Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
As I mentioned in my previous post , I wanted to take a closer look at the findings from an infra point of view and also circle back to the dead ends I reached to see if I missed anything. The approach was simple, use the indicators from the GenDigital report in combination with our findings from the previous research and try to make sense of the Remus infra. It turned out to be a lot bigger than I expected! Evidence Gathering and Grouping First step was to check the hosting…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | poxap.top | High | Score 58/100 | First seen |
| Domain | siltsoh.biz | High | Score 58/100 | First seen |
| Domain | nitroca.biz | High | Score 58/100 | First seen |
| Domain | adveryx.biz | High | Score 58/100 | First seen |
| Domain | managew.biz | High | Score 58/100 | First seen |
| Domain | chalx.live | High | Score 58/100 | First seen |
| Domain | clasl.pics | High | Score 58/100 | First seen |
| Domain | interxo.biz | High | Score 58/100 | First seen |
| URL | https://verifi-cation.com | High | Score 58/100 | First seen |
| Domain | lilyofz.cloud | High | Score 58/100 | First seen |
| URL | https://clou-dprotect.co | High | Score 58/100 | First seen |
| Domain | fightwa.biz | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…