Mastodon

emt Technology DistributionAre you ready to outsmart cyber threats with advanced adversary simulation? 🤖It's time to master the art of Adversary Simulation with @Fortra Cobalt Strike!Simulate advanced adversary tactics, collaborate on realistic red team engagements, and elevate your operations with a flexible and innovative framework. 👉Request a Demo with <a href="https://mastodon.social/@emt" class="u-url mention">@emt</a> Distribution META: <a href="https://zurl.co/4PRzL" target="_blank" rel="nofollow noopener" translate="no">https://zurl.co/4PRzL</a> <a href="https://mastodon.social/tags/CobaltStrike" class="mention hashtag" rel="tag">#CobaltStrike</a> <a href="https://mastodon.social/tags/RedTeaming" class="mention hashtag" rel="tag">#RedTeaming</a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="tag">#CyberSecurity</a> <a href="https://mastodon.social/tags/AdversarySimulation" class="mention hashtag" rel="tag">#AdversarySimulation</a> <a href="https://mastodon.social/tags/emtDisti" class="mention hashtag" rel="tag">#emtDisti</a>

Sajid Nawaz Khan :donor:For hobbyist Cobalt Strike Beacon collectors, note that the recently announced 4.11 update introduces a number of changes to frustrate Beacon configuration extraction, namely through the new `transform-obfuscate` field.When set, this field can apply multiple layers of encoding, encryption and compression (with some recent Beacons observed with a 32 byte XOR key, configurable upto 2048 bytes!).While still reasonably trivial to decode manually, standard automated workflows (say, through the SentinelOne parser) will now fail, not least because of changes to the well-known field markers.Beacons with these characteristics have thus far been observed with watermarks indicative of licensed instances, though I imagine it is only a matter of time before the 4.11 capabilities become accessible to all manner of miscreants.A sample configuration, via a staged Beacon on 104.42.26[.]200 is attached, including the three distinct XOR keys used to decode it.<a href="https://www.cobaltstrike.com/blog/cobalt-strike-411-shh-beacon-is-sleeping" rel="nofollow noopener" translate="no" target="_blank">https://www.cobaltstrike.com/blog/cobalt-strike-411-shh-beacon-is-sleeping</a><a href="https://infosec.exchange/tags/cobaltstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#cobaltstrike</a> <a href="https://infosec.exchange/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#malwareanalysis</a> <a href="https://infosec.exchange/tags/forensics" class="mention hashtag" rel="nofollow noopener" target="_blank">#forensics</a> <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#blueteam</a>

Red-Team NewsNew analysis: <a href="https://infosec.exchange/tags/TrojanW97M" class="mention hashtag" rel="nofollow noopener" target="_blank">#TrojanW97M</a> exploits <a href="https://infosec.exchange/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE</a>-2021-40444 in Office docs to run remote code, dropping <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a> beacons. Patch now and watch for suspicious CAB/DLL files. Details: <a href="https://redteamnews.com/exploit/cve/trojan-w97m-cve202140444-a-analyzing-the-microsoft-office-exploit-that-enables-remote-code-execution/" rel="nofollow noopener" translate="no" target="_blank">https://redteamnews.com/exploit/cve/trojan-w97m-cve202140444-a-analyzing-the-microsoft-office-exploit-that-enables-remote-code-execution/</a>

The Threat CodexCobalt Strike 4.11: Shhhhhh, Beacon is Sleeping.... <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a> <a href="https://www.cobaltstrike.com/blog/cobalt-strike-411-shh-beacon-is-sleeping" rel="nofollow noopener" translate="no" target="_blank">https://www.cobaltstrike.com/blog/cobalt-strike-411-shh-beacon-is-sleeping</a>

Sajid Nawaz Khan :donor:If you're not already blocking DoH services through your proxy, now might be a good time to re-evaluate:"Cobalt Strike 4.11 introduces a DNS over HTTPS (DoH) Beacon, which provides another stealthy network egress option for Cobalt Strike users. Assuming DNS C2 infrastructure has already been configured, using the DoH Beacon is as simple as enabling it on payload generation, as demonstrated below, and it will run out-of-the-box with all the default options.By default, Beacon will use mozilla.cloudflare-dns.com,cloudflare-dns.com as its target DoH-compatible DNS server. However, you can configure Beacon’s DoH settings via Malleable C2”:<a href="https://www.cobaltstrike.com/blog/cobalt-strike-411-shh-beacon-is-sleeping" rel="nofollow noopener" translate="no" target="_blank">https://www.cobaltstrike.com/blog/cobalt-strike-411-shh-beacon-is-sleeping</a> <a href="https://infosec.exchange/tags/cobaltstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#cobaltstrike</a>

