OSINT

LockBit 3.0 Ransomware Victim: mitr[.]com

July 5, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Alert: 330,000 FortiGate Firewalls Still Unpatched to CVE-2023-27997 RCE Flaw

July 5, 2023

No less than 330,000 FortiGate firewalls are still unpatched and vulnerable to CVE-2023-27997, a critical security flaw affecting Fortinet devices...

Mexico-Based Hacker Targets Global Banks with Android Malware

July 5, 2023

An e-crime actor of Mexican provenance has been linked to an Android mobile malware campaign targeting financial institutions globally, but...

Swedish Data Protection Authority Warns Companies Against Google Analytics Use

July 5, 2023

The Swedish data protection watchdog has warned companies against using Google Analytics due to risks posed by U.S. government surveillance,...

DDoSia Attack Tool Evolves with Encryption, Targeting Multiple Sectors

July 5, 2023

The threat actors behind the DDoSia attack tool have come up with a new version that incorporates a new mechanism...

Malware Analysis – evasion – cd9772b99eaa36291b8568582a6c068b

July 4, 2023

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: cd9772b99eaa36291b8568582a6c068bSHA1: e20af237fb688484edbc237c102a79c0e7c8c7c7ANALYSIS DATE: 2023-07-04T15:09:29ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – evasion – da3628b2a375448ed4b7410bf1b0c74e

July 4, 2023

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: da3628b2a375448ed4b7410bf1b0c74eSHA1: e33e4bb6558b0e256630ee8c1d4c6aca14333e4aANALYSIS DATE: 2023-07-04T15:31:00ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – ca1a0dd10f4376823f81798a4a338be2

July 4, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:dcad9d884915bbb6106f78e5e2ea6168, discovery, persistence, ransomware, spyware, stealerMD5: ca1a0dd10f4376823f81798a4a338be2SHA1: d53498d723618519e928701cb8f0259e3a961504ANALYSIS DATE: 2023-07-04T17:53:28ZTTPS: T1005, T1081, T1130, T1112,...

Malware Analysis – smokeloader – f2a67f87ec8bddd18aae50dd235a5da1

July 4, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: f2a67f87ec8bddd18aae50dd235a5da1SHA1: f91b677f3f8e9c9169039d45cdde6a98d27b8a34ANALYSIS DATE: 2023-07-04T17:34:05ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – persistence – f197e2ade3bf47b6a7ff836c1e7987d3

July 4, 2023

Score: 8 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: f197e2ade3bf47b6a7ff836c1e7987d3SHA1: 0c229bfce0057396ed162988a269175775dc2295ANALYSIS DATE: 2023-07-04T17:56:27ZTTPS: T1491, T1112, T1060 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Akira Ransomware Victim: 4LEAF, Inc

July 4, 2023

NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of the files...

LockBit 3.0 Ransomware Victim: snjb[.]net

July 4, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

LockBit 3.0 Ransomware Victim: oneexchangecorp[.]com

July 4, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

LockBit 3.0 Ransomware Victim: snjb[.]net

July 4, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Karakurt Ransomware Victim: Jefferson County Health Center

July 4, 2023

KARAKURT RANSOMWARE NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of...

Malware Analysis – ransomware – 42b7a689dceb3fc309afd809464806b9

July 3, 2023

Score: 10 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 42b7a689dceb3fc309afd809464806b9SHA1: df108c9807b29edc077f4b19421e3b5088a2be07ANALYSIS DATE: 2023-07-03T17:44:00ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – smokeloader – 9a6aca4f51392e1c36e2526daf901f84

July 3, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 9a6aca4f51392e1c36e2526daf901f84SHA1: 6e1f252146f42f338aec76c26cf7f0d39eec70fcANALYSIS DATE: 2023-07-03T15:46:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – discovery – f2864f06a6d63659e8564a91221847d4

July 3, 2023

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: f2864f06a6d63659e8564a91221847d4SHA1: 8c4bbc50763f161370cabdf89b7d05c225df171dANALYSIS DATE: 2023-07-03T16:48:50ZTTPS: T1082, T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

OSINT

LockBit 3.0 Ransomware Victim: mitr[.]com

Alert: 330,000 FortiGate Firewalls Still Unpatched to CVE-2023-27997 RCE Flaw

Mexico-Based Hacker Targets Global Banks with Android Malware

Swedish Data Protection Authority Warns Companies Against Google Analytics Use

DDoSia Attack Tool Evolves with Encryption, Targeting Multiple Sectors

Malware Analysis – evasion – cd9772b99eaa36291b8568582a6c068b

Malware Analysis – evasion – da3628b2a375448ed4b7410bf1b0c74e

Malware Analysis – djvu – ca1a0dd10f4376823f81798a4a338be2

Malware Analysis – smokeloader – f2a67f87ec8bddd18aae50dd235a5da1

Malware Analysis – persistence – f197e2ade3bf47b6a7ff836c1e7987d3

Akira Ransomware Victim: 4LEAF, Inc

LockBit 3.0 Ransomware Victim: snjb[.]net

LockBit 3.0 Ransomware Victim: oneexchangecorp[.]com

LockBit 3.0 Ransomware Victim: snjb[.]net

Karakurt Ransomware Victim: Jefferson County Health Center

Malware Analysis – ransomware – 42b7a689dceb3fc309afd809464806b9

Malware Analysis – smokeloader – 9a6aca4f51392e1c36e2526daf901f84

Malware Analysis – discovery – f2864f06a6d63659e8564a91221847d4

3 Reasons SaaS Security is the Imperative First Step to Ensuring Secure AI Usage

Chinese Hackers Use HTML Smuggling to Infiltrate European Ministries with PlugX

Medusa Locker Ransomware Victim: Luna Hotels & Resorts

Medusa Locker Ransomware Victim: Mutuelle LMP

3 Reasons SaaS Security is the Imperative First Step to Ensuring Secure AI Usage

Evasive Meduza Stealer Targets 19 Password Managers and 76 Crypto Wallets

Cobalt Strike Beacon Detected – 121[.]43[.]37[.]134:4434

Cobalt Strike Beacon Detected – 119[.]29[.]231[.]118:443

Cobalt Strike Beacon Detected – 39[.]101[.]74[.]162:443

Cobalt Strike Beacon Detected – 8[.]218[.]112[.]112:8880

Cobalt Strike Beacon Detected – 47[.]109[.]48[.]57:443

You may have missed