Actual threat intelligence! A few friends and I identified a new reverse phishing campaign leveraging Entra Guest User invitations.

This campaign was newly discovered and corroborated. I recommend reviewing organization email for these invitations.

https://taggart-tech.com/entra-toad/

#ThreatIntel #ThreatIntelligence

Heads up if you're unfortunate enough to be an M365 / Entra shop. There is a TOAD / phishing campaign going on targeting M365 tenants and because the senders are also MS tenants, they tend to be allowed.

https://blog.gayint.org/entraPhishing.html

#GAYINT #FURINT #threatIntel

Heads up if you're unfortunate enough to be an M365 / Entra shop. There is a TOAD / phishing campaign going on targeting M365 tenants and because the senders are also MS tenants, they tend to be allowed.

https://blog.gayint.org/entraPhishing.html

#GAYINT #FURINT #threatIntel

Actual threat intelligence! A few friends and I identified a new reverse phishing campaign leveraging Entra Guest User invitations.

This campaign was newly discovered and corroborated. I recommend reviewing organization email for these invitations.

https://taggart-tech.com/entra-toad/

#ThreatIntel #ThreatIntelligence

More on the meow attack. FWIW, I am attributing it to the threat actor known as @catsalad .

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-cats-out-of-the-bag-a-meow-attack-data-corruption-campaign-simulation-via-mad-cat/

#threatIntel

Anyone have some FortiShit to test something on?

https://x.com/DefusedCyber/status/1986544427121471513

⚠️Actor mass exploiting unknown Fortinet exploit (FortiWeb path traversal / API exploitation) from 107.152.41.19 🇺🇸 ( TZULO )

VirusTotal Detections 0/95 🟢

After the exploit, the actor attempted to login using the newly created username-credential pair 🔐

#RUMINT #threatIntel

More on the meow attack. FWIW, I am attributing it to the threat actor known as @catsalad .

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-cats-out-of-the-bag-a-meow-attack-data-corruption-campaign-simulation-via-mad-cat/

#threatIntel

Anyone have some FortiShit to test something on?

https://x.com/DefusedCyber/status/1986544427121471513

⚠️Actor mass exploiting unknown Fortinet exploit (FortiWeb path traversal / API exploitation) from 107.152.41.19 🇺🇸 ( TZULO )

VirusTotal Detections 0/95 🟢

After the exploit, the actor attempted to login using the newly created username-credential pair 🔐

#RUMINT #threatIntel

Huntress has published an article about Gootloader with an absolutely ridiculous amount of IoCs to hunt for, beyond an already excellent technical deep dive.

https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation

Raising the bar?

#ThreatIntel #Cybersecurity

New UI to RansomLook.io

The open source project providing real-time ransomware intelligence.

Thanks to @F_kZ_ for the incredible work.

#ransomware #threatintelligence #threatintel #opensource

🔗 https://www.ransomlook.io/

Someone asked me to hand-translate a publicly posted Chinese technical report about NSA shenanigans on the Chinese Center for Time-Keeping network. It took me a while, because it turns out translating technical corporatese from your third language is very hard when chronically sleep deprived, but it is done.

https://docs.google.com/document/d/1gk1fDLKrN3m5jOSk7QbpGL1SBcLvrm0FTN3H-5ZJZcY/edit?usp=sharing

#nsa #fiveeyes #opsec #infosec #threatintel

High confidence of a data breach targeting the UK 🇬🇧 Government Administration sector. Alleged leak of Ministry of Justice court documents. #DataBreach #CyberSecurity #ThreatIntel

Someone asked me to hand-translate a publicly posted Chinese technical report about NSA shenanigans on the Chinese Center for Time-Keeping network. It took me a while, because it turns out translating technical corporatese from your third language is very hard when chronically sleep deprived, but it is done.

https://docs.google.com/document/d/1gk1fDLKrN3m5jOSk7QbpGL1SBcLvrm0FTN3H-5ZJZcY/edit?usp=sharing

#nsa #fiveeyes #opsec #infosec #threatintel

Someone asked me to hand-translate a publicly posted Chinese technical report about NSA shenanigans on the Chinese Center for Time-Keeping network. It took me a while, because it turns out translating technical corporatese from your third language is very hard when chronically sleep deprived, but it is done.

https://docs.google.com/document/d/1gk1fDLKrN3m5jOSk7QbpGL1SBcLvrm0FTN3H-5ZJZcY/edit?usp=sharing

#nsa #fiveeyes #opsec #infosec #threatintel

Quick question to the blue teamers out there:

What's your take on MITRE ATT&CK Tactics and Techniques? Do you find them useful? If yes, how and in what capacity do you use them? (To the extent that you can and want to share...)

If you could have tactics and techniques extracted from publicly available reports/articles, would that be useful? If yes, why?

(And imagine extracted not just by direct technique referencing, but also indirectly extracted through textual descriptions.)

#Cybersecurity #Infosec #Threatintel

GitHub User Compromised with Invisible Malware

https://www.aikido.dev/blog/the-return-of-the-invisible-threat-hidden-pua-unicode-hits-github-repositorties

Updates on Glassworm.

#ThreatIntel #Cybersecurity

I think a whole bunch of orgs probably need to start rotating certificates and such. #threatintel

I think a whole bunch of orgs probably need to start rotating certificates and such. #threatintel

The Red Hat Consulting LAPSUS$ saga continues - in the past hour they've released a 2.2gb ZIP file.

#threatintel

The Scattered Lapsus$ Hunters portal has 25 victim orgs posted so far, they're an average of about one every 10 minutes.

I've talked to one of the victim orgs - their sample data is indeed from their Salesforce instance. Gonna be a long weekend for a bunch of orgs. Each org also has sample downloads up too.

#threatintel