Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
8 IOCs

WEBBFUSCATOR Campaign New TTPS – Detection & Response

Security Investigation
Security Investigation
Published September 1, 2022Original Report

Excerpt

Securonix Threat researchers have spotted a new malware that leveraged the deep field image taken from the James Webb telescope and obfuscated Golang programming language payloads to infect the target system with the malware. Also Read: Latest Cyber Security News – Hacker News ! Payload Execution Flow ‘GO#WEBBFUSCATOR’ are delivered on phishing emails as Microsoft Office attachment that includes a hidden external reference in its metadata which downloads a malicious template…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREupdatesagent.comhttp://www.xmlschemef…http://www.xmlschemef…CAPABILITYunknownVICTIMunknown
Adversary
Infrastructure(6)
Capability
Victim

Indicators of Compromise

Open the mindmap →

8 indicators

TypeIndicatorConfidenceScoreFirst Seen
Domainupdatesagent.comHighScore 58/100First seen
URLhttp://www.xmlschemeformat.com/update/2021/Office/form.dotmHighScore 58/100First seen
URLhttp://www.xmlschemeformat.com/update/2021/office/oxb36f8geec634.jpgHighScore 58/100First seen
Domainxmlschemeformat.comHighScore 58/100First seen
Domainapiregis.comHighScore 58/100First seen
IP185.247.209.255HighScore 58/100First seen
IP139.28.36.222HighScore 58/100First seen
Domainns1.updatesagent.comHighScore 58/100First seen

IOC Relationship Graph

Building graph…