Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
mamot.fr is one of the many independent Mastodon servers you can use to participate in the fediverse.
Mamot.fr est un serveur Mastodon francophone, géré par La Quadrature du Net.

Administered by:

Server stats:

3.2K
active users

mamot.fr: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.4

#threatdetection

0 posts0 participants0 posts today
Public
Just Another Blue Teamer

Good day everyone!

Check Point Software researchers produced another great article that involves #APT29 and #phishing and a little bit of masquerading. This phishing campaign targeted European diplomatic entities that distributes fake invitations to diplomatic events and appears to be a continuation of a previous campaign run by the same actors. These phishing emails utilized a backdoor known as #Wineloader and also employs a new loader #Grapeloader. There is a lot to unpack here and I hope you enjoy!

Renewed APT29 Phishing Campaign Against European Diplomats
research.checkpoint.com/2025/a

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Check Point Research · Renewed APT29 Phishing Campaign Against European Diplomats - Check Point ResearchCheck Point Research uncovers APT29 targeting European diplomatic entities with phishing attacks spreading malware Grapeloader
Public
Tycoon World

AI in Banking Security: Revolution & Risks

#TycoonWorld #AIinBanking #BankingSecurity #CyberSecurityAI #FinTechSecurity #ArtificialIntelligence #MachineLearning #AnomalyDetection #BehavioralAnalytics #ThreatDetection #FraudPrevention #PredictiveAnalytics #EthicalAI #DataPrivacy #ExplainableAI #AdversarialAttacks #BankingInnovation #FinancialSecurity #AIethics #AIrisks #DigitalBanking #AIinFinance #AIandCybercrime #SmartBanking #FinTechTrends #CyberRiskMitigation

tycoonworld.in/ai-in-banking-s

Tycoon World · AI in Banking Security: Revolution & Risks – Tycoon WorldThe digital evolution of banking has brought immense convenience, yet simultaneously amplified cyber security risks, positioning Artificial Intelligence (AI)
Public
Just Another Blue Teamer

Happy Wednesday everyone!

Today's #readoftheday starts strong! "Microsoft Threat Intelligence and Microsoft Security Response Center (MSRC) have discovered post-compromise exploitation of a zero-day elevation of privilege vulnerability in the Windows Common Log File System (CLFS) against a small number of targets." and their discovery involved #PipeMagic malware which was used to deploy ransomware. Enjoy and Happy Hunting!

Exploitation of CLFS zero-day leads to ransomware activity
microsoft.com/en-us/security/b

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Microsoft Security Blog · Exploitation of CLFS zero-day leads to ransomware activity | Microsoft Security BlogMicrosoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) have discovered post-compromise exploitation of a newly discovered zero-day vulnerability in the Windows Common Log File System (CLFS) against a small number of targets. Microsoft released security updates to address the vulnerability, tracked as CVE 2025-29824, on April 8, 2025.
Public
Just Another Blue Teamer

Good day everyone!

Today's #readoftheday involves Microsoft Office add-ins, masquerading, trojans, and MUCH MORE! Kaspersky researchers share the details about a project on SourceForge that was distributing malware. It appeared to be a project for Microsoft Office add-ins, that were copied from a legitimate project on GitHub, but in reality was a list of Microsoft Office applications that led to an archive that contained an installer file (.msi). Once that is run, a bunch of bad stuff happens (I'm not going to ruin it for you) and then you are left with a miner and the #ClipBanker malware that replaces cryptocurrency wallet addresses in the clipboard with the attacker's own, which is pretty interesting as well! I hope you enjoy it as much as I did! Happy Hunting!

Attackers distributing a miner and the ClipBanker Trojan via SourceForge
securelist.com/miner-clipbanke

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Kaspersky · Attackers distributing a miner and the ClipBanker Trojan via SourceForgeBy AMR
Public
Just Another Blue Teamer

Happy Monday everyone!

Just got done reading an incredible article from ESET researchers describing an APT group that was long thought to be inactive alive in well! #FamousSparrow is a China-aligned APT group that has had no publicly documented activity since 2022 and was found using two previously undocumented versions of their backdoor, SparrowDoor. They used a mix of publicly available and custom tools for their attack ultimately leading to the deployment of SparrowDoor and ShadowPad (a privately sold backdoor). This report gets more and more interesting as you go so please go take the time to read it! Enjoy and Happy Hunting!

