#Horabot dirigido a empresas de México 🇲🇽
.ZIP > .HTML > .RAR > .CMD > .PS1

Los correos phishing son enviados desde dominios temporary[.]link y traen adjunto un archivo .HTML (comprimido en un .ZIP) que inicia la descarga maliciosa.

Los archivos .HTML incluyen el nombre de la…

Lockbit 4.0 is Loading ... 🔐Lockbit released a lengthy response for the FBI and others

'The only thing that motivates me to work is strong competitors and the FBI' 🤡

You can read the full post here: samples.vx-underground.org/tmp/Lockbit_St… (via: vx-underground )

#DarkWeb #LockBit

This threat documented by #Kaspersky has occurred since July/2023.

Initial Access: Spearphishing Link
Delivery URL: ja2r7[.]app[.]goo[.]gl/
First IOC: 974c83e028c5adc3c79b8f99f24cfb5e2013f108fd7259bd6a2385c35f9d8a70

#trojan #banker #Coyote #Brazil

securelist.com/coyote-multi-s…

FAVIHUNTER

Generate search queries by URL for searching favicons in:

FOFA
ZoomEye
Shodan
Criminal IP
Censys
ODIN

github.com/eremit4/favihu…

Creators Padawan _eremit4

APT Kimsuky/Black Banshee infra setup 💁🏻‍♂️

/cloudown.store
/27.255.81.120
/27.255.81.82
/27.255.81.108
/27.255.75.154

Fake 404 Not Found page

Exposed, the forum designed to be the replacement to Breached, is for sale.

Meanwhile, Breached forum has returned. The previous owner who worked in conjunction with Pompompurin, Baphomet, is now working alongside the infamous ShinyHunters group.

Intel via Andrea (Drego) Draghetti 👨🏻‍💻 🎣

🍎 New from the front lines! The development of a Go implementation of Cobalt Strike called ‘Geacon’ appears to be bringing Cobalt Strike capabilities to macOS threat actors. By Phil Stokes ⫍🐠⫎

Read our latest blog post: sentinelone.com/blog/geacon-br…

2023-05-10 (Wednesday): obama262 #Qakbot ( #Qbot ) infection led to #BackConnect activity on 46.151.30[.]109:443 with #DarkCatVNC . Also saw #CobaltStrike from this infection using HTTPS traffic to floatfil[.]com. IOCs available at bit.ly/3nWvIDo

QackBot infra 🎯

Hunting rule 👇

http.html_hash:501510358 ssl.jarm:'21d14d00021d21d21c42d43d0000007abc6200da92c2a1b69c0a56366cbe21'

shodan.io/search?query=h…

Happy Hunting! 🎯

🤣

The Battle of BreachedForums, 2023, colorized

🔎 #ThreatHunting #Tip Check these sites for signs of data exfiltration by LockBit Ransomware affiliates (and others!):

File-sharing sites 🔥
premiumize[.]com
anonfiles[.]com
sendspace[.]com
fex[.]net
transfer[.]sh
send.exploit[.]in