"Send me a quick text"

This episode explores a LockBit ransomware campaign that relied on DLL sideloading and masquerading to operate undetected until the final encryption stage.

The attackers gained access using legitimate remote management tools already present in the environment. They paired trusted, signed applications with malicious DLLs placed in locations where the application would load them first. Masquerading techniques — such as adopting common process names, using standard icons, and placing payloads in system-like directories — allowed their presence to blend seamlessly into normal operations.

Once inside, they escalated privileges, conducted network reconnaissance, stole credentials and Kerberos tickets, and used Group Policy to distribute payloads. The ransomware was ultimately launched under the identity of a trusted process, bypassing many traditional detection points.

Defensive Recommendations

• Restrict DLL search paths and enable Safe DLL Search Mode to prevent loading from user-writable or non-standard directories.
• Deploy application control policies (e.g., Windows Defender Application Control, AppLocker) to block unapproved binaries and DLLs.
• Monitor for legitimate applications loading DLLs from unusual directories or with unexpected hashes.
• Audit the use of remote management tools; require MFA, logging, and alerting for unexpected file transfers or executions.
• Track Group Policy changes, focusing on script and binary deployments to endpoint systems.
• Monitor for obfuscated PowerShell commands that interact with large sets of files or sensitive directories.

Files, Folders, Tools, and Configurations for Defenders

• Files and Folders: Watch for legitimate application executables paired with DLLs of the same name in non-standard or writable directories; payloads appearing in ProgramData or user profile subdirectories.
• Tools: Remote access tools such as TeamViewer and MeshAgent; service management utilities like NSSM; administrative execution tools like PsExec; and credential theft tools for token manipulation and Kerberos extraction.
• Configurations:
  • Enforce strict application allowlisting for both executables and DLLs.
  • Limit write permissions to directories used by trusted applications.
  • Enable command-line logging for PowerShell, PsExec, and similar tools.
  • Implement centralized logging and correlation rules to detect legitimate applications initiating encryption or credential theft activity.

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.

"Send me a quick text"

Summary:

This episode breaks down the ShinyHunters social engineering campaign that breached Google, Adidas, Louis Vuitton, and more—without malware or exploits. The attackers used voice-based social engineering to trick employees into authorizing a malicious Salesforce app via an 8-digit code, then leveraged cloud integrations to pivot into Microsoft 365 for deeper access.

Defensive Actions:

• Audit Salesforce access — Restrict to employees who absolutely need it.
• Review and limit connected apps — Disable unused integrations and verify all app authorizations.
• Train staff regularly — Teach employees to verify IT requests and recognize social engineering calls.
• Enable MFA everywhere — Apply multi-factor authentication to Salesforce, Microsoft 365, and all connected services.
• Monitor app authorizations — Use Salesforce audit logs and Microsoft 365 Cloud App Security to detect suspicious connections.

Files, Folders, Tools & Configurations:

• In Salesforce: Check Setup > Connected Apps for unknown integrations.
• In Microsoft 365: Review Azure AD Enterprise Applications for suspicious OAuth connections.
• Use CASB (Cloud Access Security Broker) to monitor and block risky cloud app connections.
• Enable logging for Salesforce Data Loader usage and large data export events.

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.

"Send me a quick text"

This episode examines a stealthy pre-ransomware technique where attackers use a custom-built EDR killer paired with a malicious, kernel-level driver to disable endpoint protections. The driver is signed with stolen or revoked certificates, giving it full control over the operating system. Once loaded, it terminates processes from leading security vendors before ransomware deployment. The same method has been observed across multiple ransomware families, including RansomHub, MedusaLocker, INC, Qilin, and Dragonforce, often wrapped with the HeartCrypt packer-as-a-service.

Defensive Recommendations

• Block unsigned or revoked driver loading: Use modern Windows features like HVCI (Hypervisor-Protected Code Integrity) or Memory Integrity to prevent untrusted drivers from loading into kernel space.
• Monitor driver installation behavior: Alert on creation of driver files with unusual names (e.g., five random characters ending in .sys) or installation of drivers from uncommon vendors.
• Enable Certificate Revocation Checking: Ensure that Windows is actively verifying certificate revocation status before allowing drivers to load.
• Behavioral detection over signature-based rules: Focus on detecting the sequence — a signed driver load followed by mass security process termination — rather than static IOCs.
• Alert on attempts to stop key processes: Monitor for kill attempts against critical EDR and AV services such as MsMpEng.exe, SophosHealth.exe, SAVService.exe, SophosUI.exe, etc.
• Apply Anti-Tampering policies: Ensure endpoint protection solutions have tamper protection fully enabled to resist unauthorized shutdown.

Artifacts, Files, and Configurations

• Driver Files:
  • Example name: mraml.sys
  • SHA-1: 21a9ca6028992828c9c360d752cb033603a2fd93
  • Known to be signed with revoked certificates from vendors like “Changsha Hengxiang Information Technology Co., Ltd.” or “Fuzhou Dingxin Trade Co., Ltd.”
• Main Payload:
  • Example filename: uA8s.exe
  • SHA-1: 2bc75023f6a4c50b21eb54d1394a7b8417608728
  • Often injected into legitimate software like Clipboard Compare from Beyond Compare
  • Protected using HeartCrypt packer-as-a-service
• Observed Process Termination Targets:
  • MsMpEng.exe, SophosHealth.exe, SAVService.exe, sophosui.exe
  • Other security vendors targeted include: Bitdefender, Cylance, F-Secure, Fortinet, HitManPro, Kaspersky, McAfee, SentinelOne, Symantec, Trend Micro, Webroot
• Example Paths & Behavior:
  • Malicious driver path: C:\ProgramData\noedt.sys
  • Driver loads immediately before ransomware execution
  • Process hollowing and shellcode injection techniques observed (e.g., HollowProcessGuard, DynamicShellcode)

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.

