Good day all! The Computer Emergency Response Team of Ukraine, CERT-UA reports on a targeted attack attributed to #APT28 they observed on critical energy infrastructure facility in Ukraine. It started with a #phishing email that contained a link to an archive that led to a downloaded zip file that contained three decoy JPGs and a bat file that would run on the victims computer. The BAT file would, again, open some decoy web pages, but more importantly would create a .bat and .vbs file. There was some discovery commands issued, TOR program downloaded and hidden on the victim's computer as a hidden service, and abused common ports (445,389,3389,443). Last but not least, a PowerShell script was used to collect the password hash of the account. Enjoy and Happy Hunting!
https://cert.gov.ua/article/5702579
#CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #CERTUA
#apt28 #phishing #cybersecurity #itsecurity #infosec #blueteam #threatintel #threathunting #ThreatDetection #happyhunting #readoftheday #certua
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Asec: Threat Trend Report on APT Groups – June 2023 https://asec.ahnlab.com/en/56195/ #CharmingKitten #StealthSoldier #CadetBlizzard #CamaroDragon #MustangPanda #MuddyWater #OceanLotus #SharpPanda #Gamaredon #Patchwork #Andariel #Ke3chang #Sidecopy #Kimsuky #Lazarus #RedEyes #trend #APT28
#charmingkitten #stealthsoldier #cadetblizzard #camarodragon #mustangpanda #muddywater #oceanlotus #sharppanda #gamaredon #patchwork #andariel #ke3chang #sidecopy #kimsuky #lazarus #redeyes #trend #apt28
Hackmageddon: 16-30 June 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/01/16-30-june-2023-cyber-attacks-timeline/ #CyberAttacksTimelines #PBIResearchServices #AnonymousSudan #CVE-2023-34362 #CyberEspionage #NoName057(16) #CyberAttacks #CyberWarfare #LazarusGroup #MustangPanda #CyberCrime #Hacktivism #Ransomware #Security #JokerSpy #Timeline #REF9134 #MOVEit #APT15 #APT28 #APT29 #APT37 #2023 #Cl0p #Clop #June
#cyberattackstimelines #pbiresearchservices #anonymoussudan #cve #cyberespionage #noname057 #cyberattacks #cyberwarfare #lazarusgroup #mustangpanda #cybercrime #hacktivism #ransomware #security #jokerspy #timeline #ref9134 #moveit #apt15 #apt28 #apt29 #apt37 #cl0p #clop #june
Hackmageddon: 16-30 June 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/01/16-30-june-2023-cyber-attacks-timeline/ #CyberAttacksTimelines #PBIResearchServices #AnonymousSudan #CVE-2023-34362 #CyberEspionage #NoName057(16) #CyberAttacks #CyberWarfare #LazarusGroup #MustangPanda #CyberCrime #Hacktivism #Ransomware #Security #JokerSpy #Timeline #REF9134 #MOVEit #APT15 #APT28 #APT29 #APT37 #2023 #Cl0p #Clop #June
#cyberattackstimelines #pbiresearchservices #anonymoussudan #cve #cyberespionage #noname057 #cyberattacks #cyberwarfare #lazarusgroup #mustangpanda #cybercrime #hacktivism #ransomware #security #jokerspy #timeline #ref9134 #moveit #apt15 #apt28 #apt29 #apt37 #cl0p #clop #june
Hackmageddon: 16-30 June 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/01/16-30-june-2023-cyber-attacks-timeline/ #CyberAttacksTimelines #PBIResearchServices #AnonymousSudan #CVE-2023-34362 #CyberEspionage #NoName057(16) #CyberAttacks #CyberWarfare #LazarusGroup #MustangPanda #CyberCrime #Hacktivism #Ransomware #Security #JokerSpy #Timeline #REF9134 #MOVEit #APT15 #APT28 #APT29 #APT37 #2023 #Cl0p #Clop #June
