Analysis of SmokeLoader sample (SHA256: 84325c9da867db65abdc37f0987c2ff1194540edbac2a154e5f5e0e2469055f4) revealed command-and-control communication with 51.7.190.71 over port 443. A secondary C2 channel was observed connecting to data-backup[.]site which resolved to 142.58.36.189. The malware binary was written to C:\Windows\Temp\procdump64.exe and established persistence via a scheduled task.


Incident Report: LockBit Gang compromised the network via initial access from 195.9.8.24. The threat actor deployed Sharphound and exfiltrated data to cdn-delivery[.]xyz. Lateral movement was observed to 109.60.130.155. A dropper with MD5 hash 567d4b6629d474d868a8cf1e0f78ef7c was found at C:\Users\admin\Downloads\invoice.exe. The exfiltration endpoint collect-log[.]tech was registered 48 hours before the attack.


A phishing email was received from verify@identity-check.tech with subject line 'Urgent Account Verification Required'. The email contained a hyperlink to hxxps://backup-data[.]site/login/verify which redirected to a credential harvesting page. Victims who clicked the link also downloaded Ryuk (SHA256: c4474901665a0c0744866ad575c9691d2379c272cd7e554835755deddc148c1b) which was saved to C:\ProgramData\VMware\update_service.dll.


IOC Summary for Cobalt Strike campaign:
- 151.208.223.2
- 84.179.109.88
- 151.40.56.246
- rat-control[.]info
- fast-cdn[.]xyz
- SHA256: 925c5faf93a600754ce395b64ef13196e5e670d8b231e84af46c592f03efd090
- MD5: d320dd00f5ddfb60c0ded9784da44284


Exploitation of CVE-2023-23397 was attributed to Mustang Panda targeting Citrix ADC instances. The exploit payload was served from 37.92.217.89 and communicated with exchange-key[.]link for command-and-control. Post-exploitation, a webshell (SHA256: e01da2e9f598cd128816088ba37a1dd19ca473fd7b9387aaf7aa62864062d036) was deployed to C:\Users\Public\Documents\payload.dll.


Forensic examination of the compromised host identified FormBook artifacts. The primary payload was located at C:\ProgramData\VMware\update_service.dll with SHA256 hash 7aeb949379c93fb6eefd7dd8c11d4c718ba7e9390fa52a98602b131dc2a8db46. A secondary implant was found at /dev/shm/.payload (MD5: a1bd9b43f231677400faa187388aa018). Network logs showed outbound connections to 62.250.237.97 and DNS queries to mail-relay[.]icu.


Threat Intelligence Brief (ESET): MuddyWater has been observed deploying Gh0st RAT in a new campaign targeting financial institutions. Initial access is gained through spear-phishing emails from ceo@urgent-transfer.online. Infrastructure includes 171.148.50.181, 212.12.170.59, and botnet-cmd[.]biz. SHA1 indicator: 1326314af0c9be1c97a1801520ec1769761bd7d5.


ALERT: TrickBot detected on Confluence Server endpoint. Process C:\ProgramData\VMware\update_service.dll (MD5: 269c2b631512bc8963638ac8867798ad) initiated outbound connection to 134.222.26.98 resolving token-auth[.]space. Immediate containment recommended.


The Royal Ransomware loader contacts three staging URLs: hxxps://dns-resolve[.]cc/download/payload.exe, hxxp://api-gateway[.]club/gate.php, and hxxps://login-verify[.]top/api/beacon. The final payload (SHA256: 9fc140d1410e9943b97811dbf6abc763574bde3534a22a4dd70c900b73fd8021) is downloaded and executed. Fallback C2 is at 104.172.69.180.


The phishing campaign used sender addresses admin@fake-portal.org and access@vpn-connect.space. Links in the emails pointed to malware-drop[.]net hosted at 85.137.187.63. The attached document dropped a payload to C:\Temp\mimikatz.exe with hash 02c7fa8299a913dc28b9513621319724823c5b5211a5fe69a902c4c080cb5c5e.


Multiple AsyncRAT samples identified:
- SHA256: 20d4346443b1e9cf1ae0a388f969997489c5defccbc9c2c40ea2a98c382ac697
- SHA256: b77958e427f54145fc2b6d719ba846367b5b496ca30879504b0b5331899ed4d8
- MD5: 8f277b34e7ed296d4d1f69048f0ab2da
- MD5: 2caa8607b73a1e1f0b406621489d1f5b
All samples beacon to 176.70.254.237 and malware-drop[.]net.


Gamaredon used Sharphound for credential dumping and ngrok for lateral movement. Credentials were exfiltrated to 128.176.84.216. The attacker pivoted to 203.59.211.9 and dropped C:\Windows\System32\wbem\scrcons.exe (MD5: f6be9aa669ca4daec49d487c70b29f19). C2 traffic was routed through smtp-relay[.]icu.


