Threat Intelligence Bulletin – Decentralized Phishing Infrastructure, Top Threat IOCs, and C2-as-a-Service
Most impersonated software according to VirusTotal includes Skype, Adobe Reader, 7-Zip and more
DrayTek routers affected by RCE vulnerability
Phishing attacks increasingly using IPFS network for hosting sites
- https://thehackernews.com/2022/07/researchers-warns-of-increase-in.html
- https://cyware.com/news/rising-number-of-phishing-emails-with-ipfs-urls-327d3f25
VMware command-line utility for Windows Defender used to drop Cobalt Strike
Credential harvesting attack observed utilizing ticking countdown to pressure recipients
Breakdown of most common initial access methods (phishing) and exploited vulnerabilities (ProxyShell)
Most prevalent threats in past week according to Cisco Talos. Shiz RAT, Tofsee malware, and TeslaCrypt ransomware take top spots (link also contains their IOCs)
87% of ransomware found on dark web delivered via macros
Currently active botnet “RapperBot” focuses on brute-forcing Linux SSH servers configured to accept password authentication
VMware bug has potential for threat actor with UI access to obtain administrative privileges without authenticating
Robust new C2-as-a-Service program, Dark Utilities, gaining prevalence