FedSearch - Federated network search engine

Just Another Blue Teamer · @LeeArchinal

121 followers · 182 posts · Server ioc.exchange

Good day everyone! The ReliaQuest Threat Research team recently provided a wrap up of the most commonly used loaders, the top 80% which comprised of only three different malware! These big three are #QBot, #SocGholish, and #RaspberryRobin. THEN, they not only provided the data sheet to provide to your management or C-suite, they broke them down even further to include technical details as well! Thank you to the Threat Research team for such a great report, I hope you enjoy it as much as I did, and Happy Hunting!

The 3 Malware Loaders Behind 80% of Incidents
https://www.reliaquest.com/blog/the-3-malware-loaders-behind-80-of-incidents/

#CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

#qbot #SocGholish #RaspberryRobin #cybersecurity #itsecurity #infosec #blueteam #threatintel #threathunting #ThreatDetection #happyhunting #readoftheday

Last updated 1 year ago

Original post

Aida Akl · @AAKL

261 followers · 439 posts · Server noc.social

#RaspberryRobin #Malware Adopts Unique Evasion Techniques #cybersecurity https://www.infosecurity-magazine.com/news/raspberry-robin-adopts-unique/

#cybersecurity #malware #RaspberryRobin

Last updated 1 year ago

Original post

Opalsec :verified: · @Opalsec

59 followers · 26 posts · Server infosec.exchange

I've read and analysed last week's infosec news, so you don't have to - get up to speed on the latest in hacks, malware, tradecraft and more with this week's newsletter:

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-d72?sd=pf

A vulnerability in the widely-used, open-source JsonWebToken package has highlighted the continued reliance on vendors for supply chain security.

It's not just APTs - cyber crims are eyeing off kernel space, with #ScatteredSpider/#UNC3944 abusing the #BYOVD technique in an attempt to load their malicious driver into kernel space and subvert EDR controls.

We take a look at research into #RaspberryRobin infrastructure - it's multi-tiered, growing, and highly flexible...but also vulnerable to takeover. Will this be the next #Andromeda, still spreading and hijacked by a 3rd-party in 10 years time?

#Fortinet warns an unknown, stealth-conscious actor with a "deep understanding of #FortiOS" has been seen exploiting the month-old FortiOS vulnerability (CVE-2022-42475) to drop additional malware & subvert logging.

There's a tonne more interesting reporting and tradecraft that I can't get to in this post, but you can find them in the newsletter - check it out, and subscribe to get the latest issues straight to your inbox, and support my work!

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-d72?sd=pf

#infosec #CyberAttack #Hacked #cyber #news #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #redteam #soc

#scatteredspider #byovd #RaspberryRobin #andromeda #fortinet #fortios #infosec #cyberattack #hacked #cyber #news #cybernews #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #redteam #soc

Last updated 2 years ago

Original post

Anonymous :verified_neko:🏴 · @YourAnonRiots

5102 followers · 29443 posts · Server mstdn.social

The Hacker News - New Analysis Reveals Raspberry Robin Can be Repurposed by Other Threat Actors

A new analysis reveals that #RaspberryRobin's attack infrastructure can be repurposed by other threat actors for their own malicious activities, making it an even greater threat to watch out for.

https://thehackernews.com/2023/01/new-analysis-reveals-raspberry-robin.html

#infosec #cybersecurity #hacking #cyberattack #tech

#Tech #CyberAttack #Hacking #CyberSecurity #InfoSec #RaspberryRobin

Last updated 2 years ago

Original post

Aida Akl · @AAKL

171 followers · 738 posts · Server noc.social

New Analysis Reveals #RaspberryRobin Can be Repurposed by Other Threat Actors #cybersecurity https://thehackernews.com/2023/01/new-analysis-reveals-raspberry-robin.html @thehackernews

#cybersecurity #RaspberryRobin

Last updated 2 years ago

Original post

Germán Fernández :verified: · @1ZRR4H

73 followers · 17 posts · Server infosec.exchange

Open media

#RaspberryRobin 🪱 (REF: https://blog.sekoia.io/raspberry-robins-botnet-second-life/)

'Clean' C2 domains:
/a7k.ro
/a5az.com
/v4a3.com
/4w.pm
/hlv1.com
/ubv5.com
/c43p.com
/2ipn.com

'Clean' compromised QNAP:
151.83.67.5
84.97.18.146
88.130.94.229
188.10.57.97

'New' exploited QNAP:
61.93.39.13
94.14.45.160

#EvilCorp

#RaspberryRobin #evilcorp

Last updated 2 years ago

Original post

Opalsec :verified: · @Opalsec

53 followers · 26 posts · Server infosec.exchange

Catch up on last week's infosec news with our latest newsletter: https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-538

#RaspberryRobin continues to improve its evasion mechanisms, extracting more data from victims in the Financial sector.