OTX BotSouth Korean Organizations Targeted by Cobalt Strike 'Cat' Delivered by a Rust BeaconAn exposed web server containing tools for an intrusion campaign targeting South Korean organizations was identified. The server hosted a Rust-compiled Windows executable delivering Cobalt Strike Cat, along with SQLMap, Web-SurvivalScan, and dirsearch. The threat actor used these tools to identify and exploit vulnerable web applications, targeting government and commercial entities. The campaign utilized a Rust-compiled loader with a modified version of Cobalt Strike, providing insight into the actor's malware delivery and post-exploitation techniques. Analysis revealed reconnaissance tools, SQL injection exploitation, and malware delivery components, with logs confirming beacon activity from compromised hosts. The attackers used MinGW- and Rust-compiled loaders to deploy Cobalt Strike Cat and Marte shellcode.Pulse ID: 67d9dea6c8851b91e47b9b5e Pulse Link: <a href="https://otx.alienvault.com/pulse/67d9dea6c8851b91e47b9b5e" rel="nofollow noopener" translate="no" target="_blank">https://otx.alienvault.com/pulse/67d9dea6c8851b91e47b9b5e</a> Pulse Author: AlienVault Created: 2025-03-18 20:59:18Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/Government" class="mention hashtag" rel="nofollow noopener" target="_blank">#Government</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/Korea" class="mention hashtag" rel="nofollow noopener" target="_blank">#Korea</a> <a href="https://social.raytec.co/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/Rust" class="mention hashtag" rel="nofollow noopener" target="_blank">#Rust</a> <a href="https://social.raytec.co/tags/SQL" class="mention hashtag" rel="nofollow noopener" target="_blank">#SQL</a> <a href="https://social.raytec.co/tags/ShellCode" class="mention hashtag" rel="nofollow noopener" target="_blank">#ShellCode</a> <a href="https://social.raytec.co/tags/SouthKorea" class="mention hashtag" rel="nofollow noopener" target="_blank">#SouthKorea</a> <a href="https://social.raytec.co/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener" target="_blank">#AlienVault</a>

OTX BotUnmasking the new persistent attacks on JapanAn unknown attacker has been targeting organizations in Japan since January 2025, exploiting CVE-2024-4577, a remote code execution vulnerability in PHP-CGI on Windows. The attacker uses the Cobalt Strike kit 'TaoWu' for post-exploitation activities, including reconnaissance, privilege escalation, persistence establishment, and credential theft. Targeted sectors include technology, telecommunications, entertainment, education, and e-commerce. The attack involves exploiting the vulnerability, executing PowerShell scripts, and using various tools for system compromise. The attacker's techniques are similar to those of the 'Dark Cloud Shield' group, but attribution remains uncertain. A pre-configured installer script found on the C2 server deploys multiple adversarial tools and frameworks, indicating potential for future attacks.Pulse ID: 67c9f6c4232a8b4665784c45 Pulse Link: <a href="https://otx.alienvault.com/pulse/67c9f6c4232a8b4665784c45" rel="nofollow noopener" translate="no" target="_blank">https://otx.alienvault.com/pulse/67c9f6c4232a8b4665784c45</a> Pulse Author: AlienVault Created: 2025-03-06 19:25:56Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/Cloud" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cloud</a> <a href="https://social.raytec.co/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/Education" class="mention hashtag" rel="nofollow noopener" target="_blank">#Education</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/Japan" class="mention hashtag" rel="nofollow noopener" target="_blank">#Japan</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/PHP" class="mention hashtag" rel="nofollow noopener" target="_blank">#PHP</a> <a href="https://social.raytec.co/tags/PowerShell" class="mention hashtag" rel="nofollow noopener" target="_blank">#PowerShell</a> <a href="https://social.raytec.co/tags/RCE" class="mention hashtag" rel="nofollow noopener" target="_blank">#RCE</a> <a href="https://social.raytec.co/tags/RemoteCodeExecution" class="mention hashtag" rel="nofollow noopener" target="_blank">#RemoteCodeExecution</a> <a href="https://social.raytec.co/tags/Telecom" class="mention hashtag" rel="nofollow noopener" target="_blank">#Telecom</a> <a href="https://social.raytec.co/tags/Telecommunication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Telecommunication</a> <a href="https://social.raytec.co/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerability</a> <a href="https://social.raytec.co/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener" target="_blank">#AlienVault</a>