#cyberattackstimelines #pbiresearchservices #anonymoussudan #cve #cyberespionage #noname057 #cyberattacks #cyberwarfare #lazarusgroup #mustangpanda #cybercrime #hacktivism #ransomware #security #jokerspy #timeline #ref9134 #moveit #apt15 #apt28 #apt29 #apt37 #cl0p #clop #june
Hackmageddon: 16-30 June 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/01/16-30-june-2023-cyber-attacks-timeline/ #CyberAttacksTimelines #PBIResearchServices #AnonymousSudan #CVE-2023-34362 #CyberEspionage #NoName057(16) #CyberAttacks #CyberWarfare #LazarusGroup #MustangPanda #CyberCrime #Hacktivism #Ransomware #Security #JokerSpy #Timeline #REF9134 #MOVEit #APT15 #APT28 #APT29 #APT37 #2023 #Cl0p #Clop #June
#cyberattackstimelines #pbiresearchservices #anonymoussudan #cve #cyberespionage #noname057 #cyberattacks #cyberwarfare #lazarusgroup #mustangpanda #cybercrime #hacktivism #ransomware #security #jokerspy #timeline #ref9134 #moveit #apt15 #apt28 #apt29 #apt37 #cl0p #clop #june
Hackmageddon: 16-30 June 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/01/16-30-june-2023-cyber-attacks-timeline/ #CyberAttacksTimelines #PBIResearchServices #AnonymousSudan #CVE-2023-34362 #CyberEspionage #NoName057(16) #CyberAttacks #CyberWarfare #LazarusGroup #MustangPanda #CyberCrime #Hacktivism #Ransomware #Security #JokerSpy #Timeline #REF9134 #MOVEit #APT15 #APT28 #APT29 #APT37 #2023 #Cl0p #Clop #June
#cyberattackstimelines #pbiresearchservices #anonymoussudan #cve #cyberespionage #noname057 #cyberattacks #cyberwarfare #lazarusgroup #mustangpanda #cybercrime #hacktivism #ransomware #security #jokerspy #timeline #ref9134 #moveit #apt15 #apt28 #apt29 #apt37 #cl0p #clop #june
Hackmageddon: 16-30 June 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/01/16-30-june-2023-cyber-attacks-timeline/ #CyberAttacksTimelines #PBIResearchServices #AnonymousSudan #CVE-2023-34362 #CyberEspionage #NoName057(16) #CyberAttacks #CyberWarfare #LazarusGroup #MustangPanda #CyberCrime #Hacktivism #Ransomware #Security #JokerSpy #Timeline #REF9134 #MOVEit #APT15 #APT28 #APT29 #APT37 #2023 #Cl0p #Clop #June
#cyberattackstimelines #pbiresearchservices #anonymoussudan #cve #cyberespionage #noname057 #cyberattacks #cyberwarfare #lazarusgroup #mustangpanda #cybercrime #hacktivism #ransomware #security #jokerspy #timeline #ref9134 #moveit #apt15 #apt28 #apt29 #apt37 #cl0p #clop #june
Hackmageddon: 16-30 June 2023 Cyber Attacks Timeline https://www.hackmageddon.com/2023/08/01/16-30-june-2023-cyber-attacks-timeline/ #CyberAttacksTimelines #PBIResearchServices #AnonymousSudan #CVE-2023-34362 #CyberEspionage #NoName057(16) #CyberAttacks #CyberWarfare #LazarusGroup #MustangPanda #CyberCrime #Hacktivism #Ransomware #Security #JokerSpy #Timeline #REF9134 #MOVEit #APT15 #APT28 #APT29 #APT37 #2023 #Cl0p #Clop #June
#cyberattackstimelines #pbiresearchservices #anonymoussudan #cve #cyberespionage #noname057 #cyberattacks #cyberwarfare #lazarusgroup #mustangpanda #cybercrime #hacktivism #ransomware #security #jokerspy #timeline #ref9134 #moveit #apt15 #apt28 #apt29 #apt37 #cl0p #clop #june