"Send me a quick text"

Episode Description:

In this episode of the CyberBrief Project, we examine a modern twist on the brushing scam — unsolicited packages containing only a printed QR code. This technique uses the physical postal system to bypass traditional detection channels and the familiarity of QR scanning to trigger digital compromise.

Defensive Actions:

• Treat any unexpected package with no return address as suspicious, especially if it contains a QR code.
• Never scan a QR code from an unknown or unsolicited source.
• Use QR scanning apps that display the full destination URL before opening it.
• Ensure mobile devices have up-to-date operating systems and active mobile security software with web protection.
• Educate users that a QR code is essentially a clickable link in disguise and should be treated with the same caution as an unsolicited URL.
• If a QR scan leads to a site requesting sensitive information, close it immediately and do not enter any details.
• Report suspected brushing scams to the FBI’s Internet Crime Complaint Center at ic3.gov, providing full details of the package, QR code, and any related communications.

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.

"Send me a quick text"

Episode Description:

This episode exposes how attackers hide inside WordPress’s must-use plugins to create a self-healing backdoor. We explain how a loader in the wp-content/mu-plugins folder fetches a remote payload hidden with ROT-13, plants a hidden file manager in the theme directory, creates a rogue admin account, installs a malicious plugin, and locks out legitimate owners.

Defensive Actions:

• Inspect wp-content/mu-plugins regularly and remove any unknown files.
• Search the WordPress database wp_options table for suspicious entries such as _hdra_core.
• Check the theme directory for unexpected PHP files (e.g., pricing-table-3.php).
• Audit all administrator accounts; delete unknown users and reset passwords.
• Keep WordPress core, themes, and plugins fully updated.
• Enable Two-Factor Authentication (2FA) on all admin accounts.
• Use file integrity monitoring tools like Wordfence, Sucuri, or server-side IDS to alert on changes in sensitive directories.

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.

"Send me a quick text"

In this episode, we break down a clever phishing technique that hides malicious links behind multiple layers of trusted redirects. 

By combining public link shorteners like Bitly with security services such as Proofpoint's link wrapping, attackers create a chain that looks safe at every step — until it leads to a fake Microsoft 365 login. Learn how this method works, why it fools both people and defenses, and what it teaches us about turning trust into camouflage.

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.

"Send me a quick text"

In this episode, we explore a stealthy credential access campaign attributed to the Iranian-linked group MuddyWater, also known as TA450. 

The attack began with a phishing email that delivered a legitimate installer for the Atera Agent—used to quietly gain remote access to the victim’s machine. From there, the attackers used built-in scripting tools to extract credential-related data, mapped the domain, and created a persistent SSH tunnel. They later deployed a second RMM tool to reinforce their access.

Defensive Recommendations:

• Block installation of RMM tools like Atera or Level RMM unless deployed by authorized teams
• Monitor for new outbound SSH connections, especially from workstations
• Restrict PowerShell execution and logging, particularly for registry access or remote scripts
• Implement alerts for sudden use of remote access tools during off-hours or by non-admin users
• Maintain a baseline of approved software, and alert on deviations

Tools and Infrastructure Observed:

• Atera Agent (installed by user via phishing lure)
• Level RMM (retrieved via obfuscated PowerShell command)
• SSH tunnel to remote infrastructure (used for persistence and control)

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.

"Send me a quick text"

Summary:In this episode, we explore how the APT10 subgroup “MirrorFace” abused the Windows Sandbox feature to establish stealthy persistence. By enabling and configuring the sandbox remotely, they launched malware designed to run only inside that isolated environment, avoiding detection entirely.

Defensive Recommendations:

• Disable Windows Sandbox if not in use organization-wide
• Monitor for sudden sandbox activation or system reboots with feature changes
• Watch for background execution of wsb.exe or sandbox-related memory activity
• Use memory forensics to inspect vmmemWindowsSandbox or vmmem processes
• Apply AppLocker or similar policies to prevent unauthorized sandbox usage
• Detect Tor-based outbound connections from host IPs

Artifacts and Tools to Watch:

• Windows Sandbox configuration changes or sudden feature activations
• Usage of wsb.exe from unknown users or automation scripts
• Scripts unpacking archives or scheduling hidden tasks within the sandbox
• Shared folder usage between host and sandbox environments
• Sandbox memory processes exposing RAT or C2 tool signatures

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.

"Send me a quick text"

In this episode of the CyberBrief Project, we break down Sneaky Strike — a large-scale campaign that turns a legitimate security tool into a weapon for mass account takeover. 

Using TeamFiltration, an open-source framework originally built for penetration testing, attackers have targeted more than eighty thousand Microsoft Entra ID accounts across hundreds of organizations. 

We walk through how they enumerate accounts, launch stealthy password spraying attacks from rotating cloud servers, and establish persistence inside compromised accounts. More importantly, we unpack why this technique is so effective, and what it teaches us about defending against the creative misuse of legitimate tools.

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.

"Send me a quick text"

A new variant of the Coyote banking trojan is targeting not just banks but cryptocurrency exchanges, and it is doing it in a way few defenders expect. 

Instead of exploiting a vulnerability, it abuses a Windows accessibility feature called UI Automation to read sensitive details right from your screen. In this episode, we break down how the attack works, why it is so effective, and what it means for protecting both banking and crypto assets.

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.