Threat intelligence company, illuminating adversaries since 2017.
Joined August 2021
- Tweets39
- Following9
- Followers341
- Likes36
MalBeacon retweeted
#Gootloader /Expl was the latest target of Operation Endgame! I put together a blog on how I/we got here gootloader.wordpress.com/202…
MalBeacon retweeted
Abe RAT signed "Kimberley Hankinson"
h/t @malwrhunterteam
"Abe" is likely short for "App-Bound Encryption". Uses hidden browser to decrypt passwords
Leveraged @malbeacon 's DeceptionPro to watch hands on activity.
Full blog: rogueauthority.org/signed-ab…
MalBeacon retweeted
Thanks to @malbeacon 's DeceptionPro, we got another stage and a new C2.
The next stage, if installed on a server, copies itself to hosts that RDP to the server. See details in the blog post: rogueauthority.org/signed-ie…
C2: work.nddswa[.]com
EV "Hangzhou Yueque Li Technology Co., Ltd." signing two Gh0st RAT variants.
h/t @malwrhunterteam
First: Golden Gh0st RAT from GoldenEyeDog: rogueauthority.org/signed-ie… (Image: Golden Gh0st Rat lure from July)
Second: GodRat: rogueauthority.org/signed-wi…
Timeline, ET sigs, IOCs
🔗 blog.deception.pro/blog/kong…
![[Op Report] KongTuke ClickFix to SystemBC: HoK Intrusion — Deception.Pro Blog](https://pbs.twimg.com/card_img/2120575524103946240/uxDB4XJG?format=jpg&name=420x420_2)
Op Report:
blog.deception.pro/blog/hok-…
![[Op Report] Hands-on-Keyboard Activity from the DPRK "PolinRider" Supply Chain Attack — Deception...](https://pbs.twimg.com/card_img/2119257007454924800/lJcT2Q8A?format=jpg&name=420x420_2)
New Op Report with @proofpoint PackClient, a new C2 framework from Chinese speaking actor TA4922, detonated in a live DeceptionPro honeynet.
The RAT was just the doorman. 4.5 hours in, the operator enrolled the victim into an attacker owned ManageEngine Endpoint Central server.
Full timeline, IOCs, and defender takeaways:
blog.deception.pro/blog/new-…
Companion research from @proofpoint:
proofpoint.com/us/blog/threa…
![[Op Report] PackClient: Hands-on-Keyboard with a new C2 Framework — Deception.Pro Blog](https://pbs.twimg.com/card_img/2120926118278488064/fH3HJ7sq?format=jpg&name=420x420_2)
Full kill chain + IoCs:
blog.deception.pro/blog/pdf-…
![[Op Report] From PDF Phish to XLoader: A ScreenConnect Hands-on-Keyboard Intrusion — Deception.Pro...](https://pbs.twimg.com/card_img/2120315654574370816/mt0dxQzu?format=jpg&name=420x420_2)
5
89
MalBeacon retweeted
#XWorm #AdaptixC2 #ScreenConnect
I have been working with @malbeacon and the deception.pro platform.
Here's a write up of a recent deception operation👇
blog.deception.pro/blog/xwor…
MalBeacon retweeted
Proofpoint baited a cargo/transport industry threat actor into performing its activities in a decoy environment operated by Deception.Pro for 30+ days.
The result: rare, visibility into post‑compromise operations, tooling, and decision‑making. proofpoint.com/us/blog/threa…
ALT Email content sent after responding to a fraudulent load posted on a load board.
New @Proofpoint blog: cargo theft actor spent 30 days inside DeceptionPro environment revealing:
* 4 RMM tools
* Malicious code signing-as-a-service
* 13+ PowerShell scripts, and bank access.
* HoK activity whole way.
This is real adversary telemetry.
Link in thread.
![[Op Report] Trojanized CPU-Z Delivers STXRAT, Steals Credentials, and Exfils Data Through a Hidden...](https://pbs.twimg.com/card_img/2119919386077392896/NOYkjAeA?format=jpg&name=420x420_2)