OTX Bot2024 Malicious Infrastructure Insights: Key Trends and ThreatsThe report highlights significant trends in malicious infrastructure for 2024, including the rise of malware-as-a-service infostealers, continued dominance of Cobalt Strike among offensive security tools, and increased use of legitimate services by threat actors. Key findings include LummaC2's dominance in command-and-control servers, AsyncRAT and Quasar RAT remaining top remote access tools, and Android being the primary target for mobile malware. The US and China were the top malicious hosting locations, while traffic distribution systems enhanced cybercrime efficiency. Chinese state-sponsored groups expanded their use of relay networks, and Russian groups increasingly relied on legitimate services to evade detection. The report suggests defenders should prioritize top malware and infrastructure techniques, enhance network monitoring, and balance blocking high-risk services based on criticality and risk level.Pulse ID: 67c200b060cf2c2afc6913f0 Pulse Link: <a href="https://otx.alienvault.com/pulse/67c200b060cf2c2afc6913f0" rel="nofollow noopener" translate="no" target="_blank">https://otx.alienvault.com/pulse/67c200b060cf2c2afc6913f0</a> Pulse Author: AlienVault Created: 2025-02-28 18:30:08Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#Android</a> <a href="https://social.raytec.co/tags/AsyncRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#AsyncRAT</a> <a href="https://social.raytec.co/tags/China" class="mention hashtag" rel="nofollow noopener" target="_blank">#China</a> <a href="https://social.raytec.co/tags/Chinese" class="mention hashtag" rel="nofollow noopener" target="_blank">#Chinese</a> <a href="https://social.raytec.co/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a> <a href="https://social.raytec.co/tags/CyberCrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberCrime</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/InfoStealer" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoStealer</a> <a href="https://social.raytec.co/tags/LummaC2" class="mention hashtag" rel="nofollow noopener" target="_blank">#LummaC2</a> <a href="https://social.raytec.co/tags/Mac" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mac</a> <a href="https://social.raytec.co/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a> <a href="https://social.raytec.co/tags/MalwareAsAService" class="mention hashtag" rel="nofollow noopener" target="_blank">#MalwareAsAService</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/RAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#RAT</a> <a href="https://social.raytec.co/tags/Russia" class="mention hashtag" rel="nofollow noopener" target="_blank">#Russia</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener" target="_blank">#AlienVault</a>

Inferior Being 🔞⚛️Because the infosec community is too beholden to the corporations and are afraid of sharing information, here's the BlackBasta chat logs: <a href="https://drive.proton.me/urls/6QXMTA2M8C#YbYBbPXiE7eJ" target="_blank" rel="nofollow noopener" translate="no">https://drive.proton.me/urls/6QXMTA2M8C#YbYBbPXiE7eJ</a><a href="https://mastodon.social/tags/blackbasta" class="mention hashtag" rel="tag">#blackbasta</a> <a href="https://mastodon.social/tags/theratintel" class="mention hashtag" rel="tag">#theratintel</a> <a href="https://mastodon.social/tags/cti" class="mention hashtag" rel="tag">#cti</a> <a href="https://mastodon.social/tags/BlackBasta" class="mention hashtag" rel="tag">#BlackBasta</a> <a href="https://mastodon.social/tags/CobaltStrike" class="mention hashtag" rel="tag">#CobaltStrike</a>

