cloakMalware
Last reported 6 days ago, by ransomware.live11 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1542.003Bootkit
“…os pueden explotarse para ejecutar código no confiable durante el arranque del sistema, lo que permite a los atacantes desplegar bootkits UEFI maliciosos (como Bootkitty, HybridPetya o BlackLotus) incluso en sistemas con UEFI Secure Boot habilitado.”
- T1021.001Remote Desktop Protocol
“Defenders often prioritize preventing threat actors from getting in, whether through vulnerability exploitation or exposed Remote Desktop Protocol (RDP) instances.”
- T1496.003SMS Pumping
“Recently, Group-IB published a study on SMS pumping abuse, which sheds light on how attackers exploit misconfigured SMS gateways and commercial application-to-person (A2P) messaging platforms to automate and scale SMS distribution.”
- T1543.003Windows Service
“…for the cryptocurrency miner using nssm.exe, the "non-sucking service manager", a freely available utility for creating a resilient Windows service from a standalone executable.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
11 reports, newest first · the exact sentence from each-
cloak lists ********rta.ch“cloak lists ********rta.ch”
-
cloak lists dac********er.de“cloak lists dac********er.de”
-
cloak lists ********rta.ch“cloak lists ********rta.ch”
-
cloak lists dac********er.de“cloak lists dac********er.de”
-
Four Cyber Threats Harboring Big Plans for the Future“This software is already running inside the organization’s own systems, so the backdoor wears a cloak of trust as opposed to being an external intrusion.”
-
Los UEFI shims olvidados socavan Secure Boot“… de bootloaders UEFI vulnerables firmados y desconocidos y el despliegue de bootkits UEFI, consulte nuestra publicación Under the cloak of UEFI Secure Boot: Introducing CVE-2024-7344.”
-
Forgotten UEFI shims undermining Secure Boot“… at least detect) exploitation of unknown vulnerable signed UEFI bootloaders and deployment of UEFI bootkits, see our blogpost Under the cloak of UEFI Secure Boot: Introducing CVE-2024-7344.”
-
Threat Actors Achieve Persistence After SQL Injection“By tweaking these attributes, the threat actor aimed to better cloak these files.”
-
What Does the Dark Web Look Like? Pulling Back the Curtain“The dark web offers more anonymity, but it's not exactly an invisibility cloak.”
-
Toll of Deception: Where Evasion Drives Phishing Forward“This multi-layered redirection technique, including the use of Google AMP and encoded parameters to cloak phishing URLs, was also documented in our previous research Trust Hijacked.”
-
Hackers Are Hiding in Plain Sight“In the past year, hackers have started trading in the proverbial black hoodie and are opting instead for a “cloak of invisibility.” The result?”
Indicators in its reports
named in the reports above- ae75f0d82ba3df82…8bfd83a6b961in 2 reports
- 7b2a3f5c96f95bd8…215c8de9eb10in 2 reports
- eb86fa1386fe6e45…34a161018a0ain 2 reports
- fd23d6e57de6f4e1…3447268d50c5in 2 reports
- a0de9333442c1bf9…21bf6c1ae3e4in 2 reports
- 95b6d71fc0c0f8c5…a6759ce5fc06in 2 reports
- 236a9cb0d71951c3…5d9de549e19bin 2 reports
- 5e594c448760a313…a77f284fa63bin 2 reports
- 8a964d5f8373948d…b53d98ae8963in 2 reports
- 410260b1b6f5af5f…437f312db373in 2 reports
- 96275dfd6282a522…f92869028629in 2 reports
- 2e434a724b4759c9…3d635096dd2fin 2 reports
- rta[.]chin 2 reports
- er[.]dein 2 reports
- hxxp://334thribetlhkyo977gqrcht1k7bvdj2.oastify[.]comin 1 report
- 334thribetlhkyo977gqrcht1k7bvdj2.oastify[.]comin 1 report
- pub-c4c8e8c336c3429d97195076bf3bb6eb.r2[.]devin 1 report
- c4c8e8c336c3429d97195076bf3bb6ebin 1 report
- ocasionalmente[.]siin 1 report
- hxxps://github[.]com/rhboot/shim-reviewin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.