Author Archives: SANS Internet Storm Center, InfoCON: green

The Internet Storm Center relies on a group of Handlers[1] who are volunteers and offer some free time to the community besides our daily job. Sometimes, we share information between us about an incident or a problem that we are facing and ask for help. Indeed, why not request some help from fellow Handlers with broad experience? Yesterday, Bojan was involved in an incident with a customer and came back to us with this question:

Continue reading Obscure Wininet.dll Feature? , (Fri, Jan 21st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, January 21st, 2022 https://isc.sans.edu/podcastdetail.html?id=7846, (Fri, Jan 21st)→

Here is a piece of malicious Python script that injects a RedLine&#;x26;#;x5b;1&#;x26;#;x5d; stealer into its own process. Process injection is a common attacker&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;s technique these days (for a long time already). The difference, in this case, is that the payload is delivered through FTP&#;x26;#;x21; It&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;s pretty unusual because FTP is today less and less used for multiple reasons (lack of encryption by default, complex to filter with those passive/active modes). Support for FTP has even been disabled by default in Chrome starting with version 95&#;x26;#;x21; But&#;x26;#;xc2;&#;x26;#;xa0;FTP remains a common protocol in the IoT/Linux landscape with malware families like Mirai. My honeypots still collect a lot of Mirai samples on FTP servers. I don&#;x26;#;39;t understand why the attacker chose this protocol because, in most corporate environments,&#;x26;#;xc2;&#;x26;#;xa0;FTP is not allowed by default (and should definitely not be&#;x26;#;x21;).

Continue reading RedLine Stealer Delivered Through FTP, (Thu, Jan 20th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, January 20th, 2022 https://isc.sans.edu/podcastdetail.html?id=7844, (Thu, Jan 20th)→

Introduction

Continue reading 0.0.0.0 in Emotet Spambot Traffic, (Wed, Jan 19th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, January 19th, 2022 https://isc.sans.edu/podcastdetail.html?id=7842, (Wed, Jan 19th)→

Authors of phishing and malspam messages like to use various techniques to make their creations appear as legitimate as possible in the eyes of the recipients. To this end, they often try to make their messages look like reports generated by security tools[1], responses to previous communication initiated by the recipient[2], or instructions from someone at the recipients organization[3], just to name a few. Most such techniques have been with us for a long time, however, last week I came across one that I don’t believe I’ve ever seen before – inclusion of what may be thought of as an advertisement in the body of the message.

Continue reading Phishing e-mail with…an advertisement?, (Tue, Jan 18th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 18th, 2022 https://isc.sans.edu/podcastdetail.html?id=7840, (Tue, Jan 18th)→

Ever since news of the Log4Shell vulnerability broke, we saw a stream of attacks attempting to exploit this vulnerability in log4j (%%cve:2021-44228%%).

Continue reading Log4Shell Attacks Getting “Smarter”, (Mon, Jan 17th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 17th, 2022 https://isc.sans.edu/podcastdetail.html?id=7838, (Mon, Jan 17th)→