The Conti attack began with exploitation of CVE-2023-46805. The ransomware binary (SHA256: 34bc3c67b200df0763023cbfab91e46021b3d990229b85d2d94e0f01e7d5bd12) was deployed to C:\Windows\System32\wbem\scrcons.exe. Ransom negotiation portal was hosted at ransom-pay[.]icu (109.234.242.146). Contact email for payment: billing@invoice-payment.work.


DNS analysis for Agent Tesla infrastructure: smtp-relay[.]icu resolved to 80.68.36.64, phish-kit[.]xyz resolved to 213.68.192.150, and share-files[.]biz was used as a DNS-over-HTTPS tunnel. The implant hash is a780ced71594af256b57e8911b0ab73a.


Sandbox Report: BlackBasta
SHA256: 33e15fdf06d0ef3cba71c6252123b73fe5535721122d94a52fe5c9721ade5f71
MD5: 0821454b0dda7148ca2cf3019d57e250
File created: C:\Windows\System32\config\SAM
File modified: C:\Users\Public\Documents\payload.dll
Network connection: 181.93.57.36
DNS query: gate-proxy[.]ru
HTTP request: hxxps://rat-control[.]info/stage2


Analysis of QakBot sample (SHA256: b4d4850f626be905cb2e218c240d66abeba9ef0a2579c4555f09822e24402823) revealed command-and-control communication with 51.40.161.41 over port 4443. A secondary C2 channel was observed connecting to sync-cloud[.]work which resolved to 195.153.17.99. The malware binary was written to C:\Windows\INF\setupapi.dev.dll and established persistence via a scheduled task.


Incident Report: UNC2452 compromised the network via initial access from 144.249.142.221. The threat actor deployed ADFind and exfiltrated data to exfil-data[.]club. Lateral movement was observed to 91.175.185.30. A dropper with MD5 hash 0902d0da28bf53180fde0471fa1cdc23 was found at C:\Windows\Temp\procdump64.exe. The exfiltration endpoint monitor-net[.]org was registered 48 hours before the attack.


A phishing email was received from finance@wire-transfer.info with subject line 'Urgent Account Verification Required'. The email contained a hyperlink to hxxps://system-patch[.]online/login/verify which redirected to a credential harvesting page. Victims who clicked the link also downloaded REvil (SHA256: f40a476268e27f996d4a04e180b6107f501aa9aca27234ae01ffc48c87eb00b8) which was saved to C:\Windows\Temp\nc.exe.


IOC Summary for Gh0st RAT campaign:
- 84.117.1.245
- 146.249.129.196
- 88.130.234.28
- malware-drop[.]net
- code-deploy[.]store
- SHA256: e812600207967f5d5e12a6203c2c5fabad5e5a0f4e54b405b82af761883b733c
- MD5: 67c1c069b26d1aac66d67f1922686d64


Exploitation of CVE-2022-22965 was attributed to ALPHV targeting Windows Server 2019 instances. The exploit payload was served from 95.40.96.196 and communicated with dns-resolve[.]cc for command-and-control. Post-exploitation, a webshell (SHA256: 75618d15fc854fd1ded97e184898048a0d6e2d92f8bdcfe4129815b13a153070) was deployed to /tmp/.hidden/beacon.


Forensic examination of the compromised host identified Ryuk artifacts. The primary payload was located at C:\Windows\System32\config\SAM with SHA256 hash fad5464ca78bf7ea789d0b75d495dd68e0be607fddb3fef461889a996900649b. A secondary implant was found at /tmp/.hidden/beacon (MD5: f2405ea9ed106751b3fab66afe53efbc). Network logs showed outbound connections to 51.238.93.225 and DNS queries to code-deploy[.]store.


Threat Intelligence Brief (Check Point): APT28 has been observed deploying Ryuk in a new campaign targeting financial institutions. Initial access is gained through spear-phishing emails from noreply@payment-confirm.top. Infrastructure includes 23.22.188.125, 212.251.195.137, and botnet-cmd[.]biz. SHA1 indicator: 02e8b81a65656c6f6f4d56959539112f29d1dc06.


ALERT: Mimikatz detected on Nginx endpoint. Process C:\Users\Public\Libraries\shell.ps1 (MD5: 78a8258631abcaf49dde4311227bd06b) initiated outbound connection to 204.243.141.43 resolving cert-verify[.]dev. Immediate containment recommended.


The Vidar loader contacts three staging URLs: hxxps://web-cache[.]io/download/payload.exe, hxxp://monitor-net[.]org/gate.php, and hxxps://rat-control[.]info/api/beacon. The final payload (SHA256: 98e5bb96c027022603778697be8134a244ad4758b0015a5eb10851f70ee9ca2a) is downloaded and executed. Fallback C2 is at 95.183.80.103.


The phishing campaign used sender addresses helpdesk@reset-password.biz and cloud@storage-share.ru. Links in the emails pointed to cache-web[.]io hosted at 200.31.64.58. The attached document dropped a payload to C:\Users\Public\Documents\payload.dll with hash d272224b14b9857094138e9752bc37ba844a6d140b3abf18dce7304c4fc06dd1.


