Summary

— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

Taxpayers Oppose Local Governments Paying Hackers in Ransomware Attacks
- https://newsroom.ibm.com/2019-09-05-IBM-Security-Study-Taxpayers-Oppose-Local-Governments-Paying-Hackers-in-Ransomware-Attacks
Purple Teaming ICS Networks: Part 3 of 3
- https://dragos.com/blog/industry-news/purple-teaming-ics-networks-part-3-of-3/
YouTube hit with $170M fine over children’s privacy
- https://www.politico.com/story/2019/09/04/google-youtube-fine-children-privacy-1588267
Who is Salty Spider (Sality)?
- https://www.crowdstrike.com/blog/who-is-salty-spider/
Ransomware Protection and Containment Strategies: Practical Guidance for Endpoint Protection, Hardening, and Containment
- https://www.fireeye.com/blog/threat-research/2019/09/ransomware-protection-and-containment-strategies.html
Week in OSINT #2019–35
- https://medium.com/week-in-osint/week-in-osint-2019-35-52d032d7d1d6
Revealed: How a secret Dutch mole aided the U.S.-Israeli Stuxnet cyberattack on Iran
- https://news.yahoo.com/revealed-how-a-secret-dutch-mole-aided-the-us-israeli-stuxnet-cyber-attack-on-iran-160026018.html
Using Threat data in your vulnerability management strategy with MISP
- https://www.ecrimelabs.com/blog/2019/9/2/using-threat-data-in-your-vulnerability-management-strategy

Threat Research – Malware, Phishing, and other Campaigns in the Wild

JSWorm: The 4th Version of the Infamous Ransomware
- https://blog.yoroi.company/research/jsworm-the-4th-version-of-the-infamous-ransomware/
Pardot CRM Attack
- https://www.netskope.com/blog/pardot-crm-attack
FunkyBot: A New Android Malware Family Targeting Japan
- https://www.fortinet.com/blog/threat-research/funkybot-malware-targets-japan.html
Spam Campaign Abuses PHP Functions for Persistence, Uses Compromised Devices for Evasion and Intrusion
- https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abuses-php-functions-for-persistence-uses-compromised-devices-for-evasion-and-intrusion/
UPSynergy: Chinese-American Spy vs. Spy Story
- https://research.checkpoint.com/upsynergy/
Malspam using password-protected Word docs to push Remcos RAT
- https://isc.sans.edu/forums/diary/Malspam+using+passwordprotected+Word+docs+to+push+Remcos+RAT/25292/
Seems Phishy: Back to School Lures Target University Students and Staff
- https://www.proofpoint.com/us/threat-insight/post/seems-phishy-back-school-lures-target-university-students-and-staff
PsiXBot Now Using Google DNS over HTTPS and Possible New Sexploitation Module
- https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module
Deobfuscating Ostap: TrickBot’s 34,000 Line JavaScript Downloader
- https://www.bromium.com/deobfuscating-ostap-trickbots-javascript-downloader/
TrickBot Modifications Target U.S. Mobile Users
- https://www.secureworks.com/blog/trickbot-modifications-target-us-mobile-users
https://inquest.net/blog/2019/08/30/YARA-For-Everyone-Rules-Will-Be-Rules

Tools and Tips

Malware Classification with ‘Graph Hash,’ Applied to the Orca Cyberespionage Campaign
- https://blog.trendmicro.com/trendlabs-security-intelligence/malware-classification-with-graph-hash-applied-to-the-orca-cyberespionage-campaign/
GhIDA: Ghidra decompiler for IDA Pro
- https://blog.talosintelligence.com/2019/09/ghida.html
SharPersist: Windows Persistence Toolkit in C#
- https://www.fireeye.com/blog/threat-research/2019/09/sharpersist-windows-persistence-toolkit.html
YARA For Everyone:Rules Will Be Rules
- https://inquest.net/blog/2019/08/30/YARA-For-Everyone-Rules-Will-Be-Rules
Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels
- https://github.com/mwrlabs/C3
Awesome Asset Discovery
- https://github.com/redhuntlabs/Awesome-Asset-Discovery
Sysmon 10.4 release
- https://medium.com/@olafhartong/sysmon-10-4-release-7f7480300dff

Breaches, Government, and Law Enforcement

Increased Funding Proposed for the DHS: Lawmakers offer bill to shore up federal cybersecurity
- https://thehill.com/policy/cybersecurity/459801-lawmakers-offer-bill-to-shore-up-federal-cybersecurity
XKCD forums breached
- https://nakedsecurity.sophos.com/2019/09/03/xkcd-forums-breached/
Manager at energy firm loses £200,000 after fraudsters use AI to impersonate his boss’s voice
- https://www.telegraph.co.uk/technology/2019/08/31/manager-energy-firm-loses-200000-fraudsters-use-ai-impersonate
Leader of new NSA Cybersecurity Directorate outlines threats, objectives
- https://www.csoonline.com/article/3435142/leader-of-new-nsa-cybersecurity-directorate-outlines-threats-objectives.amp.html

Vulnerabilities and Exploits

A Vulnerability in Exim Could Allow for Remote Command Execution
- https://www.cisecurity.org/advisory/a-vulnerability-in-exim-could-allow-for-remote-command-execution_2019-090/
Metasploit team releases BlueKeep exploit
- https://www.zdnet.com/article/metasploit-team-releases-bluekeep-exploit/
The latest on BlueKeep and DejaBlue vulnerabilities — Using Firepower to defend against encrypted DejaBlue
- https://blog.talosintelligence.com/2019/09/the-latest-on-bluekeep-and-dejablue.html
Supermicro Bug Could Let ‘Virtual USBs’ Take Over Corporate Servers
- https://www.wired.com/story/supermicro-bug-virtual-usb/

Weekly News Roundup — September 1 to September 7