InfoSec Articles (11/21/23 – 11/28/23)

Cybersecurity News

?

Welcome to our weekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our weekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

New Agent Tesla Malware Variant Using ZPAQ Compression in Email Attacks

Source: The Hacker News

A new variant of the Agent Tesla malware has been observed delivered via a lure file with the ZPAQ compression format to harvest data from several email clients and nearly 40 web browsers. Read more.

Third-party data breach affecting Canadian government could involve data from 1999

Source: The Register

The government of Canada has confirmed its data was accessed after two of its third-party service providers were attacked. The third parties both provided relocation services for public sector workers and the government is currently analyzing a “significant volume of data” which could date back to 1999. Read more.

Play Ransomware Goes Commercial – Now Offered as a Service to Cybercriminals

Source: The Hacker News

The ransomware strain known as Play is now being offered to other threat actors “as a service,” new evidence unearthed by Adlumin has revealed. Read more.

DarkGate and PikaBot Phishing Campaign is Using Qakbot Tactics

Source: Security Boulevard

The operators behind a phishing campaign that is distributing the DarkGate and PikaBot malware is using many of the techniques attributed to the notorious QakBot operation that was taken down by law enforcement agencies in August. Read more.

Citrix warns admins to kill NetScaler user sessions to block hackers

Source: BLEEPING COMPUTER

Citrix reminded admins today that they must take additional measures after patching their NetScaler appliances against the CVE-2023-4966 ‘Citrix Bleed’ vulnerability to secure vulnerable devices against attacks. Besides applying the necessary security updates, they’re also advised to wipe all previous user sessions and terminate all active ones. Read more.

Anonymous Sudan DDoS Attack Cloudflare Decoded

Source: Security Boulevard

Cloudflare swiftly acknowledged the DDoS attack, emphasizing that it exclusively impacted the www.cloudflare.com website, leaving their broader range of products and services unscathed. A Cloudflare spokesperson assured users that no customer data or services were compromised during the incident. This emphasizes that the website operates on separate infrastructure designed to prevent any collateral damage. Read more.

Malware dev says they can revive expired Google auth cookies

Source: BLEEPING COMPUTER

The Lumma information-stealer malware (aka ‘LummaC2’) is promoting a new feature that allegedly allows cybercriminals to restore expired Google cookies, which can be used to hijack Google accounts. Read more.

DPRK Hackers Masquerade as Tech Recruiters, Job Seekers

Source: DARK READING

North Korean threat actors are posing as both job recruiters and job seekers on the Web, deceiving companies and applicants for financial gain and, possibly, to gain access into Western organizations. Read more.

New Flaws in Fingerprint Sensors Let Attackers Bypass Windows Hello Login

Source: The Hacker News

The flaws were discovered by researchers at hardware and software product security and offensive research firm Blackwing Intelligence, who found the weaknesses in the fingerprint sensors from Goodix, Synaptics, and ELAN that are embedded into the devices. Read more.

Welltok Data Breach Impacted 8.5 Million Patients in the U.S.

Source: Security Affairs

The company disclosed a data breach that exposed the personal data of nearly 8.5 million patients (8,493,379) in the U.S.. On July 26, 2023, threat actors hacked the company’s MOVEit Transfer server. Read more.

ClearFake Campaign Spreads macOS AMOS Information Stealer

Source: Security Affairs

Threat actors spread Atomic Stealer (AMOS) macOS information stealer via a bogus web browser update as part of the ClearFake campaign. Read more.

PoC for Splunk Enterprise RCE flaw released (CVE-2023-46214)

Source: HELP NET SECURITY

A vulnerability researcher has published a detailed analysis of CVE-2023-46214 and has consolidated the steps required for exploitation into a Python script. If specific prerequisites are met, the script should open a remote command prompt. Read more.

Hackers Hijack Industrial Control System at US Water Utility

Source: SECURITY WEEK

The Municipal Water Authority of Aliquippa in Pennsylvania has confirmed that hackers took control of a system associated with a booster station over the weekend, but said there was no risk to the water supply. Read more.

GE servers hacked n DARPA Military Info Leaked

Source: Cybersecurity INSIDERS

General Electric, commonly referred to as GE, a multinational corporation engaged in the fields of renewable energy, aerospace, and power, has fallen prey to a cyber attack resulting in the leakage of sensitive information related to DARPA Military operations. Read more.

