Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
WEBBFUSCATOR Campaign New TTPS – Detection & Response
Excerpt
Securonix Threat researchers have spotted a new malware that leveraged the deep field image taken from the James Webb telescope and obfuscated Golang programming language payloads to infect the target system with the malware. Also Read: Latest Cyber Security News – Hacker News ! Payload Execution Flow ‘GO#WEBBFUSCATOR’ are delivered on phishing emails as Microsoft Office attachment that includes a hidden external reference in its metadata which downloads a malicious template…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | updatesagent.com | High | Score 58/100 | First seen |
| URL | http://www.xmlschemeformat.com/update/2021/Office/form.dotm | High | Score 58/100 | First seen |
| URL | http://www.xmlschemeformat.com/update/2021/office/oxb36f8geec634.jpg | High | Score 58/100 | First seen |
| Domain | xmlschemeformat.com | High | Score 58/100 | First seen |
| Domain | apiregis.com | High | Score 58/100 | First seen |
| IP | 185.247.209.255 | High | Score 58/100 | First seen |
| IP | 139.28.36.222 | High | Score 58/100 | First seen |
| Domain | ns1.updatesagent.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…