BellaMalware
Last reported 4 days ago, by Cisco Talos4 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“Review Windows Event Logs for anomalous interactive logons, unexpected remote desktop protocol (RDP) activity, signs of credential dumping, and other evidence of lateral movement.”
- T1036Masquerading
“Web Server Persistence Method A: Package Handler Masquerading (.deb)”
- T1505.003Web Shell
“Analysis of the actor’s post-exploitation toolkit reveals newly discovered custom PHP web shells, such as WHIPSHOT, capable of disguising Base64-encoded command-and-control (C&C) payloads within native HTTP headers.”
- T1552.003Shell History
“Examine Process Execution & Shell History: Inspect active system processes for anomalous Python interpreters executing background commands referencing /tmp/.uxdport or running under nohup.”
- T1552.004Private Keys
“Rotate NetScaler administrator credentials, local appliance accounts, Secure Shell (SSH) keys, TLS certificates, and associated private keys.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
There's only so much code: the rise in vulnerability numbers“Dive deeper into this conversation with the latest TTP interview with Yves Younan and vulnerability researcher Bella Fusari.”
-
Working in Boston at the World’s Largest Intelligence Company“Bella Cabrera”
-
Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances“This analysis would not have been possible without the assistance of Bella Valdescruz, Bhavesh Dhake, Chris Linklater, Christopher Romano, Geoff Carstairs, Greg Blaum, Josh Thackston, Kimberly Goody, Lianis Oliva, Matthew Quick, Michael Edie, Omar ElAhdan, Peter Ukhanov, Sagun Ch…”
-
A method to assess 'forgivable' vs 'unforgivable' vulnerabilities“Analysis by Eloff and Bella (2018), Williams et al.”
Indicators in its reports
named in the reports above- iglu[.]netin 1 report
- hxxps://news.blackduck[.]com/2015-07-29-Coverity-Scan-Open-Source-Report-Shows-Commercial-Code-Is-More-Compliant-to-Security-Standards-than-Open-Source-Codein 1 report
- news.blackduck[.]comin 1 report
- hxxps://www.acsac[.]org/2007/workshop/Howard.pdfin 1 report
- www.acsac[.]orgin 1 report
- hxxps://www.outsystems[.]com/blog/posts/attack-surface/in 1 report
- www.outsystems[.]comin 1 report
- hxxps://docs.netscaler[.]com/en-us/netscaler-console-service/instance-advisory/security-advisory-dashboard.htmlin 1 report
- docs.netscaler[.]comin 1 report
- hxxps://docs.netscaler[.]com/en-us/netscaler-console-service/instance-advisory/ioc.htmlin 1 report
- 143.198.7[.]94in 1 report
- 157.254.167[.]12in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.