Out of the Woods: The Threat Hunting Podcast

**Join our Threat Hunting Workshop: Hunting for Lateral Movement on March 22nd from 12:00 – 1:00 PM ET and earn your “Lateral Movement – Level 1” certification! Save your seat 👇
https://info.cyborgsecurity.com/en-us/threat-hunting-workshop-6


Show Noteshttps://info.cyborgsecurity.com/hubfs/Out%20of%20the%20Woods/Shownotes/OOTW%20Shownotes%202-21-2023.pdf
APT SideCopy Targeting Indian Government Entities

https://threatmon.io/apt-sidecopy-targeting-indian-government-entities/

WIP26 Espionage | Threat Actors Abuse Cloud Infrastructure in Targeted Telco Attacks

https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/

Fog of war: how the Ukraine conflict transformed the cyber threat landscape

https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/

HWP Malware Using the Steganography Technique: RedEyes (ScarCruft)

https://asec.ahnlab.com/en/48063/

Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity – Part 1https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ 

**Join our Threat Hunting Workshop: Hunting for Credential Access on February 8th from 12:00 – 1:00 PM ET and earn your “Credential Access – Level 1” certification! Save your seat 👇
 https://info.cyborgsecurity.com/en-us/threat-hunting-workshop-5
 

The DFIR Report: Collect, Exfiltrate, Sleep, Repeat
https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/

North Korea: Intelligence Assessment 2022
https://analyst1.com/north-korea-intelligence-assessment-2022/

New APT34 Malware Targets The Middle East
https://www.trendmicro.com/en_us/research/23/b/new-apt34-malware-targets-the-middle-east.html

SocGholish: A Tale of FakeUpdates
https://www.reliaquest.com/i/blog/socgholish-fakeupdates/

The Defender’s Guide to OneNote MalDocs
https://opalsec.substack.com/p/the-defenders-guide-to-onenote-maldocs

Show Notes:
https://info.cyborgsecurity.com/hubfs/Out%20of%20the%20Woods/Shownotes/OOTW%20Shownotes%202-06-2023.pdf


Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Instagram: https://www.instagram.com/cyborgsecinc/
Facebook: https://www.facebook.com/CyborgSecInc

**Join our Threat Hunting Workshop: Hunting for Credential Access on February 8th from 12:00 – 1:00 PM ET and earn your “Credential Access – Level 1” certification! Save your seat 👇
https://info.cyborgsecurity.com/en-us/threat-hunting-workshop-5


Watering Hole Attacks Push ScanBox Keylogger
https://threatpost.com/watering-hole-attacks-push-scanbox-keylogger/180490/

JD Sports Hit by Cyber-Attack That Leaked 10m Customers’ Data
https://www.theguardian.com/business/2023/jan/30/jd-sports-cyber-attack-customers-data-jd-size-millets-blacks

Germany’s Tank Support Met with Russian Cyberattacks
https://cybernews.com/news/german-tank-support-spurs-russian-cyberattacks/

Realtek Vulnerability Under Attack: Over 134 Million Attempts to Hack IoT Devices
https://thehackernews.com/2023/01/realtek-vulnerability-under-attack-134.html

Russian Hackers Use Western Network to Attack Ukraine
https://cybernews.com/security/russians-use-western-networks-attack-ukraine/

https://info.cyborgsecurity.com/hubfs/Out%20of%20the%20Woods/Shownotes/OOTW%20Shownotes%201-30-2023.pdf


Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Instagram: https://www.instagram.com/cyborgsecinc/
Facebook: https://www.facebook.com/CyborgSecInc

**Join our Threat Hunting Workshop: Hunting for Credential Access on February 8th from 12:00 – 1:00 PM ET and earn your “Credential Access – Level 1” certification! Save your seat 👇
https://info.cyborgsecurity.com/en-us/threat-hunting-workshop-5


EXCLUSIVE: U.S. Airline Accidentally Exposes ‘No Fly List’ on Unsecured Server

https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/

ChatGPT Is Pretty Good at Writing Malware, It Turns Out

https://gizmodo.com/chatgpt-ai-polymorphic-malware-computer-virus-cyber-1850012195

The DFIR Report: How Threat Actors Discover File Shares

https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/

Gamaredon Group Launches Cyberattacks Against Ukraine Using Telegram

https://thehackernews.com/2023/01/gamaredon-group-launches-cyberattacks.html

National Security Agency | IPv6 Security Guidance

https://media.defense.gov/2023/Jan/18/2003145994/-1/-1/0/CSI_IPV6_SECURITY_GUIDANCE.PDF

Show Notes:

https://info.cyborgsecurity.com/hubfs/Out%20of%20the%20Woods/Shownotes/OOTW%20Shownotes%201-23-2023.pdf


Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Instagram: https://www.instagram.com/cyborgsecinc/
Facebook: https://www.facebook.com/CyborgSecInc

To be fully interactive by asking questions and giving feedback and opinions in real-time, join our Discord Server! Be sure to join the live recording of our next episode to be a part of the fun! --> https://discord.gg/sHw5c3qwRh


Episode 5 | 3 Interesting Artifacts:

*TikTok Banning:
https://www.nbcnews.com/tech/tiktok-bans-public-universities-list-rcna66185

*GHOSTS – Training / Exercise NPC Activity
https://github.com/cmu-sei/GHOSTS
https://github.com/cmu-sei/GHOSTS-SPECTRE
https://github.com/cmu-sei/GHOSTS-ANIMATOR
https://www.youtube.com/watch?v=EkwK-cqwjjA

