threatintel

Cobalt Stike Beacon Detected – 101[.]42[.]175[.]119:80

June 14, 2022

Cobalt Stike Beacon Detected – 159[.]75[.]252[.]102:443

June 14, 2022

Cobalt Stike Beacon Detected – 81[.]68[.]196[.]206:443

June 14, 2022

Cobalt Stike Beacon Detected – 5[.]61[.]39[.]72:88

June 14, 2022

Cobalt Stike Beacon Detected – 209[.]141[.]33[.]44:4433

June 14, 2022

Cobalt Stike Beacon Detected – 194[.]36[.]188[.]12:443

June 14, 2022

SharpEventPersist – Persistence By Writing/Reading Shellcode From Event Log

June 13, 2022

Persistence by writing/reading shellcode from Event Log. Usage The SharpEventPersist tool takes 4 case-sensitive parameters: -file "C:pathtoshellcode.bin" -instanceid 1337 -source...

US-CERT Bulletin (SB22-164):Vulnerability Summary for the Week of June 6, 2022

June 13, 2022

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards...

Russia-linked APT targets Ukraine by exploiting the Follina RCE vulnerability

June 13, 2022

Ukraine’s Computer Emergency Response Team (CERT) warns that the Russia-linked Sandworm APT group may exploit the Follina RCE vulnerability. Ukraine’s...

Taking down the IP2Scam tech support campaign

June 13, 2022

Tech support scams follow a simple business model that has not changed much over the years. After all, why change...

Cuba Ransomware Victim: Etron

June 13, 2022

Cuba Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of...

GALLIUM APT used a new PingPull RAT in recent campaigns

June 13, 2022

China-linked Gallium APT employed a previously undocumented RAT, tracked as PingPull, in recent cyber espionage campaign targeting South Asia, Europe,...

Update Chrome now: Four high risk vulnerabilities found

June 13, 2022

Users of Chrome have been advised to apply updates as soon as possible related to seven security vulnerabilities. CISA has...

HelloXD Ransomware operators install MicroBackdoor on target systems

June 13, 2022

Experts observed the HelloXD ransomware deploying a backdoor to facilitate persistent remote access to infected hosts. The HelloXD ransomware first appeared...

confluencePot – Simple Honeypot For Atlassian Confluence (CVE-2022-26134)

June 13, 2022

ConfluencePot is a simple honeypot for the Atlassian Confluence unauthenticated and remote OGNL injection vulnerability (CVE-2022-26134). About the vulnerability You...

Serious vulnerabilities found in ITarian software, patches available for SaaS products

June 13, 2022

Dutch research group DIVD has identified multiple vulnerabilities in ITarian products. In cooperation with DIVD, ITarian has made patches available...

LockBit 2.0 Ransomware Victim: ptg[.]com[.]au

June 13, 2022

LockBit 2.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

A week in security (June 6 – June 12)

June 13, 2022

Last week on Malwarebytes Labs: FBI warns of scammers soliciting donations for UkraineMicrosoft autopatch is here…but can you use it?Prometheus...

Cobalt Stike Beacon Detected – 194[.]87[.]70[.]14:8080

June 13, 2022

Cobalt Stike Beacon Detected – 185[.]112[.]83[.]65:443

June 13, 2022

Cobalt Stike Beacon Detected – 82[.]157[.]153[.]129:80

June 13, 2022

Cobalt Stike Beacon Detected – 179[.]43[.]144[.]8:88

June 13, 2022

Cobalt Stike Beacon Detected – 150[.]158[.]212[.]148:10001

June 13, 2022

Cobalt Stike Beacon Detected – 114[.]132[.]163[.]195:443

June 13, 2022

threatintel

Cobalt Stike Beacon Detected – 101[.]42[.]175[.]119:80

Cobalt Stike Beacon Detected – 159[.]75[.]252[.]102:443

Cobalt Stike Beacon Detected – 81[.]68[.]196[.]206:443

Cobalt Stike Beacon Detected – 5[.]61[.]39[.]72:88

Cobalt Stike Beacon Detected – 209[.]141[.]33[.]44:4433

Cobalt Stike Beacon Detected – 194[.]36[.]188[.]12:443

SharpEventPersist – Persistence By Writing/Reading Shellcode From Event Log

US-CERT Bulletin (SB22-164):Vulnerability Summary for the Week of June 6, 2022

Russia-linked APT targets Ukraine by exploiting the Follina RCE vulnerability

Taking down the IP2Scam tech support campaign

Cuba Ransomware Victim: Etron

GALLIUM APT used a new PingPull RAT in recent campaigns

Update Chrome now: Four high risk vulnerabilities found

HelloXD Ransomware operators install MicroBackdoor on target systems

confluencePot – Simple Honeypot For Atlassian Confluence (CVE-2022-26134)

Serious vulnerabilities found in ITarian software, patches available for SaaS products

LockBit 2.0 Ransomware Victim: ptg[.]com[.]au

A week in security (June 6 – June 12)

Cobalt Stike Beacon Detected – 194[.]87[.]70[.]14:8080

Cobalt Stike Beacon Detected – 185[.]112[.]83[.]65:443

Cobalt Stike Beacon Detected – 82[.]157[.]153[.]129:80

Cobalt Stike Beacon Detected – 179[.]43[.]144[.]8:88

Cobalt Stike Beacon Detected – 150[.]158[.]212[.]148:10001

Cobalt Stike Beacon Detected – 114[.]132[.]163[.]195:443

ICO Urges Caution: How to Safeguard Your Mobile Privacy This Christmas

Interpol Uncovers 140+ Human Traffickers in Groundbreaking Anti-Trafficking Operation

Cryptomining Malware Discovered in Leading Open Source Packages

Ransomware Attack on Ascension Exposes 5.6 Million Patient Records

Critical Vulnerabilities in WPLMS and VibeBP WordPress Plugins Exposed

You may have missed