Multiple LockBit samples identified:
- SHA256: e3ec5897e095faeaf6a20a1eceb0dddc324bef053b94b44f51ec1ba8c5f2af1d
- SHA256: 906f9a00f9a8961a34093aa0a6709940ec1afccb8ed58247105755213abad8b9
- MD5: 5449d61503b2077aeb04dbbdaf1ff79d
- MD5: 6f1b9f0d68e4bc85af0e740a1d2013b2
All samples beacon to 103.151.142.59 and auth-token[.]space.


UNC2452 used Brute Ratel C4 for credential dumping and Cobalt Strike for lateral movement. Credentials were exfiltrated to 216.182.162.16. The attacker pivoted to 134.18.232.9 and dropped C:\Windows\System32\wbem\scrcons.exe (MD5: c551800b48a492d547bb8c90938dd5b0). C2 traffic was routed through cloud-sync[.]work.


The LockBit attack began with exploitation of CVE-2023-20198. The ransomware binary (SHA256: c393ca0eb7bc6f728f14083b5758604c5b8faf4892456ae05961359e44cf655e) was deployed to C:\Windows\System32\drivers\ndis_helper.sys. Ransom negotiation portal was hosted at monitor-net[.]org (151.172.125.55). Contact email for payment: alert@security-warning.dev.


DNS analysis for AsyncRAT infrastructure: resolve-dns[.]cc resolved to 182.49.25.25, log-collect[.]tech resolved to 196.91.109.106, and resolve-dns[.]cc was used as a DNS-over-HTTPS tunnel. The implant hash is 6c79a41072cb700870258a4dcb260cda.


Sandbox Report: DarkSide
SHA256: 5315d93087e2a91ae4d43afdf75f2d294f7d24ee0db18f046ba24dcd326a83a3
MD5: b371e6d5fa38d1c55f9163beacdb7b3b
File created: C:\ProgramData\Microsoft\update.bat
File modified: C:\Windows\Temp\debug.exe
Network connection: 198.173.168.252
DNS query: phish-kit[.]xyz
HTTP request: hxxps://smtp-relay[.]icu/stage2


Analysis of Bumblebee sample (SHA256: c96536195fde69d6a3f326248e54d229072a3cb321d912be0b7932c0be993caa) revealed command-and-control communication with 168.205.221.28 over port 4443. A secondary C2 channel was observed connecting to portal-auth[.]info which resolved to 142.50.49.138. The malware binary was written to C:\Windows\System32\drivers\ndis_helper.sys and established persistence via a scheduled task.


Incident Report: Sandworm compromised the network via initial access from 151.119.64.224. The threat actor deployed ADFind and exfiltrated data to collect-log[.]tech. Lateral movement was observed to 216.114.207.221. A dropper with MD5 hash 634eca2d6fb400a19c70368de760e221 was found at C:\ProgramData\Microsoft\update.bat. The exfiltration endpoint data-backup[.]site was registered 48 hours before the attack.


A phishing email was received from verify@identity-check.tech with subject line 'Urgent Account Verification Required'. The email contained a hyperlink to hxxps://update-service[.]net/login/verify which redirected to a credential harvesting page. Victims who clicked the link also downloaded TrickBot (SHA256: 9657dc1942bcbba61923b7a2d4c628cb853d4de4f4e845cb78dc42516fe73a90) which was saved to C:\Windows\Tasks\scheduled_task.xml.


IOC Summary for Royal Ransomware campaign:
- 85.105.125.124
- 109.222.103.232
- 203.43.98.1
- sync-cloud[.]work
- cert-verify[.]dev
- SHA256: 55356f5d1d275c82c5f50989c863cfe63fa7aec9064c9604538acd2dda6888dd
- MD5: c3d8aee4b0f4a8b25b004f58a40a02fe


Exploitation of CVE-2024-3400 was attributed to MuddyWater targeting Azure AD instances. The exploit payload was served from 195.179.246.188 and communicated with collect-log[.]tech for command-and-control. Post-exploitation, a webshell (SHA256: d3089c9af03bd92285285f2c742374b1d0304ac02c0fdca854d20571794e70c5) was deployed to C:\Users\Public\desktop.ini.


Forensic examination of the compromised host identified FormBook artifacts. The primary payload was located at C:\Users\admin\AppData\Local\Temp\loader.exe with SHA256 hash 4ef681cd5d368dc4607033aaa141bfd5dec0702749ba54161fb5c7c09c66910f. A secondary implant was found at /opt/.cache/reverse_shell (MD5: fbf15131b42aa11d86af50885145a269). Network logs showed outbound connections to 109.248.15.149 and DNS queries to shell-cmd[.]online.


Threat Intelligence Brief (SentinelOne): APT28 has been observed deploying Bumblebee in a new campaign targeting financial institutions. Initial access is gained through spear-phishing emails from phishing@secure-update.net. Infrastructure includes 203.13.150.123, 208.236.219.136, and dns-resolve[.]cc. SHA1 indicator: b1acc2a42a5160b4353f6b1fdf5c21cd16612bd2.


