Author Archives: SANS Internet Storm Center, InfoCON: green

Increase in the number of phishing messages pointing to IPFS and to R2 buckets, (Thu, Mar 14th)

Posted on by

Credential-stealing phishing is constantly evolving, nevertheless, some aspects of it – by necessity – stay the same. One thing, which is constant, is the need for a credential gathering mechanism, and although threat actors have come up with a number of alternatives to simply hosting a fake login page somewhere (e.g., using a third-party “forms” service[1] or attaching an entire phishing page to an e-mail[2]), the old approach of placing a phishing page on an internet-connected server and linking to it from e-mail messages is commonly used to this day.

Continue reading Increase in the number of phishing messages pointing to IPFS and to R2 buckets, (Thu, Mar 14th)→

Posted in Uncategorized

Using ChatGPT to Deobfuscate Malicious Scripts, (Wed, Mar 13th)

Posted on by

Today, most of the malicious scripts in the wild are heavily obfuscated. Obfuscation is key to slow down the security analyst&#;x26;#;39;s job and to bypass simple security controls. They are many techniques available. Most of the time, your trained eyes can spot them in a few seconds but it remains a pain to process manually. How to handle them? For soe of them, you have tools like numbers-to-strings.py[1], developed by Didier, to convert classic encodings back to strings. Sometimes, you can write your own script (time consuming) or use a Cyberchef recipe. To speed up the analysis, why not ask some help to AI tools? Let&#;x26;#;39;s see a practical example with ChatGPT.

Continue reading Using ChatGPT to Deobfuscate Malicious Scripts, (Wed, Mar 13th)→

Posted in Uncategorized