Summary

*Note: Security Soup is back following a vacation to rest and recharge! As always, thanks for reading…

— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

COFENSE Q3 2019 MALWARE TRENDS (Report requires registration)
- https://cofense.com/whats-malware-find-q3-report/
Ransomware: The Nightmare Before Cyber Monday
- https://go.forrester.com/blogs/ransomware-the-nightmare-before-cyber-monday/
Oracle launches Internet Intelligence IXP Filter Check – a free tool to designed for secure routing
- https://www.internetsociety.org/blog/2019/10/securing-the-internet-introducing-oracle-internet-intelligence-ixp-filter-check/
Advisory: Turla group exploits Iranian APT to expand coverage of victims
- https://www.ncsc.gov.uk/news/turla-group-exploits-iran-apt-to-expand-coverage-of-victims
RiskIQ’s Q2 2019 Mobile Threat Landscape Report (Report requires registration)
- https://www.riskiq.com/blog/external-threat-management/q2-2019-mobile-threat-landscape/
A Look at the Pricing of Cybercrime Goods and Services (Report requires registration)
- https://www.flashpoint-intel.com/blog/a-look-at-the-pricing-of-cybercrime-goods-services/
Joker’s Stash Upgrades With Large SSN Offering and Support Infrastructure
- https://www.recordedfuture.com/jokers-stash-infrastructure/
APT trends report Q3 2019
- https://securelist.com/apt-trends-report-q3-2019/94530/
Claims of a Cyber Attack on Iran’s Abadan Oil Refinery and the Need for Root Cause Analysis
- https://dragos.com/blog/industry-news/claims-of-a-cyber-attack-on-irans-abadan-oil-refinery-and-the-need-for-root-cause-analysis/
Mobile Malware and APT Espionage: Prolific, Pervasive, and Cross-Platform
- https://threatvector.cylance.com/en_us/home/mobile-malware-and-apt-espionage-prolific-pervasive-and-cross-platform.html
Week in OSINT #2019–42
- https://medium.com/week-in-osint/week-in-osint-2019-42-51408fd9bb2
Typosquatting and the 2020 U.S. Presidential election: Cyberspace as the new political battleground
- https://www.digitalshadows.com/blog-and-research/typosquatting-and-the-2020-u-s-presidential-election/
Burning and bridges — Insights into NSA and NCSC Joint Report on Turla Group
- https://medium.com/@horkos/burning-and-bridges-c92531b0e8a0

Threat Research – Malware, Phishing, and other Campaigns in the Wild

Warning of Serious DDoS Blackmail Campaigns Attributed to Fancy Bear Group
- https://www.link11.com/en/blog/warning-of-serious-ddos-blackmail-campaigns-attributed-to-fancy-bear-group/
New Variant of Remcos RAT Observed In the Wild
- https://www.fortinet.com/blog/threat-research/new-variant-of-remcos-rat-observed-in-the-wild.html
Exploring a link between Magecart Group 5 and the Carbanak APT
- https://blog.malwarebytes.com/threat-analysis/2019/10/the-forgotten-domain-exploring-a-link-between-magecart-group-5-and-the-carbanak-apt/
Winnti Group’s skip‑2.0: A Microsoft SQL Server backdoor
- https://www.welivesecurity.com/2019/10/21/winnti-group-skip2-0-microsoft-sql-server-backdoor/
Peeling the Netwire Onion
- https://www.fidelissecurity.com/threatgeek/threat-intelligence/netwire-rat/
AutoIT-compiled Negasteal/Agent Tesla, Ave Maria Delivered via Malspam
- https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-negasteal-agent-tesla-ave-maria-delivered-via-malspam/
Pony’s C&C servers hidden inside the Bitcoin blockchain
- https://research.checkpoint.com/ponys-cc-servers-hidden-inside-the-bitcoin-blockchain/
Gustuff return, new features for victims
- https://blog.talosintelligence.com/2019/10/gustuffv2.html
Hunting Raccoon: The New Masked Bandit on the Block
- https://www.cybereason.com/blog/hunting-raccoon-stealer-the-new-masked-bandit-on-the-block
Ransomware Goes Fileless, Uses Malicious Documents and PowerShell to Encrypt Files
- https://www.bromium.com/ransomware-goes-fileless-uses-malicious-documents-and-powershell-to-encrypt-files/
Shikata Ga Nai Encoder Still Going Strong
- https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html
Emotet, an Analysis of TTP’s: Part II For the Watch
- https://laskowski-tech.com/2019/10/22/emotet-and-analysis-of-ttps-part-ii-for-the-watch/
Emotet_network_protocol
- https://d00rt.github.io/emotet_network_protocol/
Exploring Emotet, and Elaborate Everyday Enigma
- https://www.virusbulletin.com/uploads/pdf/magazine/2019/VB2019-Nagy.pdf