ALERT: Remcos RAT detected on VMware ESXi endpoint. Process C:\Users\Public\Documents\payload.dll (MD5: d2f782d5129e169f26f02799b5437553) initiated outbound connection to 23.218.48.18 resolving exchange-key[.]link. Immediate containment recommended.


The Raccoon Stealer loader contacts three staging URLs: hxxps://smtp-relay[.]icu/download/payload.exe, hxxp://system-patch[.]online/gate.php, and hxxps://verify-cert[.]dev/api/beacon. The final payload (SHA256: 9144f94601f5dab20b11b44af0735877d3c85185e705f78ddda1a1475faeb869) is downloaded and executed. Fallback C2 is at 142.149.153.11.


The phishing campaign used sender addresses admin@fake-portal.org and tax@refund-claim.pw. Links in the emails pointed to c2-relay[.]top hosted at 210.81.240.67. The attached document dropped a payload to C:\Users\admin\AppData\Local\Temp\loader.exe with hash e495e89dbde475c0f493079b47970ed630be461c60d3d9c1b029643a91c81f85.


Multiple Vidar samples identified:
- SHA256: 8eae837415e160b3264c05847d823ba2d1fb5fb34bcab50289355e0d83d8906d
- SHA256: bec132e1835c8526ab7508efdba6cba107c9c93d880f8c6b8a80baab21a04e45
- MD5: 14eaa44a33af535cf1a961a2b0a27f4e
- MD5: 1a4fbd4f9ace3e2828da55e2c129d9ea
All samples beacon to 162.62.68.102 and auth-portal[.]info.


Lazarus Group used Net-GPPPassword for credential dumping and ADFind for lateral movement. Credentials were exfiltrated to 158.118.81.238. The attacker pivoted to 216.3.118.160 and dropped C:\Recovery\WindowsRE\agent.exe (MD5: 1d62870c66779c42edf8de1f8d3734f6). C2 traffic was routed through data-backup[.]site.


The LockBit attack began with exploitation of CVE-2022-26134. The ransomware binary (SHA256: 87d80a63fa49abfcf014eea1c6c143d3e99cf5afbad735fd20821bfcc565e990) was deployed to C:\Users\Public\Documents\payload.dll. Ransom negotiation portal was hosted at login-verify[.]top (208.68.34.239). Contact email for payment: security@alert-notification.icu.


DNS analysis for FormBook infrastructure: key-exchange[.]link resolved to 217.181.78.157, dns-resolve[.]cc resolved to 211.3.171.210, and portal-auth[.]info was used as a DNS-over-HTTPS tunnel. The implant hash is 49a0d48b401f01849f8575f553af5279.


Sandbox Report: REvil
SHA256: a393d5c5acdd16e728996801f5bbb5b834c96a852cc35f4fc051db53168b0aac
MD5: 7aa07a214ce145f5a104aa9ffe1f8577
File created: C:\ProgramData\Microsoft\update.bat
File modified: C:\ProgramData\Microsoft\update.bat
Network connection: 46.241.225.35
DNS query: cert-verify[.]dev
HTTP request: hxxps://shell-cmd[.]online/stage2


Analysis of FormBook sample (SHA256: 4e0863e4cc68d9634d0af31a52e2d7933912795b397385adb96d06e507ded32e) revealed command-and-control communication with 82.70.73.155 over port 9090. A secondary C2 channel was observed connecting to exfil-data[.]club which resolved to 104.184.88.53. The malware binary was written to C:\ProgramData\svchost.exe and established persistence via a scheduled task.


Incident Report: TA551 compromised the network via initial access from 144.232.233.217. The threat actor deployed CrackMapExec and exfiltrated data to token-auth[.]space. Lateral movement was observed to 198.24.163.109. A dropper with MD5 hash 5772834eafa955aa0426b7a2d27bb50c was found at C:\Windows\System32\svchost_update.exe. The exfiltration endpoint secure-login[.]top was registered 48 hours before the attack.


A phishing email was received from noreply@payment-confirm.top with subject line 'Urgent Account Verification Required'. The email contained a hyperlink to hxxps://malware-drop[.]net/login/verify which redirected to a credential harvesting page. Victims who clicked the link also downloaded Conti (SHA256: b0f27c4938d194c85a6db3b58b8679544b7591b053705be3ed765c07a8602d21) which was saved to C:\Temp\mimikatz.exe.


IOC Summary for FormBook campaign:
- 199.142.181.110
- 91.29.20.242
- 82.140.10.214
- api-gateway[.]club
- auth-token[.]space
- SHA256: 57da9e9aaae0dee0c486eb9dad7f6bd56f25cda5f979d9e1172124cbc410fd43
- MD5: ca8cf94cf0886490d3120e903edb090d


Exploitation of CVE-2023-34362 was attributed to Winnti Group targeting Confluence Server instances. The exploit payload was served from 77.11.79.94 and communicated with secure-login[.]top for command-and-control. Post-exploitation, a webshell (SHA256: d51ab86ad6b7305fd99d17bf76097eaaba7cf0698a014af35770b207a65804cf) was deployed to C:\Windows\Temp\nc.exe.


