threat research @proofpoint // tweets are probably someone else's
Joined August 2010
- Tweets163
- Following693
- Followers335
- Likes952
Daniel retweeted
Proofpoint has tracked this technique since August 2024, and call it “brooxml”. Our researchers do not consider this a zero-day or vulnerability in general.
We’ve released Emerging Threats and YARA signatures at the end of this thread.
🚨ALERT: Potential ZERO-DAY, Attackers Use Corrupted Files to Evade Detection 🧵 (1/3)
⚠️ The ongoing attack evades #antivirus software, prevents uploads to sandboxes, and bypasses Outlook's spam filters, allowing the malicious emails to reach your inbox
The #ANYRUN team discovered that as part of this #zeroday attack, threat actors attempt to conceal the file type by deliberately corrupting it, making it difficult for certain security tools to detect
📌 Our sandbox solves this problem thanks to interactivity. It launches these broken files in their corresponding programs, which allows it to identify #malicious behavior
See example:
app.any.run/tasks/6839e806-5…
🚫 Although these files operate successfully within the OS, they remain undetected by most security solutions due to the failure to apply proper procedures for their file types
They were uploaded to VirusTotal, but all antivirus solutions returned "clean" or “Item Not Found” as they couldn't analyze the file properly
Daniel retweeted
When the ecrime gang finds something… else
If you like weird infection chains, WebDAV, Python, custom backdoors with novel C2 methods, and use of Dumpulator, PCAPs, and more, the gang @selenalarson @Myrtus0x0 @ffforward got you covered!
proofpoint.com/us/blog/threa…
Daniel retweeted
In this special holiday edition of DISCARDED, Mindy Semling joins as guest host for a 2nd annual "Ask Me Anything" episode.
In this lively discussion, Selena & Crista answer questions from the audience and bid farewell to the 2023 cybersecurity landscape. ow.ly/9LRB50QmsIV
Daniel retweeted
Great blog just published on an interesting cluster of #DarkGate malware distribution activity that used high-volume email campaigns, compromised websites with fake browser updates, steganography in CSS, and TDS filtering deliver DarkGate: proofpoint.com/us/blog/threa…
Daniel retweeted
proofpoint.com/us/blog/threa…
confused by the fake browser landscape? me too - thats why I'm glad my teammates track this
come for the clarity, stay for the inject examples to show the differences between the kits!
Daniel retweeted
Want to see something new and exciting?
Are you a blue teamer and want to see a novel new way threat actors have been observed exploiting LNK files in the wild?
Are you a red teamer and want to see how this exploit works on a technical level and how I recreated it?
Are you a CTI professional who evangelizes about the benefits of attribution?
Are you an infosec professional or enthusiast who loves video game humor?
This talk is for you!
Join us in person or online here:
na.eventscloud.com/website/5…
I’ll be sharing the stage with @aRtAGGI from Google Cloud (Mandiant).
This promises to be a very fun and informative talk. I hope to see you.
@MITREattack
Daniel retweeted
Like forensic scientists, threat analysts are always on the hunt for digital fingerprints. 🔎
In this DISCARDED #podcast episode, we discuss the China #cybercrime threat landscape and the importance of staying aware of past trends.
Stream now at ow.ly/P7hP50PFFi4.
Daniel retweeted
🚨 Job Openings!
Our team is looking to hire for 2 positions on our APT tracking team.
Primary responsibilities & day-to-day will be disrupting state-aligned or state-sponsored actors trying to deliver malware, phish, or otherwise engage with our customers, in email data.
Daniel retweeted
At #LABScon23, Proofpoint's Greg Lesnewich will take a close look at similarities in macOS components used in North Korean crypto heists @greglesnewich
labscon.io/speakers/greg-les…
Daniel retweeted
Threat actor attack chains are constantly evolving. In addition to new techniques, we're also seeing the overlap present amongst a variety of high profile activity.
Today at #BHUSA, our threat researchers will highlight this murky ecosystem and what this means for attribution.
Daniel retweeted
Super proud to announce that I’ve been selected to speak at @MITREattack ATT&CKcon 4.0 with @aRtAGGI.
Dropping a new .LNK subtechnique like:
@MITREattack ATT&CKcon 4.0 tickets are live!! Come out and see me and @ex_raritas cosplay as Link and a stranded Korok while debuting a brand new sub technique for Defense Evasion. .lnk icon smuggling coming to a Nintendo Switch near you 🎮
Daniel retweeted
What is new with Iranian actor #TA453, and what is happening with their attack chains? To answer these questions, Joshua Miller, senior threat researcher on the APT team at @proofpoint, joins our DISCARDED #podcast.
Stream now at: ow.ly/tYQA50PmfUo
#CharmingKitten #APT42
Daniel retweeted
Threat actors are using #employmentscams to prey on vulnerable job seekers.
ow.ly/6FX250PfGEP
In this blog, our threat researchers detail a recent campaign they observed in the wild, including messages purported to be from legitimate #healthcare and #biotech companies.
Daniel retweeted
Proofpoint has been tracking a new loader, dubbed WikiLoader, since February 2023. On July 11th, Proofpoint researchers observed WikiLoader return with new and notable updates in a high-volume campaign.
Daniel retweeted
Who’s quiet and who’s making noise? What’s the backchannel chatter over at @proofpoint?
Proofpoint threat researchers Joe Wise and Pim Trouerbach joined our DISCARDED #podcast to discuss the #ecrime vibe for the first half of 2023.
Stream now ➡️ ow.ly/XYcO50OOT0L
Daniel retweeted
I’m proud to announce that this year’s Human Factor report is now available.
The 2023 Human Factor report delves deeper into recent advancements in the threat landscape, with a particular focus on the intersection of technology and psychology that enhances the potency of the modern attack chain.
When quantifying techniques, tools, and exploits used by Thread Actors one thing is clear, the vast majority rely on social engineering techniques targeting the human.
This report wouldn’t be possible without the efforts of the entire @proofpoint @threatinsight team.
A big thanks to @dansomware @ET_Labs and @rpargman for their leadership.
Daniel retweeted
7️⃣ @greglesnewich | Greg Lesnewich
A senior threat researcher at @proofpoint, Greg is working on tracking malicious activity linked to the DPRK (North Korea). He has a background in threat intelligence, incident response, and managed detection, and previously built a threat intelligence program for a Fortune 50 financial organization.
Daniel retweeted
Advanced persistent threat actors from Russia, Iran, and North Korea are targeting vulnerable SMBs and regional MSPs as part of their state-aligned collection requirements.
This blog recaps a year’s worth of campaign data examined by our researchers. ow.ly/IAQY50OuYV6