Tools and Tips

Detecting SharePoint attacks via worker process activity
- https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/
Best Practices for Defanging Social Media Phishing Attacks
- https://info.phishlabs.com/blog/best-practices-for-defanging-social-media-phishing-attacks
Understanding APIs: SOAP
- https://swimlane.com/blog/understanding-apis-soap/
Blue Hands On Bloodhound
- https://insinuator.net/2019/10/blue-hands-on-bloodhound/
Web Browser Forensics: Investigating The Browser For Evidence
- https://netseedblog.com/security/web-browser-forensics-investigating-the-browser-for-evidence/
Unpacking Malware Series – Maze Ransomware
- https://poxyran.github.io/poxyblog/src/pages/22-10-2019-unpacking-malware-series-maze-ransomware.html
The ThreatHunting Project: Hunting for adversaries in your IT environment
- https://www.threathunting.net/

Breaches, Government, and Law Enforcement

Second Ransomware Attack Strikes Johannesburg
- https://www.darkreading.com/operations/second-ransomware-attack-strikes-johannesburg/d/d-id/1336175
Czech authorities dismantle alleged Russian cyber-espionage network
- https://www.zdnet.com/article/czech-authorities-dismantle-alleged-russian-cyber-espionage-network/
NordVPN Confirms 3rd-party Breach
- https://nordvpn.com/blog/official-response-datacenter-breach/
Chinese National Sentenced to 40 Months in Prison for Conspiring to Illegally Export Military- and Space-Grade Technology from the United States to China
- https://www.justice.gov/opa/pr/chinese-national-sentenced-40-months-prison-conspiring-illegally-export-military-and-space
Democrats offer cybersecurity bill for ‘internet of things’
- https://thehill.com/policy/cybersecurity/466996-democrats-offer-cybersecurity-bill-for-internet-of-things
Ransomware Hits B2B Payments Firm Billtrust
- https://krebsonsecurity.com/2019/10/ransomware-hits-b2b-payments-firm-billtrust/
In a rare move, Moody’s says it’s paying close attention to Pitney Bowes ransomware attack
- https://www.cnbc.com/amp/2019/10/16/moodys-credit-negative-note-on-pitney-bowes-after-ransomware-attack.html

Vulnerabilities and Exploits

NGINX + CIS Hardened Images Provide Security at Maximum Efficiency
- https://www.cisecurity.org/blog/nginx-cis-hardened-images-provide-security-at-maximum-efficiency/
Nasty PHP7 remote code execution bug exploited in the wild
- https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/
Throwback Threat Thursday: JCE Vulnerability
- https://blog.sucuri.net/2019/10/throwback-threat-thursday-jce-vulnerability.html
TCP SACK Security Issue in OpenBSD – CVE-2019-8460
- https://research.checkpoint.com/tcp-sack-security-issue-in-openbsd-cve-2019-8460/
Bulletin (SB19-294): Vulnerability Summary for the Week of October 14, 2019
- https://www.us-cert.gov/ncas/bulletins/sb19-294

Weekly News Roundup — October 20 to October 26