← Feed

Posts

• View post

  RE: https://infosec.exchange/@alexandreborges/117354511098957647 The NCSI service mentioned here is the "Network Connectivity Status Indicator" service, which displays a WiFi or Ethernet icon on Windows' taskbar when it discovers internet access.

• View post

  Your SOC deserves better alerts. FlowCarp helps uncover network activity that traditional detection may miss. https://netresec.com/?b=26A42c0

• View post

  Interesting analysis by Fortinet in their ClingSTUN Linux Backdoor writeup. There's a related blog post by @eFeSpain called Twelve alibis and a mailbox that concludes that only one of the STUN servers that the malware connects to is controlled by the threat actors, the other ones are just decoys. The server believed to belong to the threat actors is 145.249.115.184. That blog post also indicates that this activity seems to be related to the #ngioweb botnet and #NSOCKS service that Lumen re...

• View post

  NetworkMiner 3.2 Released 🔑 RADIUS authentication extraction 🏭 Better OT/ICS protocol parsers for UMAS and IEC-104 📂 Improved file extraction from PCAP https://netresec.com/?b=26Aa0d3

• View post

  New #AtlasRAT loader checks in with "BFuck" and the C2 protocol switched to using TLS 📡 23.226.57.50:443 📡 38.76.177.46:443 📡 43.99.101.175:443 📡 45.142.152.180:443 📡 116.204.169.70:443 📡 150.158.50.175:443 📡 156.234.7.48:443 📡 192.252.180.45:443 https://netresec.com/?b=26A6cc8

• View post

  @da_667 Nice job! Looks like you've got yourself some decrypted HTTP/2 traffic there.

• View post

  @da_667 Wow, sounds like your book will be a MUST READ for anyone in the IDS/NSM field! Feel free to send a DM or email if you have any questions about PolarProxy!

• View post

  @abuse_ch Some smartass has reported blog.xlab.qianxin.com as a compromised ClearFake domain and tagged it #etherhide. The reported blog belongs to a well respected cybersecurity lab in China. The only connection it has to #EtherHiding is that they report on such attack techniques.

• View post

  RE: https://infosec.exchange/@ifin/117434320955324418 This post by @mttaggart explains why threat intel is best shared widely and promptly: sharing the information vastly benefits [the attacked organization] and any other potential victims   accelerate toward disclosure to maximize everyone’s safety The argument strongly resonates with the ideas in our Maximizing IOC Impact blog post, which also emphasizes fast, broad sharing where appropriate.

• View post

  CapLoader 2.2 is here! 🚨 New alert types for abused services ⬆️ Navigate flow transcripts with the arrow keys 🎨 Alert severity row coloring 🔎 Better BPF filter feedback https://netresec.com/?b=26A4762

• View post

  RE: https://infosec.exchange/@josehelps/117502362372160586 Good hunting tips for NSecsoft's #Ping32 RMM tool, which often is abused as a RAT.

• View post

  Only 3 IOCs have been posted to ThreatFox for the confusing catch-all label zgRAT in the past 12 months. Let's clear up any issues and figure out what they actually are. 89.23.103.60:7001 is PureRAT 194.169.175.191:39002 is PureMiner (also tagged correctly as "PUREMINER" by Neiki 🎉 ) 196.251.86.238:56001 is PureRAT

• View post

  The technical detail in this PureRAT analysis by Heejae Hwang (황희재) is fantastic! The analyzed #PureRAT sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.

• View post

  21 of the world's best intelligence and security agencies cannot be wrong... right? https://netresec.com/?b=26233f4