Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
More RMM Tools In the Wild, (Tue, Oct 6th)
Excerpt
It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[ 1 ] about ScreenConnect used in the wild. Today, I found another one. Same scenario, it started with a phishing email that delivers a fake PDF invoice to the victim: When the PDF is opened, it just redirect to a malicious VBS file. Indeed, the PDF contains an…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3 | Medium | Score 53/100 | First seen |
| SHA256 | 1b19115d5ebdc216e0ab3adf2c643648cfc70a385f4caf0217c679f9f3b20342 | Medium | Score 53/100 | First seen |
| SHA256 | eaff35d250c9b04f51c971e70082740dbfeee5dd846829d541f588ad43378727 | Medium | Score 53/100 | First seen |
| Domain | server.na-2.action1.com | High | Score 58/100 | First seen |
| SHA256 | 996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06 | Medium | Score 53/100 | First seen |
| URL | https://up-theta-rose.vercel.app/adobe_new_update.vbs | High | Score 58/100 | First seen |
| URL | https://up-theta-rose.vercel.app/action1.msi | High | Score 58/100 | First seen |
| URL | https://update-two-tau.vercel.app/adobe-ne | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…