You will always remember this as the day you finally caught FamousSparrow
welivesecurity.com/en/eset-res

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

www.welivesecurity.comYou will always remember this as the day you finally caught FamousSparrowESET researchers uncover the toolset used by the FamousSparrow APT group, including two undocumented versions of the group’s signature backdoor, SparrowDoor.
Public
Just Another Blue Teamer

Happy Wednesday!

I know this is a repeat of yesterday, but tomorrow is the day! You still have time to register and get your community HUNTER account before we begin! I look forward to seeing you there! Happy Hunting!
linkedin.com/events/threathunt

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #workshop #webinar

www.linkedin.comThreat Hunting Foundations Workshop: Moving Beyond IOCs to Behaviors & TTPs | LinkedInThis four-hour workshop equips veteran threat hunters, SOC analysts, and cybersecurity professionals with the skills to move beyond traditional indicators of compromise (IOCs) and focus on behaviors and tactics, techniques, and procedures (TTPs). Through a combination of foundational instruction and hands-on exercises, attendees will gain a structured approach to identifying, investigating, and responding to threats. The workshop begins with a lecture covering key cybersecurity models, including the Pyramid of Pain, Lockheed Martin Cyber Kill Chain, Unified Kill Chain, and MITRE ATT&CK Framework. Participants will explore common threat-hunting tools and methodologies before breaking down the six-phase threat-hunting process, with a focus on practical application. In the hands-on lab, attendees will apply these concepts by operationalizing an intelligence report, forming hypotheses, and conducting a structured hunt. They will execute queries, pivot through data to build context, and identify relationships between events. The session concludes with guidance on documenting and presenting findings effectively. Key Takeaways: - Understand core cybersecurity models and their role in threat hunting. - Learn how to operationalize threat intelligence and develop hypotheses. - Gain hands-on experience executing and refining hunt queries. - Identify and analyze adversary behaviors through structured methodologies. - Improve documentation and reporting techniques for threat-hunting investigations. This interactive workshop provides both the theoretical foundation and technical skills necessary to improve threat-hunting capabilities and uncover adversary behaviors more effectively. After the workshop, attendees can complete a final challenge to earn the Threat Hunting – Foundational Badge, recognizing their ability to apply core threat-hunting concepts. The challenge reinforces key skills, including hypothesis-driven hunting, executing queries, analyzing adversary behaviors, and documenting findings. Successfully completing it demonstrates proficiency in behavioral analysis and structured threat detection.
Public
Just Another Blue Teamer

Happy Monday everyone!

Coming out of a brief lull in activity, I have a #readoftheday for you! This comes from a CYFIRMA article that takes a look at the APT #VoltTyphoon. They share vulnerabilities that have been recently exploited and (my favorite part) recent #TTPs and #behaviors that are associated with the group! I like how well it is documented that I am not even going to recreate it here! I will definitely diving back into their archives to see if there are more of these profile articles! Enjoy and Happy Hunting!

APT PROFILE – VOLT TYPHOON
cyfirma.com/research/apt-profi

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

CYFIRMAAPT PROFILE - VOLT TYPHOON - CYFIRMAVolt Typhoon is a Chinese state-sponsored hacker group that has been targeting critical infrastructure in the United States and other...
Public
Just Another Blue Teamer

Happy Monday everyone!

Today's #readoftheday is brought to you by Trend Micro and they share their findings related to #BlackBasta and #CactusRansomware adding a piece of malware known as #BackConnect to their toolbox.

The report states "The BackConnect malware is a tool that cybercriminals use to establish and maintain persistent control over compromised systems. Once infiltrated, it grants attackers a wide range of remote control capabilities, allowing them to execute commands on the infected machine. This enables them to steal sensitive data, such as login credentials, financial information, and personal files."

Behaviors (MITRE ATT&CK):
Initial Access - TA0001:
Phishing: Spearphishing Voice - T1566.004 - The attackers conducted an email bombing campaign then contacted the victim posing as "IT Support" or "HelpDesk".

