TermiteMalware
Last reported 15 days ago, by RansomLook12 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1558.003Kerberoasting
“Any red teamer who has run a Kerberoasting attack will tell you that the best exploitation primitives are features, not bugs, and therefore can’t be patched.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
12 reports, newest first · the exact sentence from each-
termite lists hxxps://www.identalsoft.com/“termite lists hxxps://www.identalsoft.com/”
-
termite lists iDentalSoft“termite lists iDentalSoft”
-
termite lists hxxps://www.aon.com/“termite lists hxxps://www.aon.com/”
-
termite lists Aon“termite lists Aon”
-
termite lists hxxps://www.crossettinc.com/“termite lists hxxps://www.crossettinc.com/”
-
termite lists Crossett“termite lists Crossett”
-
termite lists hxxps://www.truamerica.com/“termite lists hxxps://www.truamerica.com/”
-
termite lists hxxps://thelender.com/“termite lists hxxps://thelender.com/”
-
termite lists hxxps://www.sealconusa.com/“termite lists hxxps://www.sealconusa.com/”
-
termite lists Sealcon“termite lists Sealcon”
-
termite lists theLender“termite lists theLender”
-
6 Months of Researching OAuth Application Attacks“Never Just One Termite: Six Months of Researching OAuth Application Attacks”
Indicators in its reports
named in the reports above- www.crossettinc[.]comin 1 report
- www.sealconusa[.]comin 1 report
- thelender[.]comin 1 report
- hxxps://github[.]com/HuskyHacks/cazadorain 1 report
- hxxps://www.crossettinc[.]com/in 1 report
- hxxps://www.truamerica[.]com/in 1 report
- www.truamerica[.]comin 1 report
- hxxps://www.sealconusa[.]com/in 1 report
- hxxps://thelender[.]com/in 1 report
- www.aon[.]comin 1 report
- hxxps://www.aon[.]com/in 1 report
- www.identalsoft[.]comin 1 report
- hxxps://www.identalsoft[.]com/in 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.