Forensic examination of the compromised host identified Raccoon Stealer artifacts. The primary payload was located at C:\Windows\Tasks\scheduled_task.xml with SHA256 hash de206fdbe504837efce64b823f08a377a76f978bbf772783cacac5ac5fb42712. A secondary implant was found at /tmp/linpeas.sh (MD5: ef245857ae1413dc3df0be611fe879ef). Network logs showed outbound connections to 46.91.200.144 and DNS queries to backup-data[.]site.


Threat Intelligence Brief (Check Point): FIN11 has been observed deploying Royal Ransomware in a new campaign targeting financial institutions. Initial access is gained through spear-phishing emails from finance@wire-transfer.info. Infrastructure includes 141.222.42.250, 88.226.106.7, and vpn-tunnel[.]pw. SHA1 indicator: 2b0c3cac3641356e63c6bfa0a3d793ffe47a21dd.


ALERT: ShadowPad detected on Citrix ADC endpoint. Process C:\Windows\Tasks\scheduled_task.xml (MD5: 5f480a2bfb43a1aa12c0cd47f0aadd1b) initiated outbound connection to 182.206.172.222 resolving shell-cmd[.]online. Immediate containment recommended.


The NjRAT loader contacts three staging URLs: hxxps://dns-resolve[.]cc/download/payload.exe, hxxp://loader-bin[.]work/gate.php, and hxxps://data-backup[.]site/api/beacon. The final payload (SHA256: 032b3934962dce68afa4868f97698813c5f587600120dbc8a963fa9c585c38e0) is downloaded and executed. Fallback C2 is at 176.224.10.220.


The phishing campaign used sender addresses security@alert-notification.icu and billing@invoice-payment.work. Links in the emails pointed to share-files[.]biz hosted at 169.79.211.204. The attached document dropped a payload to C:\Windows\Tasks\scheduled_task.xml with hash 80cb00a64ff9847bf91c83ba31283cac85fb4748450856d8e940a488cf0da6d7.


Multiple Ryuk samples identified:
- SHA256: 75d25a29646de86ae604bf927fefdba5af3d3d04b806bf8be3ab4f0fd9bfb0d0
- SHA256: eaed36f53105a93364c678de8fd8560673f4cb5c300594540bfc0c7c7e29bd01
- MD5: 82752ae2f5d6008330bcc2d4cab188b2
- MD5: eefcb459329b2a8358f28e4833326f5e
All samples beacon to 185.169.50.103 and fast-cdn[.]xyz.


APT29 used Rubeus for credential dumping and BloodHound for lateral movement. Credentials were exfiltrated to 151.90.165.131. The attacker pivoted to 181.174.252.216 and dropped C:\Windows\Temp\procdump64.exe (MD5: a3889edbfc83694edfd257f9b0b7d090). C2 traffic was routed through fast-cdn[.]xyz.


The Conti attack began with exploitation of CVE-2024-21762. The ransomware binary (SHA256: b33f572efb25280ecab4e039f6c5531768492d9e41d26ee693cb37c6fd8953f5) was deployed to C:\Windows\Temp\debug.exe. Ransom negotiation portal was hosted at cert-verify[.]dev (146.46.149.247). Contact email for payment: support@account-verify.xyz.


DNS analysis for RedLine Stealer infrastructure: patch-system[.]online resolved to 162.112.156.252, login-verify[.]top resolved to 209.30.99.231, and exploit-hub[.]site was used as a DNS-over-HTTPS tunnel. The implant hash is 85be308616be93dd4a0ffa0a698a6e63.


Sandbox Report: BazarLoader
SHA256: 817efad8e291fe740b480d39012992d92433be9d6fa51e6617e0c8bbd8a30c23
MD5: e4528c53ff82248ebf5adbdaaecba60d
File created: C:\Users\Public\Libraries\shell.ps1
File modified: C:\Windows\Temp\procdump64.exe
Network connection: 144.12.182.112
DNS query: update-service[.]net
HTTP request: hxxps://exfil-data[.]club/stage2


Analysis of Bumblebee sample (SHA256: ee84cef4e1dfb28150d31955134d51166e2471c5b90cb014523179552dd35178) revealed command-and-control communication with 95.94.111.18 over port 9090. A secondary C2 channel was observed connecting to system-patch[.]online which resolved to 167.160.81.170. The malware binary was written to C:\Users\Public\desktop.ini and established persistence via a scheduled task.


Incident Report: MuddyWater compromised the network via initial access from 182.84.104.179. The threat actor deployed Net-GPPPassword and exfiltrated data to backup-data[.]site. Lateral movement was observed to 156.142.33.50. A dropper with MD5 hash 7540894c91f6203fc7b302ff9610d612 was found at /opt/.cache/reverse_shell. The exfiltration endpoint c2-relay[.]top was registered 48 hours before the attack.


