Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
11 IOCs
Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading
Threat Actors
Excerpt
by Robin Dost A few months ago, I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK stealer through a weaponized WinRAR archive . Of course, that wasn’t it yet, we’re going to keep tracking our friends, so let’s go The chain was relatively simple: RAR archive -> decoy PDF -> LNK -> obfuscated PowerShell -> additively encoded payload -> GIFTEDCROOK Sample : 420f1931af9b3f7d02c5edfc78eb69abdad6e71d2c3e9b81f9cbc3823a503654 The sample…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →11 indicators
IOC Relationship Graph
Building graph…