shramanack
banner
shramanack.bsky.social
shramanack
@shramanack.bsky.social
Mixing Threat Intelligence with Criminal Sciences for Preventive Security & Cyber Counter-Intelligence | 10+ years of Tactical CTI | Entrepreneur | Cyberdefense Lecturer

#ThreatIntel #Criminology #Cyberwarfare
Reposted by shramanack
Some thoughts on one of the most interesting threat actors we have seen over the past few years; Predatory Sparrow - with @jamesshires.bsky.social and Hannah-Sophie Weber

bindinghook.com/articles-bin...
Predatory Sparrow: cyber sabotage with a conscience?
An understudied ‘hacktivist’ group conducts cyberattacks against Iran that clearly violate international norms – but claims to demonstrate ethical restraint
bindinghook.com
December 9, 2024 at 10:40 AM
(Recorded Future) #BlueAlpha (#Gamaredon Group / Primitive Bear) Abuses #Cloudflare Tunneling Service for #GammaDrop Staging Infrastructure : www.recordedfuture.com/research/blu...

#cyber #threatintel #malware
December 5, 2024 at 6:54 PM
December 5, 2024 at 6:46 PM
Reposted by shramanack
Second time we've seen Turla sit on top of someone else's operation. blog.lumen.com/snowblind-th...
Snowblind: The Invisible Hand of Secret Blizzard
blog.lumen.com
December 4, 2024 at 5:31 PM
(Github Security Advisory) Malware Advisory in the JavaScript SDK for building Solana apps for Node, web, and React Native: github.com/advisories/G...

#cyber #cryptocurrency #solana #malware #vulnerability #javascript
December 4, 2024 at 11:32 AM
(FBI) Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud : www.ic3.gov/PSA/2024/PSA...

#cyber #scam #genai
December 4, 2024 at 11:25 AM
Reposted by shramanack
🦝 The new episode of @intel471.bsky.social "Cybercrime Exposed" podcast produced by @jkirk.bsky.social tells the story of #Raccoon Stealer and, more broadly, reveals how the #infostealer ecosystem operates.

Featuring @crep1x.bsky.social from @sekoia.io!

intel471.com/resources/po...
Cybercrime Exposed Podcast: Raccoon Stealer
Intel 471 empowers cybersecurity teams worldwide to be proactive with its TITAN platform and comprehensive coverage into the criminal underground.
intel471.com
December 4, 2024 at 10:30 AM
Reposted by shramanack
Created a new repo to publish my MITRE ATT&CK mappings for when reports don't have a section on TTPs, hopefully useful for other defenders working on detection engineering & threat hunting.

github.com/BushidoUK/MI...
github.com
December 4, 2024 at 10:54 AM
Reposted by shramanack
Given fears that there may be new chemical attacks in Syria, here's a thread on some of the chemical munitions used in the past by the Syrian government. First, there's been two primary agents use, chlorine gas, and sarin, each associated with specific munitions.
December 3, 2024 at 9:33 AM
December 3, 2024 at 8:40 AM
December 3, 2024 at 8:35 AM
December 3, 2024 at 8:24 AM
Reposted by shramanack
Germany's domestic intelligence service (BfV) has created a special task force to counter cyberattacks, espionage, sabotage and disinformation campaigns ahead of federal elections in February. https://therecord.media/german-bfv-election-task-force-cyberattacks-disinformation
German intelligence launches task force to combat foreign election interference
Germany's domestic intelligence service (BfV) has created a special task force to counter cyberattacks, espionage, sabotage and disinformation campaigns ahead of federal elections in February.
therecord.media
December 2, 2024 at 2:44 PM
#APT35 Launches Attacks on Aerospace and Semiconductor Industries in Multiple Countries : threatbook.io/blog/id/1095

