Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
bolha.us is one of the many independent Mastodon servers you can use to participate in the fediverse.
We're a Brazilian IT Community. We love IT/DevOps/Cloud, but we also love to talk about life, the universe, and more. | Nós somos uma comunidade de TI Brasileira, gostamos de Dev/DevOps/Cloud e mais!

Administered by:

Server stats:

255
active users

bolha.us: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#APT

13 posts9 participants2 posts today
VulDB :verified:<p>We have improved indicators: MetaStealer (+1), DarkVision RAT (+1), Kimsuky (+1), Mozi (+1), Ghost RAT (+1), Mirai (+1) and Amadey (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?actor</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ioc</span></a></p>
Hacker News<p>Attune – Build and publish APT repositories in seconds</p><p><a href="https://github.com/attunehq/attune" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/attunehq/attune</span><span class="invisible"></span></a></p><p><a href="https://mastodon.social/tags/HackerNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HackerNews</span></a> <a href="https://mastodon.social/tags/Attune" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Attune</span></a> <a href="https://mastodon.social/tags/APT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>APT</span></a> <a href="https://mastodon.social/tags/repositories" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>repositories</span></a> <a href="https://mastodon.social/tags/Build" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Build</span></a> <a href="https://mastodon.social/tags/Publish" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Publish</span></a> <a href="https://mastodon.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OpenSource</span></a> <a href="https://mastodon.social/tags/DevTools" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DevTools</span></a></p>
securityaffairs<p><a href="https://infosec.exchange/tags/China" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>China</span></a>-linked <a href="https://infosec.exchange/tags/APT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>APT</span></a> <a href="https://infosec.exchange/tags/Mustang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Mustang</span></a> <a href="https://infosec.exchange/tags/Panda" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Panda</span></a> upgrades tools in its arsenal<br><a href="https://securityaffairs.com/176662/apt/china-linked-apt-mustang-panda-upgrades-tools-in-its-arsenal.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">securityaffairs.com/176662/apt</span><span class="invisible">/china-linked-apt-mustang-panda-upgrades-tools-in-its-arsenal.html</span></a><br><a href="https://infosec.exchange/tags/securityaffairs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>securityaffairs</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malware</span></a></p>
VulDB :verified:<p>We have added indicators: Latrodectus (+1), Orcus RAT (+1), Rhadamanthys (+1), Meterpreter (+1), Xtreme RAT (+1), DarkComet (+1) and MooBot (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?actor</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ioc</span></a></p>
VulDB :verified:<p>Our CTI team identifies elevated offensive activities for products of the category WordPress Plugin <a href="https://vuldb.com/?type.wordpress_plugin" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">vuldb.com/?type.wordpress_plug</span><span class="invisible">in</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a></p>
VulDB :verified:<p>We have updated indicators: BlackShades (+1), NjRAT (+2), SquidLoader (+1), Quasar RAT (+1), QakBot (+3), Stealc (+1) and DOPLUGS (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?actor</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ioc</span></a></p>
VulDB :verified:<p>We have updated these actors: Ares (+1), VipersoftX (+2), Slow Pisces (+3), Trox (+1), 8585.bio (+1), MisCloud (+1) and Rbx2.net (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?actor</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ioc</span></a></p>
VulDB :verified:<p>Improved indicators: Rhadamanthys (+2), QakBot (+1), MooBot (+2), ERMAC (+1), NjRAT (+1), Stealc (+13) and NetSupportManager RAT (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?actor</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ioc</span></a></p>
VulDB :verified:<p>A lot of offensive activity is originating from USA <a href="https://vuldb.com/?country.us" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?country.us</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/usa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>usa</span></a> <a href="https://infosec.exchange/tags/country" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>country</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a></p>
VulDB :verified:<p>Indicators added for: Rhadamanthys (+1), DOPLUGS (+1), SectopRAT (+1), Kaiji (+1), XWorm (+1), BlackShades (+1) and Ghost RAT (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?actor</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ioc</span></a></p>
VulDB :verified:<p>We have identified elevated activities targeting products by IBM <a href="https://vuldb.com/?vendor.ibm" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?vendor.ibm</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/ibm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ibm</span></a> <a href="https://infosec.exchange/tags/vendor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>vendor</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a></p>
VulDB :verified:<p>Added some more indicators for: Bashlite (+1), ShadowPad (+1), Matanbuchus (+1), Sliver (+2), Eye Pyramid (+1), Brute Ratel C4 (+1) and Venom RAT (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?actor</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ioc</span></a></p>
VulDB :verified:<p>There is an unusual high amount of activity targeting products by Linux <a href="https://vuldb.com/?vendor.linux" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?vendor.linux</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>linux</span></a> <a href="https://infosec.exchange/tags/vendor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>vendor</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a></p>
VulDB :verified:<p>Added more indicators for: Chaos (+1), Mozi (+4), Kaiji (+2), Wang Duo Yu (+3), SpyNote (+1), DOPLUGS (+1) and Quasar RAT (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?actor</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ioc</span></a></p>
securityaffairs<p>An <a href="https://infosec.exchange/tags/APT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>APT</span></a> group exploited <a href="https://infosec.exchange/tags/ESET" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ESET</span></a> flaw to execute <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malware</span></a><br><a href="https://securityaffairs.com/176364/security/an-apt-group-exploited-eset-flaw-to-execute-malware.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">securityaffairs.com/176364/sec</span><span class="invisible">urity/an-apt-group-exploited-eset-flaw-to-execute-malware.html</span></a><br><a href="https://infosec.exchange/tags/securityaffairs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>securityaffairs</span></a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>hacking</span></a></p>
VulDB :verified:<p>Added some indicators for: Stealc (+1), Quasar RAT (+1), Bashlite (+1), Chaos (+1), Mirai (+16), PoshC2 (+1) and Venom RAT (+2). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?actor</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ioc</span></a></p>
VulDB :verified:<p>Added indicators for: Orcus RAT (+1), SectopRAT (+1), Bashlite (+1), NjRAT (+1), ShadowPad (+1), Tofsee (+2) and Rhadamanthys (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?actor</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ioc</span></a></p>
VulDB :verified:<p>New indicators for: RedLine Stealer (+1), Houdini (+1), XWorm (+2), Ghost RAT (+1), QakBot (+1), Chaos (+1) and NetSupportManager RAT (+5). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?actor</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ioc</span></a></p>
VulDB :verified:<p>A lot of offensive activity is originating from USA <a href="https://vuldb.com/?country.us" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vuldb.com/?country.us</span><span class="invisible"></span></a> <a href="https://infosec.exchange/tags/usa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>usa</span></a> <a href="https://infosec.exchange/tags/country" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>country</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apt</span></a></p>
Christoffer S.<p>(google.com / Mandiant) Windows Remote Desktop Protocol: Remote to Rogue - Analysis of Novel Russian APT Campaign </p><p><a href="https://cloud.google.com/blog/topics/threat-intelligence/windows-rogue-remote-desktop-protocol/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">cloud.google.com/blog/topics/t</span><span class="invisible">hreat-intelligence/windows-rogue-remote-desktop-protocol/</span></a></p><p>As always a very good write-up and detailed analysis of some novel use of RDP by Russian APTs. Involves signed RDP, and interesting proxy-behaviour.</p><p>Worth reading (as always!)</p><p><a href="https://swecyb.com/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a> <a href="https://swecyb.com/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://swecyb.com/tags/Russia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Russia</span></a> <a href="https://swecyb.com/tags/APT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>APT</span></a> <a href="https://swecyb.com/tags/RDP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RDP</span></a> #</p>
ExploreLive feeds
About