*OPERA1ER: Playing God Without Permission
https://www.group-ib.com/resources/research-hub/opera1er/


Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Instagram: https://www.instagram.com/cyborgsecinc/
Facebook: https://www.facebook.com/CyborgSecInc

**Join our Threat Hunting Workshop: Hunting for Credential Access on February 8th from 12:00 – 1:00 PM ET and earn your “Credential Access – Level 1” certification! Save your seat 👇
https://info.cyborgsecurity.com/en-us/threat-hunting-workshop-5

Many of 13 New Mac Malware Families Discovered in 2022 Linked to Chinahttps://www.securityweek.com/many-13-new-mac-malware-families-discovered-2022-linked-china?&web_view=true

• https://objective-see.org/blog/blog_0x71.html

Microsoft Ends Windows 7 Extended Security Updates on Tuesdayhttps://www.bleepingcomputer.com/news/microsoft/microsoft-ends-windows-7-extended-security-updates-on-tuesday/?&web_view=true
Attackers Abuse Genuine Windows Tool to Deliver Pupy RAThttps://cyware.com/news/attackers-abuse-genuine-windows-tool-to-deliver-pupy-rat-26f6400e
Can You Trust Your VSCode Extensions?https://blog.aquasec.com/can-you-trust-your-vscode-extensions
Unwrapping Ursnifs Giftshttps://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/

Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Instagram: https://www.instagram.com/cyborgsecinc/
Facebook: https://www.facebook.com/CyborgSecInc

Top 5 Threat Hunting Headlines - 19 December 2022


OPWNAI: AI THAT CAN SAVE THE DAY OR HACK IT AWAY
https://research.checkpoint.com/2022/opwnai-ai-that-can-save-the-day-or-hack-it-away/

ISA Researchers: Russia's Fancy Bear infiltrated US Satellite Network
https://www.cyberscoop.com/apt28-fancy-bear-satellite/

Colombian Energy Supplier EPM Hit by BlackCat Ransomware Attack
https://www.bleepingcomputer.com/news/security/colombian-energy-supplier-epm-hit-by-blackcat-ransomware-attack/

Russia’s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine
https://unit42.paloaltonetworks.com/trident-ursa/

FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked
https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/


Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Instagram: https://www.instagram.com/cyborgsecinc/
Facebook: https://www.facebook.com/CyborgSecInc

Top 5 Threat Hunting Headlines - 12 December 2022
Rackspace Warns of Phishing Risks Following Ransomware Attack
https://www.bleepingcomputer.com/news/security/rackspace-warns-of-phishing-risks-following-ransomware-attack/

New MuddyWater Threat: Old Kitten; New Tricks
https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks

Researchers Detail New Attack Method to Bypass Popular Web Application Firewalls
https://thehackernews.com/2022/12/researchers-detail-new-attack-method-to.html

Buyer Beware: Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware
https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/

Hack-for-Hire Group Targets Travel and Financial Entities with New Janicab Malware Varient
https://thehackernews.com/2022/12/hack-for-hire-group-targets-travel-and.html
 

Show Notes
https://info.cyborgsecurity.com/hubfs/Out%20of%20the%20Woods/Shownotes/OOTW%20Shownotes%2012-12-2022.pdf


Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Instagram: https://www.instagram.com/cyborgsecinc/
Facebook: https://www.facebook.com/CyborgSecInc

To be fully interactive by asking questions and giving feedback and opinions in real-time, join our Discord Server! Be sure to join the live recording of our next episode to be a part of the fun! --> https://discord.gg/sHw5c3qwRh


Episode 4 | 3 Interesting Artifacts:

*Rackspace Incident Highlights How Disruptive Attacks on Cloud Providers Can Be
https://www.darkreading.com/cloud/rackspace-incident-highlights-disruptive-attacks-on-cloud-providers

*ANNOUNCING PWN2OWN TORONTO 2022 AND INTRODUCING THE SOHO SMASHUP!
https://www.zerodayinitiative.com/blog/2022/8/29/announcing-pwn2own-toronto-2022-and-introducing-the-soho-smashup

*SOF-ELK and Integration with KAPE
https://aboutdfir.com/sof-elk-and-integration-with-kape/
 
 
Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Instagram: https://www.instagram.com/cyborgsecinc/
Facebook: https://www.facebook.com/CyborgSecInc

Top 5 Threat Hunting Headlines - 28 November 2022
OpZero’s Modus Operandi: Opportunity Hunter, Front for Kremlin, or Both?
https://cybernews.com/editorial/opzero-exploit-hunter-kremlin/

Vice Society Ransomware Claims Attack on CCncinnati State College
https://www.bleepingcomputer.com/news/security/vice-society-ransomware-claims-attack-on-cincinnati-state-college/

Russia-based RansomBoggs Ransomware Targeted Several Ukrainian Organizations
https://thehackernews.com/2022/11/russia-based-ransomboggs-ransomware.html

Millions of Twitter Users Hacked in ‘Colossal’ Security Breach
https://www.yahoo.com/news/millions-twitter-users-hacked-colossal-130736003.html

Emotet Strikes Again – LNK File Leads to Domain Wide Ransomware
https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ 
 

Show Notes
https://info.cyborgsecurity.com/hubfs/Out%20of%20the%20Woods/Shownotes/OOTW%20Shownotes%2011-28-2022.pdf


Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Instagram: https://www.instagram.com/cyborgsecinc/
Facebook: https://www.facebook.com/CyborgSecInc