Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
26 IOCs
UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos
Malware Families
Excerpt
by Robin Dost Malware: HijackLoader / IDATLoader -> Remcos Agent 7.1.0 Pro Actor tracking: UAC-0184 / MB-0005 Related analysis: UAC-0184: From HTA to a Signed Network Stack A YARA rule for this sample is available on request: contact@robin-dost.de . In my previous UAC-0184 analysis , I documented a loader chain built around a legitimate Plane9 application, several local payload containers and a pseudo-PNG file carrying additional stages inside its IDAT chunks. That chain…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →26 indicators
IOC Relationship Graph
Building graph…