Command and Control - TA0011:
Remote Access Software - T1219 -
The attackers used QuickAssist to access the victim's environment once they were successfully social engineered.

Lateral Movement - TA0008:
Remote Services: SMB/ Windows Admin Shares - T1021.002 -
Remote Services: Windows Remote Management - T1021.006
The attackers leveraged both SMB, shared folders, and WinRM for lateral movement.

Go check out the rest of the technical details! Enjoy and Happy Hunting!

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal
trendmicro.com/en_us/research/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Trend Micro · Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal
Public
Just Another Blue Teamer

Happy Friday everyone!

I feel like this has become a weekly PSA but Kaspersky Securelist researchers have identified hundreds of #GitHub projects that are serving up malicious code designed to steal saved credentials, cryptocurrency wallets, and browsing history. Sometimes this execution of code leads to the #ASyncRAT or #Quasar Backdoor, but the threat remains the same: blindly executing code from GitHub. I hope you enjoy and Happy Hunting!

The GitVenom campaign: cryptocurrency theft using GitHub

securelist.com/gitvenom-campai

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Kaspersky · The GitVenom campaign: cryptocurrency theft using GitHubBy Georgy Kucherin
Public
Just Another Blue Teamer

Good day everyone!

An APT group known as Angry Likho (a.k.a. Sticky Werewolf) is being monitored by Kaspersky's Securelist researchers and they have identified hundreds of victims of a recent attack in Russia, several in Belarus, and additional incidents in other countries. They used an age-old technique of spear-phishing to gain initial access that had various attachments that would contain the legitimate bait file as well as other files, in some cases malicious LNK files. Execution would lead to a newly discovered implant named FrameworkSurvivor.exe.

As usual, check out all the juicy details that I left out and enjoy the read! Happy Hunting!

Angry Likho: Old beasts in a new forest
securelist.com/angry-likho-apt

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Kaspersky · Angry Likho: Old beasts in a new forestBy Kaspersky
Public
Just Another Blue Teamer

Good day everyone!

Forescout Technologies Inc. researchers identified a malware cluster that masqueraded as MediaViewerLauncher.exe, the primary executable for the Philips DICOM viewer that has been associated with the Chinese APT #SilverFox. When downloaded, these executables led to the deployment of the #ValleyRAT (Remote Access Trojan), a backdoor, keylogger, and a crypto miner on victim computers.

Behaviors (MITRE ATT&CK):
Discovery - TA0007
System Network Configuration Discovery: Internet Connection Discovery - T1016.001: Living-off-the-land binaries are used to check if the system can reach the C2 server.

Persistence - TA0003:
Scheduled Task/Job: Scheduled Task - T1053.003:
The malware creates a scheduled task that will trigger on logon for persistence.

Healthcare Malware Hunt, Part 1: Silver Fox APT Targets Philips DICOM Viewers
lnkd.in/ghQS3nwv

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #readoftheday #HappyHunting

lnkd.inLinkedInThis link will take you to a page that’s not on LinkedIn
Public
Just Another Blue Teamer

Happy Monday everyone!

The AhnLab, Inc. Security Intelligence Center (ASEC) has been monitoring infostealer malware that is disguised as illegal software and keygens and found that most of the malware that is distributed in this manner has been the #LummaC2 infostealer BUT there has been an increase in distribution of the #ACRStealer as well. What is pretty interesting is the technique they use for C2. In this case they have used Steam, telegra.ph, Google Docs (Form) and Google Docs (Presentation). Enjoy and Happy Hunting!

ACRStealer Infostealer Exploiting Google Docs as C2
asec.ahnlab.com/en/86390/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

ASEC · ACRStealer Infostealer Exploiting Google Docs as C2 - ASECAhnLab SEcurity intelligence Center (ASEC) monitors the Infostealer malware disguised as illegal programs such as cracks and keygens being distributed, and publishes related trends and changes through the Ahnlab TIP and ASEC Blog posts. While the majority of the malware distributed in this manner has been the LummaC2 Infostealer, the ACRStealer Infostealer has seen an […]
ExploreLive feeds
About