 

Want more articles? Check out the previous edition of Security Signals. Want to dig deeper on DDoS Attacks, check out the Malware Patrol DDoS: What is a Reflection and Amplification Attack? blog post.

?

InfoSec Articles (11/14/23 – 11/21/23)

Cybersecurity News

?

Welcome to our weekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our weekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

IPStorm botnet dismantled by FBI as hacker pleads guilty to three charges

Source: SC Media

The Federal Bureau of Investigation (FBI) dismantled an international botnet comprising more than 23,000 proxies after the hacker responsible for the network reached a plea deal with authorities. Read more.

Scattered Spider

Source: CISA

The FBI and CISA are releasing this joint Cybersecurity Advisory (CSA) in response to recent activity by Scattered Spider threat actors against the commercial facilities sectors and subsectors. This advisory provides tactics, techniques, and procedures (TTPs) obtained through FBI investigations as recently as November 2023. Read more.

UK labels AI Tools as a cyber threat to National Elections

Source: Cybersecurity INSIDERS

Britain has identified the continued use of AI tools as a significant cyber threat to the upcoming national elections slated for January 2025. Emphasizing the increasing difficulty for security experts to track and neutralize these deepfake threats, particularly in the context of digital elections, the nation has raised concerns about potential interference. Read more.

Samsung Hacked: Customers Personal Information Exposed

Source: GBHackers

The breach was formally confirmed in an email received by this reporter on the night of November 15. Samsung traced the detection of the cyber incursion back to November 13. Although the specific third-party business application remains undisclosed, Samsung ascribes the breach to a flaw. Customers who made purchases between July 1, 2019, and June 30, 2020, are presumed to be impacted. Read more.

Hackers Could Exploit Google Workspace and Cloud Platform for Ransomware Attacks

Source: The Hacker News

A set of novel attack methods has been demonstrated against Google Workspace and the Google Cloud Platform that could be potentially leveraged by threat actors to conduct ransomware, data exfiltration, and password recovery attacks. Read more.

Attacker – hidden in plain sight for nearly six months – targeting Python developers

Source: Checkmarx

For nearly half a year, a threat actor has been planting malicious Python packages into the open-source repository. Many of the malicious packages were camouflaged with names closely resembling popular legitimate Python packages. Consequently, they received thousands of downloads. Read more.

TA402 Uses Complex IronWind Infection Chains to Target Middle East-Based Government Entities

Source: Proofpoint

From July through October 2023, Proofpoint researchers observed TA402 engage in phishing campaigns that delivered a new initial access downloader dubbed IronWind. The downloader was followed by additional stages that consisted of downloaded shellcode. Read more.

Children’s tablet has malware and exposes kids’ data, researcher finds

Source: TechCrunch

The Dragon Touch KidzPad Y88X contains traces of a well-known malware, runs a version of Android that was released five years ago, comes pre-loaded with other software that’s considered malware and a “potentially unwanted program” because of “its history and extensive system level permissions to download whatever application it wants,” and includes an outdated version of an app store designed specifically for kids, according to Hancock’s report, which was released on Thursday and seen by TechCrunch ahead of its publication. Read more.

New ‘Octo’ malware tricks Android users into giving up bank details

Source: RNZ

Netsafe says it’s not aware of New Zealanders being tricked into giving up their bank details by a sophisticated new malware but it is possible they have without realising. The ABC reported that Russian cyber criminals have targeted hundreds of bank customers across the Tasman with a malware called Octo. Read more.

ALPHV/BlackCat Take Extortion Public

Source: TREND MICRO

ALPHV filed a complaint with the Security and Exchange Commission (SEC) stating their victim (MeridianLink) had not disclosed a breach within the 4 day requirement from the SEC. It appears this is an attempt to influence MeridianLink to pay the ransom sooner than later. This is an interesting spin on the traditional tactic used and one that could become more pronounced in 2024. Read more.

Phishing page with trivial anti-analysis features

Source: SANS Internet Storm Center

Anti-analysis features in phishing pages – especially in those, which threat actors send out as e-mail attachments – are nothing new[1,2]. Nevertheless, sometimes the way that these mechanisms are implemented may still leave one somewhat mystified. This has happened to me a few weeks ago when I found what appeared to be a generic phishing message in one of my spam traps. Read more.

