SpecterMalware
Last reported 11 days ago, by SecurityWeek4 reports
ATT&CK techniques
6 of 14 · each with the sentence it comes from- T1001.003Protocol or Service Impersonation
“T1001.003”
- T1036Masquerading
“In this case, Dust Specter lured the victim by creating web pages masquerading as Cisco‘s “Webex for Government” meeting invite.”
- T1053.005Scheduled Task
“Create a scheduled task with the name winWebex set to launch every 2 hours to execute the malicious binary in the location C:\ProgramData\WinWebex\WinWebex.exe.”
- T1071.001Web Protocols
“T1071.001”
- T1082System Information Discovery
“T1082”
- T1112Modify Registry
“T1112”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant“According to on-chain investigator Specter, the total losses associated with the supply chain attack may top $86 million.”
-
Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports“The incident is said to have resulted in losses totaling more than $86 million, according to pseudonymous blockchain investigator Specter.”
-
Risky Bulletin: Intel ends paid bug bounties“The chipmaker has had a bug bounty program for more than a decade, but added fat bounties after the Specter and Meltdown disclosures in 2017 showed how vulnerable and insecure its CPUs really were.”
-
Dust Specter APT Targets Government Officials in Iraq“Dust Specter APT Targets Government Officials in Iraq”
Indicators in its reports
named in the reports above- hxxps://meetingapp[.]site/webexdownloadin 1 report
- meetingapp[.]sitein 1 report
- b8254efd859f5420f1ce4060e4796c08in 1 report
- 8621be9e1aa730d1…6d9da70ff293in 1 report
- 903f7869a94d88d4…fd7c7c2aca74in 1 report
- 78275f3fc7e209b85bff6a6f99acc68ain 1 report
- fc08f8403849c623…c58cd7041823in 1 report
- 6bb0d45799076b3f…fbbfba23efcein 1 report
- d5ddf40ba2506c57d3087d032d733e08in 1 report
- 682c043443cb81b6…333f5d1fec53in 1 report
- 797325b3c8a9356d…ee821618cb96in 1 report
- 8f44262afaa171b78fc9be20a0fb0071in 1 report
- 1debc4c512ded889…d2f61b87ff13in 1 report
- 293ee1fe8d36aa79…796119564779in 1 report
- 19ab3fd2800f62a47bf13a4cc4e4c124in 1 report
- c79c261457def606…2832a5c0ded3in 1 report
- ad26cd72a83b884a…f9a4406e530din 1 report
- 63702bd6422ec2d5678d4487146ea434in 1 report
- c7dff3a0675f330f…40369451d122in 1 report
- f3f2dc31f70a105d…9da1c279f7efin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.