#Dridex developers look to be dabbling in creating a Mac variant - but aren't quite there yet.

#HTMLSmuggling is being used increasingly over the past few months by heavy-hitting first stage malware such as Qakbot, IcedID and BumbleBee - make sure you understand how it works and how to spot it.

#infosec #CyberAttack #Hacked #cyber #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities

#RaspberryRobin #dridex #htmlsmuggling #infosec #cyberattack #hacked #cyber #cybernews #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities

Last updated 2 years ago

Original post

Anonymous :verified_neko:🏴 · @YourAnonRiots

5065 followers · 29302 posts · Server mstdn.social

The Hacker News - Raspberry Robin Worm Evolves to Attack Financial and Insurance Sectors in Europe

#RaspberryRobin worm is targeting financial and insurance sectors in Europe, and has evolved its post-exploitation capabilities to resist analysis and collect more data from infected computers.

https://thehackernews.com/2023/01/raspberry-robin-worm-evolves-to-attack.html

#infosec #technology #hacking #malware

#Malware #Hacking #Technology #InfoSec #RaspberryRobin

Last updated 2 years ago

Original post

Sova · @sova

9 followers · 51 posts · Server infosec.exchange

How #telecoms aren't blocking #Tor and controlling USB devices is beyond me. However, that is how a worm is spreading in Latin America and Europe right now. #RaspberryRobin

https://securityaffairs.co/wordpress/139964/breaking-news/raspberry-robin-targets-telecom-governments.html

#telecoms #tor #RaspberryRobin

Last updated 2 years ago

Original post

Anonymous :verified_neko:🏴 · @YourAnonRiots

4902 followers · 28711 posts · Server mstdn.social

The Hacker News - Raspberry Robin Worm Strikes Again, Targeting Telecom and Government Systems

#RaspberryRobin worm has been attacking telecommunications and government systems across Latin America, Australia, and Europe.

https://thehackernews.com/2022/12/raspberry-robin-worm-strikes-again.html

#infosec #hacking #cyberattack #malware #technology #cybersecurity

#CyberSecurity #Technology #Malware #CyberAttack #Hacking #InfoSec #RaspberryRobin

Last updated 2 years ago

Original post

Anonymous :verified_neko:🏴 · @YourAnonRiots

4972 followers · 28930 posts · Server mstdn.social

The Hacker News - Raspberry Robin Worm Strikes Again, Targeting Telecom and Government Systems

#RaspberryRobin worm has been attacking telecommunications and government systems across Latin America, Australia, and Europe.

https://thehackernews.com/2022/12/raspberry-robin-worm-strikes-again.html

#infosec #hacking #cyberattack #malware #technology #cybersecurity

#CyberSecurity #Technology #Malware #CyberAttack #Hacking #InfoSec #RaspberryRobin

Last updated 2 years ago

Original post

AA · @AAKL

151 followers · 2491 posts · Server noc.social

#RaspberryRobin worm drops fake #malware to confuse researchers #cybersecurity https://www.bleepingcomputer.com/news/security/raspberry-robin-worm-drops-fake-malware-to-confuse-researchers/ @BleepingComputer @billtoulas

#cybersecurity #malware #RaspberryRobin

Last updated 2 years ago

Original post

arb0ur · @arb0ur

10 followers · 4 posts · Server infosec.exchange

I've published a blog post examining the malware distribution behaviours in Microsoft's recent reporting of Raspberry Robin. The post intends to help analysts make sense of the loader landscape.

https://arb0ur.substack.com/p/examining-malware-distribution-behaviours

#loader #raspberryrobin #evilcorp #wizardspider

#loader #RaspberryRobin #evilcorp #WizardSpider

Last updated 2 years ago

Original post