A phishing email was received from hr@resume-upload.club with subject line 'Urgent Account Verification Required'. The email contained a hyperlink to hxxps://deploy-code[.]store/login/verify which redirected to a credential harvesting page. Victims who clicked the link also downloaded RedLine Stealer (SHA256: 4a05cde81910f698ccafc66e867c4a3c29676f7282513bd189047b915b599a85) which was saved to C:\Users\Public\desktop.ini.


IOC Summary for Remcos RAT campaign:
- 181.141.214.1
- 158.74.54.111
- 163.120.114.114
- exfil-data[.]club
- web-cache[.]io
- SHA256: 2798512e2e944163ddf0807d6314066ae81afd6cb353f45ad5fdef7aafd5553a
- MD5: 5e27f6a50b354f1e517af5943cb1c2c0


Exploitation of CVE-2023-46805 was attributed to Sandworm targeting Ivanti Connect Secure instances. The exploit payload was served from 23.73.132.170 and communicated with malware-drop[.]net for command-and-control. Post-exploitation, a webshell (SHA256: c6f93c69bbf44e85d43ead55556649ea31b5f27b803afd6b09dbd792fbae2bd6) was deployed to C:\Temp\mimikatz.exe.


Forensic examination of the compromised host identified Emotet artifacts. The primary payload was located at C:\Windows\Tasks\scheduled_task.xml with SHA256 hash 6e835e50ea30aa03cbc435b6e5582213886ea53273eb4470d0f0e06d0b46b9cb. A secondary implant was found at /tmp/linpeas.sh (MD5: ab9837391347337f553ddc17b55e61d3). Network logs showed outbound connections to 159.58.207.51 and DNS queries to file-share[.]biz.


Threat Intelligence Brief (FireEye): APT28 has been observed deploying Ryuk in a new campaign targeting financial institutions. Initial access is gained through spear-phishing emails from delivery@package-track.cc. Infrastructure includes 216.117.107.227, 94.184.179.99, and tunnel-vpn[.]pw. SHA1 indicator: a34b97bc457d4db44b9711a1a025d703c0dd524c.


ALERT: Ryuk detected on Nginx endpoint. Process C:\ProgramData\Microsoft\update.bat (MD5: 3f3ceacdf42e94f43ef3a7bd999f9530) initiated outbound connection to 80.168.177.2 resolving rat-control[.]info. Immediate containment recommended.


The Ryuk loader contacts three staging URLs: hxxps://net-monitor[.]org/download/payload.exe, hxxp://vpn-tunnel[.]pw/gate.php, and hxxps://loader-bin[.]work/api/beacon. The final payload (SHA256: c5d6a12ee45e4a47e8004f5cd2647949cc6ed3c1e2f7e88805b5193eea5ce634) is downloaded and executed. Fallback C2 is at 210.119.13.143.


The phishing campaign used sender addresses support@account-verify.xyz and cloud@storage-share.ru. Links in the emails pointed to auth-portal[.]info hosted at 202.171.136.253. The attached document dropped a payload to C:\Windows\Temp\procdump64.exe with hash a3a4c218208af26165e8fbfbf8e7b8733c71e86f217e1984e0629c26d5deafc5.


Multiple Raccoon Stealer samples identified:
- SHA256: 7358365e2dc8ea15a4ac6ff2bae98586509a061cf4577616bfd62799064f05b6
- SHA256: 7e4853f423e45426b3c82c646fba101a7432a3c033a6202c99d2fdada764e56a
- MD5: dc2756314e6140a5ee196df34e851441
- MD5: 58b4aa8a743951b94aafdb9936511320
All samples beacon to 162.244.194.229 and portal-auth[.]info.


Gamaredon used LaZagne for credential dumping and PowerView for lateral movement. Credentials were exfiltrated to 208.110.213.233. The attacker pivoted to 200.230.41.191 and dropped C:\Windows\System32\config\SAM (MD5: 2d3d729756b6057852305fbbc10e7de0). C2 traffic was routed through portal-auth[.]info.


The LockBit attack began with exploitation of CVE-2024-3400. The ransomware binary (SHA256: bfff65a170a3baa34e9506d0b7cea00f5c5207ac4c64ea20ac5f42b54b3238ff) was deployed to C:\Windows\Tasks\scheduled_task.xml. Ransom negotiation portal was hosted at tunnel-vpn[.]pw (151.197.200.134). Contact email for payment: it-admin@helpdesk-ticket.site.


DNS analysis for Ryuk infrastructure: cloud-sync[.]work resolved to 141.70.86.82, ransom-pay[.]icu resolved to 217.21.36.39, and key-exchange[.]link was used as a DNS-over-HTTPS tunnel. The implant hash is 670a0458e2ae6803ddebfe79d2709d7f.


