasing-my-first-responder-for-thehive/
• ATT&CK Website Docker
  • https://blacksmith.readthedocs.io/en/latest/attack_website_docker.html

Breaches, Government, and Law Enforcement 

• International Crackdown on Imminent Monitor RAT
  • https://www.europol.europa.eu/newsroom/news/international-crackdown-rat-spyware-which-takes-total-control-of-victims%E2%80%99-pcs
• Adobe Discloses Breach Impacting Magento Marketplace
  • https://magento.com/blog/magento-news/magento-marketplace-security-update
• $48 million in Ethereum Stolen from Upbit
  • https://upbit.com/service_center/notice
• Former Executives and Employees of Health Technology Start-Up Charged in a $1 Billion Scheme to Defraud Clients, Lenders and Investors
  • https://www.justice.gov/opa/pr/former-executives-and-employees-health-technology-start-charged-1-billion-scheme-defraud
• Pressure mounts for federal privacy law with second bill
  • https://nakedsecurity.sophos.com/2019/11/29/pressure-mounts-for-federal-privacy-law-with-second-bill/

Vulnerabilities and Exploits

• US-CERT Bulletin (SB19-329) – Vulnerability Summary for the Week of November 18, 2019
  • https://www.us-cert.gov/ncas/bulletins/sb19-329
• Patched GIF Processing Vulnerability CVE-2019-11932 Still Afflicts Multiple Mobile Apps
  • https://blog.trendmicro.com/trendlabs-security-intelligence/patched-gif-processing-vulnerability-cve-2019-11932-still-afflicts-multiple-mobile-apps/
• Long-known Vulnerabilities in High-Profile Android Applications
  • https://research.checkpoint.com/2019/long-known-vulnerabilities-in-high-profile-android-applications/