Our monthly Intelligence Insight for December is out!

Highlighted topics this month are #YellowCockatoo (aka #Solarmarker aka #JupyterInfostealer), and recent changes to #Gootloader TTPs.

https://redcanary.com/blog/intelligence-insights-december-2022/

Our monthly Intelligence Insight for December is out!

Highlighted topics this month are #YellowCockatoo (aka #Solarmarker aka #JupyterInfostealer), and recent changes to #Gootloader TTPs.

https://redcanary.com/blog/intelligence-insights-december-2022/

Whoa. You can use OpenAI to deobfuscate #malware. Here's a chunk of old #Solarmarker, which it correctly summarized. #Infosec

The #sczriptzzbn campaign which normally delivers #netsupportRAT, #solarmarker or #icedID is currently redirecting to a tech support scam :blobeyes:​

friscomusicgroup[.]com/br2

existsupport22[.]z13[.]web[.]core[.]windows[.]net

This awesome blog about #SolarMarker / #YellowCockatoo / #Jupyter infostealer by Squiblydoo doubles as a really great beginner #powershell walk through from a blue team perspective. They provide easy to spot red flags, and explain how to break down a script into digestible pieces.

https://squiblydoo.blog/2022/09/27/solarmarker-the-old-is-new/