SaltmyhashBlackBasta Data Leak Analysis: CobaltStrike Team ServersRetrohunt for outbound connections to these addresses. Validate your own CTI findings as a result of any potential hits in your environment. I’m just a person on the internet sharing information.91[.]191[.]209[.]70 88[.]119[.]170[.]162 78[.]128[.]113[.]102 70[.]34[.]211[.]31 51[.]89[.]62[.]218 51[.]222[.]194[.]208 5[.]78[.]41[.]126 5[.]188[.]206[.]50 5[.]161[.]227[.]233 47[.]250[.]58[.]195 45[.]227[.]254[.]7 216[.]146[.]25[.]72 206[.]71[.]148[.]41 206[.]189[.]62[.]224 203[.]23[.]128[.]72 198[.]27[.]121[.]195 194[.]32[.]77[.]162 194[.]165[.]17[.]9 194[.]165[.]16[.]19 193[.]149[.]176[.]38 192[.]153[.]57[.]252 179[.]60[.]149[.]10 172[.]86[.]98[.]173 168[.]119[.]110[.]217 167[.]114[.]199[.]75 165[.]22[.]8[.]91 151[.]80[.]52[.]32 15[.]204[.]170[.]49 147[.]182[.]231[.]59 142[.]93[.]146[.]149 141[.]98[.]9[.]152 141[.]98[.]81[.]48 128[.]140[.]36[.]37 104[.]248[.]175[.]193 104[.]156[.]59[.]220<a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/BlackBasta" class="mention hashtag" rel="nofollow noopener" target="_blank">#BlackBasta</a> <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a>

Anonymous 🐈️🐾☕🍵🏴🇵🇸 :af:Software vendor Trimble is warning that hackers are exploiting a Cityworks deserialization vulnerability to remotely execute commands on IIS servers and deploy Cobalt Strike beacons for initial network access. <a href="https://kolektiva.social/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a> <a href="https://kolektiva.social/tags/haking" class="mention hashtag" rel="nofollow noopener" target="_blank">#haking</a> <a href="https://www.bleepingcomputer.com/news/security/hackers-exploit-cityworks-rce-bug-to-breach-microsoft-iis-servers/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/hackers-exploit-cityworks-rce-bug-to-breach-microsoft-iis-servers/</a>

dritsec<a href="https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/" rel="nofollow noopener" translate="no" target="_blank">https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/</a>Interesting Case Study by dfirreport<a href="https://social.tchncs.de/tags/dfir" class="mention hashtag" rel="nofollow noopener" target="_blank">#dfir</a> <a href="https://social.tchncs.de/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#blueteam</a> <a href="https://social.tchncs.de/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://social.tchncs.de/tags/cobaltstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#cobaltstrike</a> <a href="https://social.tchncs.de/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#ransomware</a> <a href="https://social.tchncs.de/tags/LockBitRansomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#LockBitRansomware</a>

emt Technology DistributionAre you ready to outsmart cyber threats with advanced adversary simulation? 🤖It's time to master the art of Adversary Simulation with @Fortra Cobalt Strike!Simulate advanced adversary tactics, collaborate on realistic red team engagements, and elevate your operations with a flexible and innovative framework. 👉Request a DEMO with <a href="https://mastodon.social/@emt" class="u-url mention">@emt</a> Distribution META : <a href="https://zurl.co/yxekb" target="_blank" rel="nofollow noopener" translate="no">https://zurl.co/yxekb</a> <a href="https://mastodon.social/tags/CobaltStrike" class="mention hashtag" rel="tag">#CobaltStrike</a> <a href="https://mastodon.social/tags/RedTeaming" class="mention hashtag" rel="tag">#RedTeaming</a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="tag">#CyberSecurity</a> <a href="https://mastodon.social/tags/AdversarySimulation" class="mention hashtag" rel="tag">#AdversarySimulation</a> <a href="https://mastodon.social/tags/emtDisti" class="mention hashtag" rel="tag">#emtDisti</a>

The DFIR ReportStolen Images Campaign Ends in Conti Ransomware➡️Initial Access: Stolen Images IcedID Campaign ➡️Discovery: net, ipconfig, Invoke-ShareFinder, chcp, etc. ➡️Persistence: Scheduled Task & Atera Agent ➡️C2: <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a> & Atera ➡️Impact: Conti Ransomware<a href="https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/" rel="nofollow noopener" translate="no" target="_blank">https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/</a>

Anonymous 🐈️🐾☕🍵🏴🇵🇸 :af:🚨 New red team tool Splinter discovered by Palo Alto's Unit 42. Not as advanced as <a href="https://kolektiva.social/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a>, but still a threat if misused. Built with Rust, it enables process injection & C2 communication.<a href="https://thehackernews.com/2024/09/cybersecurity-researchers-warn-of-new.html" rel="nofollow noopener" translate="no" target="_blank">https://thehackernews.com/2024/09/cybersecurity-researchers-warn-of-new.html</a>Cyber pros, stay alert!<a href="https://kolektiva.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a>