#cyber #threatintel #apt #UNC1549
December 2, 2024 at 2:14 PM
Reposted by shramanack
Reposted by shramanack
Microsoft has recently issued a warning about a large-scale spear-phishing campaign attributed to the notorious Russian state-sponsored threat actor known as Midnight Blizzard. #APT29 #CozyBear #MidnightBlizzard
zerosecurity.org/microsoft-wa...
Microsoft Warns of Russian Spear-Phishing Attacks
Midnight Blizzard's spear-phishing campaign targets thousands across government, defense, academia, NGOs; Microsoft warns of stolen data, persistent access risks.
zerosecurity.org
December 1, 2024 at 3:46 AM
Reposted by shramanack
Very interesting report from The DFIR Report about TA4557 #malware.
It helps to understand how #attackers performs their attacks and how #blueteam can respond against them.
I highly recommend SOC/CERT analysts to read this.

thedfirreport.com/2024/12/02/t...

#cybersecurity #detection #ioc
The Curious Case of an Egg-Cellent Resume
Key Takeaways Initial access was via a resume lure as part of a TA4557/FIN6 campaign. The threat actor abused LOLbins like ie4uinit.exe and msxsl.exe to run the more_eggs malware. Cobalt Strike and…
thedfirreport.com
December 2, 2024 at 12:28 PM
Improve Your Forensic Analyses with hashlookup -> www.foo.be/2024/09/Impr... #cyber #forensic #threatintel #misp
December 2, 2024 at 11:57 AM
Reposted by shramanack
"221 mobile phones, 258 hard drives, 495 SIM cards, 33 audio recording devices, 55 visual recording devices, 11 drones, 16 radios, 3 IMSI grabbers, […] Wi-Fi eavesdropping devices and jammers, and 75 passports and identity documents" 🕵️‍♂️
Man who spied for Russia in UK 'discussed killing journalist'
A UK-based spy ring allegedly passed secrets to Russia, a court has heard as a trial begins.
www.bbc.com
November 29, 2024 at 6:06 PM
Reposted by shramanack
"The networks are still compromised, and booting the hackers out could involve physically replacing “literally thousands and thousands and thousands of pieces of equipment across the country,” specifically outdated routers and switches" 🕵️‍♂️
Top senator calls Salt Typhoon ‘worst telecom hack in our nation’s history’
The severity of the Chinese breach highlights the need for more telecommunications regulation, lawmakers say.
www.washingtonpost.com
November 29, 2024 at 6:35 PM
By building communities and leveraging popular apps, #EvilBamboo created a self-sustaining engine of espionage. This is not just #malware distribution; it's a comprehensive assault on the trust model underpinning our digital society. #threatintel
EvilBamboo Targets Mobile Devices in Multi-year Campaign
Volexity has identified several long-running and currently active campaigns undertaken by the threat actor Volexity tracks as EvilBamboo (formerly named Evil Eye) targeting Tibetan, Uyghur, and Taiwan...
www.volexity.com
November 30, 2023 at 11:21 AM
Diamond Sleet's manipulation of a legitimate CyberLink installer embodies a disturbing trend in supply chain attacks. It's not just about the immediate breach; it's a chess move in a larger strategy, patiently and opportunistically positioning assets for later use. #threatintel #malware #apt
Diamond Sleet supply chain compromise distributes a modified CyberLink installer | Microsoft Securit...
Microsoft has uncovered a supply chain attack by the threat actor Diamond Sleet (ZINC) involving a malicious variant of an application developed by CyberLink Corp. This malicious file is a legitimate ...
www.microsoft.com
November 29, 2023 at 9:16 AM
#HrServ, the #webshell that's so sneaky, when you find it, you may find one of your missing socks too. #malware #apt #threatintel #crimeware
securelist.com/hrserv-apt-w...
HrServ web shell analysis
In this report Kaspersky researchers provide an analysis of the previously unknown HrServ web shell, which exhibits both APT and crimeware features and has likely been active since 2021.
securelist.com
November 28, 2023 at 5:33 PM