Sandbox Report: Dridex
SHA256: b601cd0b6b131fc59d43c0891e0873165fb98a6d40d28bab6f63311a092d8944
MD5: 2d7b099313fec62c390f2db3af228261
File created: C:\Windows\Temp\nc.exe
File modified: C:\Windows\System32\wbem\scrcons.exe
Network connection: 82.181.55.17
DNS query: backup-data[.]site
HTTP request: hxxps://monitor-net[.]org/stage2


Analysis of AsyncRAT sample (SHA256: 79d7fc18948dae180b8250a3cc9d08cb6e4b0f47c117536c395bccc4e670a504) revealed command-and-control communication with 188.16.53.214 over port 9090. A secondary C2 channel was observed connecting to auth-token[.]space which resolved to 188.100.232.198. The malware binary was written to C:\Windows\System32\svchost_update.exe and established persistence via a scheduled task.


Incident Report: Mustang Panda compromised the network via initial access from 205.2.242.91. The threat actor deployed LaZagne and exfiltrated data to backup-data[.]site. Lateral movement was observed to 158.193.100.219. A dropper with MD5 hash f5636f298b79b063d39ce8815cf1bfb8 was found at /tmp/.ICE-unix/agent. The exfiltration endpoint monitor-net[.]org was registered 48 hours before the attack.


A phishing email was received from security@alert-notification.icu with subject line 'Urgent Account Verification Required'. The email contained a hyperlink to hxxps://tunnel-vpn[.]pw/login/verify which redirected to a credential harvesting page. Victims who clicked the link also downloaded Ryuk (SHA256: cf688b58992f4fec836d3b43440af125eca31eb17cfd81e60a166bc6a4a49576) which was saved to C:\ProgramData\svchost.exe.


IOC Summary for Raccoon Stealer campaign:
- 196.125.8.100
- 168.172.174.205
- 181.186.43.216
- share-files[.]biz
- auth-portal[.]info
- SHA256: e8ff7f7c079749f487ed14d34fbc7642aa793944f82e62b35425814c31b417d6
- MD5: 08a844da4566fe2bc9064c918d811158


Exploitation of CVE-2021-21972 was attributed to APT29 targeting Windows 11 instances. The exploit payload was served from 179.152.145.170 and communicated with cdn-delivery[.]xyz for command-and-control. Post-exploitation, a webshell (SHA256: 92376589330387034357d5813804d154b6a63c47dd17e2d78055be3fc0bb95bb) was deployed to /home/www-data/.ssh/authorized_keys2.


Forensic examination of the compromised host identified LockBit artifacts. The primary payload was located at C:\Windows\System32\drivers\ndis_helper.sys with SHA256 hash d0d36681a4a8592f410d57c110572bd9e264e0041b98c5781c6847bb2786008a. A secondary implant was found at /lib/x86_64-linux-gnu/.libpam.so (MD5: 844f086613a67b6897b7f319326464b1). Network logs showed outbound connections to 202.47.13.67 and DNS queries to sync-cloud[.]work.


Threat Intelligence Brief (SentinelOne): Turla has been observed deploying AsyncRAT in a new campaign targeting financial institutions. Initial access is gained through spear-phishing emails from it-admin@helpdesk-ticket.site. Infrastructure includes 168.195.226.98, 151.193.244.213, and backup-data[.]site. SHA1 indicator: 596b138be7be8213cbb663c8a0819564bc20a953.


ALERT: Gh0st RAT detected on Confluence Server endpoint. Process C:\Windows\Temp\debug.exe (MD5: 44a95bcfbefb0a37275dacea5d2dc1ee) initiated outbound connection to 23.121.5.192 resolving monitor-net[.]org. Immediate containment recommended.


The Ryuk loader contacts three staging URLs: hxxps://net-monitor[.]org/download/payload.exe, hxxp://phish-kit[.]xyz/gate.php, and hxxps://cloud-sync[.]work/api/beacon. The final payload (SHA256: 82fe0cca4972d3763826f9839a91712aaf066a7426f6212f9ff51ac6902fb5b3) is downloaded and executed. Fallback C2 is at 194.194.8.244.


The phishing campaign used sender addresses billing@invoice-payment.work and attacker@malicious-domain.com. Links in the emails pointed to deploy-code[.]store hosted at 82.62.33.122. The attached document dropped a payload to C:\ProgramData\Microsoft\update.bat with hash d1710e340a054ce3298777fbee99bbd044f4c04122e990edbb27e234d6f20d75.


Multiple RedLine Stealer samples identified:
- SHA256: 205f238dc5be5ac306c2930ed04cab4a56d0bccc5ec87d14c88f6f08cc5cbef9
- SHA256: 998d6b610850e314e82f2d4abfef7038f6cf8f51180df00a05c172094c9e0a81
- MD5: 5b0ba166d78934d2c4a5467af9ebe098
- MD5: 55853f9dc3fbbccd2cfa4fa654bba2a3
All samples beacon to 109.120.180.66 and botnet-cmd[.]biz.


Vice Society used PsExec for credential dumping and Metasploit for lateral movement. Credentials were exfiltrated to 51.200.210.42. The attacker pivoted to 159.28.149.7 and dropped C:\Users\Public\desktop.ini (MD5: 2570f7222e2bcc72de49186867798c20). C2 traffic was routed through verify-cert[.]dev.