Just Another Blue TeamerHappy Monday everyone!The researchers at Trend Micro witnessed a threat group named <a href="https://ioc.exchange/tags/EarthBaxia" class="mention hashtag" rel="nofollow noopener" target="_blank">#EarthBaxia</a> conducting spear-phishing campaigns and exploiting a vulnerability in the open source geospatial data sharing server, GeoServer. Something interesting to note, and there is a lot here, is that the adversary utilized a tool commonly seen in attacks, which is <a href="https://ioc.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a>. The thing to note here is that they customized the version they had which removed the MZ header, which is most likely a defense-evasion technique to get around security tools. This technique goes to show that while adversaries may continue to use off-the-shelf and publicly available tools, some will go as far as taking the time and effort to modify them to become undetectable. Enjoy and Happy Hunting!Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC <a href="https://www.trendmicro.com/en_us/research/24/i/earth-baxia-spear-phishing-and-geoserver-exploit.html" rel="nofollow noopener" translate="no" target="_blank">https://www.trendmicro.com/en_us/research/24/i/earth-baxia-spear-phishing-and-geoserver-exploit.html</a>Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatHunting</a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#HappyHunting</a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener" target="_blank">#readoftheday</a> Cyborg Security, Now Part of Intel 471

Malwar3Ninja | Threatview.io[Threatview.io] Detection Tip: If you see IP/domain getting blocked with reason - “ET Threatview.io High Confidence Cobalt Strike C2” in your suricata rules. You have blocked and detected <a href="https://infosec.exchange/tags/cobaltstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#cobaltstrike</a> in your network. Please do host analysis to 7nderstand the impact. <a href="https://infosec.exchange/tags/threatfeeds" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatfeeds</a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener" target="_blank">#dfir</a>

Malwar3Ninja | Threatview.io[Threatview.io]⚡️Glad to see <a href="https://infosec.exchange/tags/cobaltstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#cobaltstrike</a> detections based on ioc’s detected by our scanner present in Suricata Signatures - “ET Threatview.io High Confidence Cobalt Strike C2”🚀 More new detection rules updated for c2 & <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#phishing</a><a href="https://infosec.exchange/tags/dfirreport" class="mention hashtag" rel="nofollow noopener" target="_blank">#dfirreport</a><a href="https://thedfirreport.com/2024/08/26/blacksuit-ransomware/" rel="nofollow noopener" translate="no" target="_blank">https://thedfirreport.com/2024/08/26/blacksuit-ransomware/</a>

Anonymous 🐈️🐾☕🍵🏴🇵🇸 :af:<a href="https://kolektiva.social/tags/APT32" class="mention hashtag" rel="nofollow noopener" target="_blank">#APT32</a> has been exploiting spear-phishing to infiltrate and compromise a Vietnamese human rights organization for over four years. They deployed <a href="https://kolektiva.social/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a> Beacons to steal sensitive data, including Google Chrome cookies and personal information. <a href="https://thehackernews.com/2024/08/vietnamese-human-rights-group-targeted.html" rel="nofollow noopener" translate="no" target="_blank">https://thehackernews.com/2024/08/vietnamese-human-rights-group-targeted.html</a>

The Threat CodexBlackSuit Ransomware <a href="https://infosec.exchange/tags/BlackSuitRansomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#BlackSuitRansomware</a> <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a> <a href="https://infosec.exchange/tags/BloodHound" class="mention hashtag" rel="nofollow noopener" target="_blank">#BloodHound</a> <a href="https://infosec.exchange/tags/SystemBC" class="mention hashtag" rel="nofollow noopener" target="_blank">#SystemBC</a> <a href="https://thedfirreport.com/2024/08/26/blacksuit-ransomware/" rel="nofollow noopener" translate="no" target="_blank">https://thedfirreport.com/2024/08/26/blacksuit-ransomware/</a>

Recent searches

Search options

Administered by:

Server stats:

#cobaltstrike

Recent searches

Search options

Administered by:

Server stats:

Cobaltstrike

#cobaltstrike