Brad · @malware_traffic
2195 followers · 103 posts · Server infosec.exchange
Original version at: https://twitter.com/Unit42_Intel/status/1617672614792642560
2023-01-23 (Monday) - Google ad led to a fake AnyDesk page. Distributed malicious .msi package first reported to VirusTotal in December 2022. This malware contacts a domain associated with #TA505 infrastructure from 2020. Indicators available at https://github.com/pan-unit42/tweets/blob/master/2023-01-23-IOCs-for-Google-ad-for-possible-TA505-activity.txt
Additional info:
The reason this might be TA505 is because download-cdn[.]com is a domain associated with TA505 infrastructure from 2020 and older. I'm not sure if the same threat actor has revived it, or if someone else grabbed it instead.
The final C2 traffic uses tcp://64.190.113[.]123:443/ and might be some sort of VNC activity.
If anyone can shed some light on it, feel free to reply! I just wanted to get the information out quickly.
Malwar3Ninja | Threatview.io · @Malwar3Ninja
149 followers · 47 posts · Server infosec.exchange
[Threatview.io]🌀 Our proactive hunter detected malicious #zoom download site distributing #TA505 malware
⚠️zoomapp[.]tech
🚫c2: download-cdn[.]com
⚙️tria.ge/230123-hmkksad…
#zoom #ta505 #malware #threatintel #dfir #cti #cybersecurity
Malwar3Ninja | Threatview.io · @Malwar3Ninja
149 followers · 47 posts · Server infosec.exchange[Threatview.io]🌀 Our proactive hunter detected malicious #zoom download site distributing #TA505 malware
⚠️zoomapp[.]tech
🚫c2: download-cdn[.]com
⚙️tria.ge/230123-hmkksad…
#zoom #ta505 #malware #threatintel #dfir #cti #cybersecurity
ITSEC News · @itsecbot
988 followers · 32791 posts · Server schleuss.onlineBreaking the silence - Recent Truebot activity - Since August 2022, we have seen an increase in infections of Truebot (aka Silence.... https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ #cve-2022-31199 #raspberryrobin #truebot #botnet #grace #ta505
#ta505 #grace #botnet #truebot #RaspberryRobin #cve
ITSEC News · @itsecbot
988 followers · 32788 posts · Server schleuss.onlineNew Ransom Payment Schemes Target Executives, Telemedicine - Ransomware groups are constantly devising new methods for infecting victims and co... https://krebsonsecurity.com/2022/12/new-ransom-payment-schemes-target-executives-telemedicine/ #venusransomware #thecomingstorm #clopransomware #holdsecurity #webfraud2.0 #fabianwosar #ransomware #alexholden #emsisoft #tripwire #ta505 #cl0p
#cl0p #ta505 #tripwire #emsisoft #alexholden #ransomware #fabianwosar #webfraud2 #holdsecurity #clopransomware #thecomingstorm #venusransomware
ITSEC News · @itsecbot
856 followers · 32557 posts · Server schleuss.online
Signed MSI files, Raccoon and Amadey are used for installing ServHelper RAT - By Vanja Svajcer.
News summaryGroup TA505 has been active for at least seven years... http://feedproxy.google.com/~r/feedburner/Talos/~3/gYniZMcoDBU/raccoon-and-amadey-install-servhelper.html #securex #stealer #threats #trojans #ta505
#ta505 #trojans #threats #stealer #securex
ITSEC News · @itsecbot
687 followers · 32461 posts · Server schleuss.online
FIN11 Cybercrime Gang Shifts Tactics to Double-Extortion Ransomware - The Clop ransomware has become a tool of choice for the financially motivated group. https://threatpost.com/fin11-gang-double-extortion-ransomware/160089/ #financiallymotivated #doubleextortion #shiftingtactics #leakeddata #ransomware #mandiant #malware #breach #fin11 #ta505 #clop
#clop #ta505 #fin11 #breach #malware #mandiant #ransomware #leakeddata #shiftingtactics #doubleextortion #financiallymotivated
ITSEC News · @itsecbot
687 followers · 32461 posts · Server schleuss.online
TA505 Crime Gang Deploys SDBbot for Corporate Network Takeover - The custom RAT offers persistent access, data exfiltration and lateral network movement. more: https://threatpost.com/ta505-crime-gang-sdbbot-corporate-network-takeover/154779/ #remoteaccesstrojan #dataexfiltration #activedirectory #maliciousemails #malwareanalysis #custommalware #websecurity #cyberattack #ibmx-force #hive0065 #malware #onehub #sdbbot #ta505 #rat
#rat #ta505 #sdbbot #onehub #malware #hive0065 #ibmx #cyberattack #websecurity #custommalware #malwareanalysis #maliciousemails #activedirectory #dataexfiltration #remoteaccesstrojan