The BlackBasta attack began with exploitation of CVE-2022-30190. The ransomware binary (SHA256: de677543330be835edcc1583b47d5f8d71db0f27bfd06b307ac9a72fa575b4f9) was deployed to C:\Recovery\WindowsRE\agent.exe. Ransom negotiation portal was hosted at cloud-sync[.]work (179.242.184.51). Contact email for payment: security@alert-notification.icu.


DNS analysis for Vidar infrastructure: loader-bin[.]work resolved to 62.204.252.145, botnet-cmd[.]biz resolved to 194.89.137.110, and code-deploy[.]store was used as a DNS-over-HTTPS tunnel. The implant hash is c0bc160f87890fec6a66ec19324b27bb.


Sandbox Report: BlackCat
SHA256: 26cea5ea41514dd4d3f0078f5aa41319d387b3437c362c9abd13ac3232041be4
MD5: a74a5f3e9e93a7d4d96d853ff54bb5a6
File created: C:\Windows\Temp\nc.exe
File modified: C:\Windows\System32\config\SAM
Network connection: 212.130.166.88
DNS query: update-service[.]net
HTTP request: hxxps://data-backup[.]site/stage2


Analysis of Agent Tesla sample (SHA256: 4b2d128750932e9d1fe69c583d6ad54f5a829a51612a902776cbc082e3cb8dd1) revealed command-and-control communication with 171.163.229.213 over port 80. A secondary C2 channel was observed connecting to vpn-tunnel[.]pw which resolved to 201.182.40.112. The malware binary was written to C:\Users\Public\Libraries\shell.ps1 and established persistence via a scheduled task.


Incident Report: Gamaredon compromised the network via initial access from 213.199.124.120. The threat actor deployed BloodHound and exfiltrated data to token-auth[.]space. Lateral movement was observed to 196.212.188.152. A dropper with MD5 hash 276a463eb76edb23baa19d5eaeb35a65 was found at C:\Windows\System32\config\SAM. The exfiltration endpoint micro-update[.]net was registered 48 hours before the attack.


A phishing email was received from it-admin@helpdesk-ticket.site with subject line 'Urgent Account Verification Required'. The email contained a hyperlink to hxxps://portal-auth[.]info/login/verify which redirected to a credential harvesting page. Victims who clicked the link also downloaded Ryuk (SHA256: 33af21e00813dd9554b194f7b8e5707a40c369ccedb2afd70840707b1e10e6a4) which was saved to C:\ProgramData\VMware\update_service.dll.


IOC Summary for SystemBC campaign:
- 176.87.8.127
- 163.47.125.55
- 170.205.67.88
- token-auth[.]space
- exchange-key[.]link
- SHA256: c7a3248802356f2909f65c31ea904a5f52d37b28920010d6b50a8f3d6ea31e3e
- MD5: a94e1f02269e45863ee08a25c65ce4d3


Exploitation of CVE-2023-27997 was attributed to Scattered Spider targeting VMware ESXi instances. The exploit payload was served from 91.133.243.49 and communicated with mail-relay[.]icu for command-and-control. Post-exploitation, a webshell (SHA256: 9e2befedac5abe4b2de561d634496b5b51152858af53255551e0896452463601) was deployed to /var/log/.access_log.


Forensic examination of the compromised host identified NjRAT artifacts. The primary payload was located at C:\Windows\System32\config\SAM with SHA256 hash 7a8cc24b994c7c318704dd8d3bbb571c714ac7eea8d5784c53b4b995c95073ea. A secondary implant was found at /dev/shm/.payload (MD5: 1bafa6cfe9b2fe395dd1ca0684cc9557). Network logs showed outbound connections to 141.177.122.166 and DNS queries to ransom-pay[.]icu.


Threat Intelligence Brief (Microsoft): TA505 has been observed deploying ShadowPad in a new campaign targeting financial institutions. Initial access is gained through spear-phishing emails from service@subscription-renew.io. Infrastructure includes 31.76.57.104, 142.79.170.149, and api-gateway[.]club. SHA1 indicator: cd4410dfed4e22664a2b531427f9c8747a95f869.


ALERT: FormBook detected on Confluence Server endpoint. Process C:\Windows\System32\wbem\scrcons.exe (MD5: 07b886ef8000f150a2eed13a1baded0c) initiated outbound connection to 211.89.109.191 resolving collect-log[.]tech. Immediate containment recommended.


The Bumblebee loader contacts three staging URLs: hxxps://loader-bin[.]work/download/payload.exe, hxxp://share-files[.]biz/gate.php, and hxxps://token-auth[.]space/api/beacon. The final payload (SHA256: 0dca123ba69c7c94a793d25435d3a271d9c66b68f6a5b90b3454a57293902f5d) is downloaded and executed. Fallback C2 is at 159.65.60.31.


The phishing campaign used sender addresses billing@invoice-payment.work and finance@wire-transfer.info. Links in the emails pointed to system-patch[.]online hosted at 213.244.196.177. The attached document dropped a payload to C:\Temp\mimikatz.exe with hash 17651044fe287d9c07ab69897ae5f01a42611bb669861d99542cda2c23e9d92b.