#phishing m365 🇮🇹 targeting energy & renewable companies - 🚹landing on onenote of compromised m365 account of 850 employees oil&gas (dm for url) - 🐟s://mangotech.cloud/me/ JAMESWT illegalFawn phishunt.io PhishingKitTracker  IPAE!

[1/3] multi stage #stego campaign vs #italy 🇮🇹 leads to #xworm rat via #andeloader (h/t hi tag: spam-ita JAMESWT ) mail > 7z > js > ps1 > ande loader from #stego image from archive[.org > b64 #xworm payload from paste[.ee > msbuild.exe possible #BlindEagle apt-c-36 ? 🤔

Apt spotted 💯💪

Qilin Decryptor? f910b2a6d84d0677cda9aefabfa4a45863ba51a8831588e3b527e8e1d3a9927c

#MintsLoader > #PEC #Italy 👇 brettesxes.]com/1.php?s=flibabc12 abckdkfkgdjnkhe.]top/zeqvk8x13ghtr.php Samples👇 lc4m bazaar.abuse.ch/browse/tag/abc… #MintsLoader #Spain geronimo.]website/1.php?s=flibabc12 glmhhdcmgcfddbk.]top/upow4fi5hvhtr.php ❇️Summary bazaar.abuse.ch/browse/tag/185…

#pxastealer 🇻🇳 targeting 🇮🇹 Cisco Talos Intelligence Group malware_traffic cert_lu Cert AgID Gianni Amato JAMESWT MalwareHunterTeam H/t: ܛܔܔܔܛܔܛܔܛ

"RE: TOURS BOOKING" #booking spam email spread #RemCosRat ⛔️C2 178.215.236.]251:2727 #AgentTesla ⛔️ExFil Smtp > sendxambro@educt.]shop Sample👇 bazaar.abuse.ch/sample/41d9c5a… Kelsey Mikhail Kasimov ܛܔܔܔܛܔܛܔܛ

3/ Sandy Nguyen (Bullish Gopher) a DPRK ITW from this cluster was spotted via OSINT next to the North Korea flag at an event in Russia. A small group of people still believe North Korean devs are just a conspiracy despite all of the IOCs, research, etc widely available.

🚨New #Ransomware Group : Sinobi🚨 Clear: blog[.sinobi.us[.org/leaks Onion: sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd[.onion/leaks sinobi6rlec6f2bgn6rd72xo7hvds4a5ajiu2if4oub2sut7fg3gomqd[.onion/leaks

not #MalwareChallenge but #DLLsideloading abuse of signed EXE 😎 📷 Cryptolaemus ExecuteMalware hazmalware James JAMESWT_MHT Joe Roosen James Quinn lc4m MalwareHunterTeam Microsoft Threat Intelligence John Lambert neonprimetime ps66uk Racco42 Nilanjana Hugo Rifflet Hash Miser

Reminder everyone that time and time again its individual/crowdsourced effort that safes our internet. Individual People like those behind: abuse.ch Malpedia Squiblydoo vx-underground Use their hobby, free time, money and much more just to make our world safer.

SAP, are you awake?

🫤🥺 Sap..

Quck analysis of new #ToolShell payload observed by LeakIX: Paylaod is a .dll executed in memory. Sha-256: 3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997 It collects System Info and the sensitive machine key. Sends back in response. Single Request takeover.