CISA Releases The Mitigation Guide: Healthcare and Public Health (HPH) Sector

Source: CISA

This guide provides defensive mitigation strategy recommendations and best practices to combat pervasive cyber threats affecting this critical infrastructure sector. It also identifies known vulnerabilities for organizations to assess their networks and minimize risks before intrusions occur. Read more.

Blacksuit Ransomware linked to Royal Ransomware

Source: Cybersecurity INSIDERS

As per an advisory from the FBI and US-CISA, a forthcoming ransomware variant is set to enter the cybersecurity landscape, marking itself as a rebrand or offshoot of the Royal Ransomware gang, notorious for purportedly amassing around $275 million in 2022. Read more.

CitrixBleed Vulnerability Exploitation Suspected in Toyota Ransomware Attack

Source: SECURITY WEEK

Toyota Financial Services Europe & Africa this week confirmed being targeted in a cyberattack, which appears to have been conducted by a known ransomware group. The Toyota subsidiary said it recently detected unauthorized activity on systems in a limited number of locations. In response, it took some systems offline and they are gradually being brought back online. Read more.

 

Want more articles? Check out the previous edition of Security Signals. Want to explore more on the Topic of Phishing, check out the Malware Patrol blog Post: Phishing: The Tide Is Still Coming In.

?

InfoSec Articles (11/07/23 – 11/14/23)

Cybersecurity News

?

Welcome to our weekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our weekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Japan Aviation Electronics Targeted in Ransomware Attack

Source: SECURITY WEEK

While Japan Aviation Electronics has not found evidence of data exfiltration, the Alphv/BlackCat ransomware gang claims to have stolen roughly 150,000 documents from the company, including blueprints, contracts, confidential messages, and reports. Read more.

Microsoft Authenticator Restricts Suspicious MFA Notifications

Source: Latest Hacking News

The Redmond giant has recently announced introducing a new privacy feature to its authenticator app. With this feature, Microsoft Authenticator app now blocks suspicious multi-factor authentication notifications to prevent potential abuse. Read more.

Chinese multinational bank hit by ransomware

Source: HELP NET SECURITY

The state-owned Industrial and Commercial Bank of China (ICBC), which is one of the largest banks in the world, has been hit by a ransomware attack that led to disrupted trades in the US Treasury market. Read more.

After ChatGPT, Anonymous Sudan Took Down The CloudFlare Website

Source: Security Affairs

The hacktivist group Anonymous Sudan claimed responsibility for the massive distributed denial-of-service (DDoS) attack that took down the website of Cloudflare. Cloudflare confirmed that a DDoS attack took down its website for a few minutes and ponited out that it did not impact other products or services. Read more.

Threat Actors Leverage File-Sharing Service and Reverse Proxies for Credential Harvesting

Source: TREND MICRO

The attacker-controlled reverse proxies function as intermediary servers positioned between the target and a legitimate authentication endpoint, such as the Microsoft 365 login page. When a victim interacts with the fake login page, the reverse proxy presents the genuine login form, manages incoming requests, and conveys responses from the legitimate Microsoft 365 login page. Read more.

Iranian hackers launch malware attacks on Israel’s tech sector

Source: BLEEPING COMPUTER

Security researchers have tracked a new campaign from Imperial Kitten targeting transportation, logistics, and technology firms. Imperial Kitten is also known as Tortoiseshell, TA456, Crimson Sandstorm, and Yellow Liderc, and for several years it used the online persona Marcella Flores. Read more.

Unlucky Kamran: Android malware spying on Urdu-speaking residents of Gilgit-Baltistan

Source: welivesecurity

When opened on a mobile device, the Urdu version of the Hunza News website offers readers the possibility to download the Hunza News Android app directly from the website, but the app has malicious espionage capabilities. Read more.

Routers Targeted for Gafgyt Botnet [Guest Diary]

Source: SANS Internet Storm Center

The threat actor attempts to add my honeypot into a botnet so the threat actor can carry out DDoS attacks. The vulnerabilities used for the attack were default credentials and CVE-2017-17215. To prevent these attacks, make sure systems are patched and using strong credentials. Read more.

Keeping Up with Today’s Top Mobile Spyware Threat Trends

Source: CheckPoint

In this post, we will explore trends including the rise of new and more sophisticated types of mobile spyware: nation-level spyware and modified applications. We’ll also present several best practices to help you protect all your organization’s assets. Read more.

Police Seized BulletProftLink Phishing-as-a-Service (PhaaS) Platform

Source: Security Affairs

The Royal Malaysian Police announced to have dismantled the notorious BulletProftLink phishing-as-a-service (PhaaS) platform. A joint international operation conducted by the Malaysian police, the FBI, and the Australian Federal Police took down several domains employed in the cybercriminal operation. Read more.

It’s Still Easy for Anyone to Become You at Experian

Source: Krebs on Security

In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this gaping lack of security. Read more.

The Lorenz Ransomware Group Hit Texas-Based Cogdell Memorial Hospital

Source: Security Affairs

The Lorenz extortion group claimed responsibility for the security breach and added the hospital to its Tor leak site. The group claims to theft of more than 400GB of data, including internal files, patient medical images, and also employee email communications. Read more.

Microsoft Warns of Fake Skills Assessment Portals Targeting IT Job Seekers

Source: The Hacker News

A sub-cluster within the infamous Lazarus Group has established new infrastructure that impersonates skills assessment portals as part of its social engineering campaigns. Microsoft attributed the activity to a threat actor it calls Sapphire Sleet, describing it as a “shift in the persistent actor’s tactics.” Read more.

Chinese APT Targeting Cambodian Government

Source: Unit 42 by Palo Alto

Unit 42 has identified malicious Chinese APT infrastructure masquerading as cloud backup services. Monitoring telemetry associated with two prominent Chinese APT groups, we observed network connections predominately originating from the country of Cambodia, including inbound connections originating from at least 24 Cambodian government organizations. Read more.

 

Want more articles? Check out the previous edition of Security Signals. Want to get more information on what Ransomware is, check out the Malware Patrol blog Post: What is Ransomware?

?

Honeypots: Simple Tools that Supercharge Cybersecurity

Insights

?

honeypots

Using Honeypots for Threat Intelligence Collection

Staying ahead of malicious actors is a constant challenge. As threats continue to increase in complexity and sophistication, organizations must adopt innovative approaches to safeguard their digital assets and sensitive information. One such approach is the use of threat intelligence derived from honeypots. These deception technology tools offer a unique and invaluable insight into the tactics, techniques, and procedures employed by cybercriminals, providing organizations with the upper hand in the ongoing battle against attackers.

Honeypots are virtual or physical decoy systems designed to mimic legitimate services or applications. They can be strategically placed within an organization’s network to attract cyber attackers, diverting their attention away from actual critical assets. Another option, for research and threat intelligence gathering, is setting them up in distinct geographies via various service providers. No matter how they are deployed, the beauty of honeypots lies in their ability to capture and analyze timely data about incoming attacks without putting actual systems at risk. This data, often referred to as “honey data,” sheds light on emerging attack vectors.

1. Real-time Visibility into Attacks: Using honeypots for threat intelligence offers a front-row seat to ongoing cyber attacks. By emulating vulnerable systems and services, these traps attract a wide range of attackers attempting to exploit perceived weaknesses. The interactions between attackers and honeypots yield a wealth of information about attack methodologies, malware variants, and even potential zero-day vulnerabilities. This instant visibility enables security teams to detect and respond to threats swiftly, reducing the window of exposure and potential damage.

2. Understanding Attack Tactics: Through honeypots, organizations gain an intricate understanding of the tactics, techniques, and procedures (TTPs) employed by threat actors. Analyzing the behavior of attackers within the controlled environment of honeypots unveils their strategies, tools, and evasion techniques. This knowledge is crucial for anticipating future attacks and enhancing cybersecurity measures.

3. Prioritization and Resource Allocation: With the data derived from honeypots, organizations can effectively prioritize their cybersecurity efforts. By identifying the most prevalent attack vectors and targeting vulnerable systems, security teams can allocate resources where they are needed most. This strategic approach ensures that cybersecurity investments are optimized to mitigate the highest risks, leading to a more resilient defense posture.

Types of Honeypot Attacks

There are many different kinds of honeypots. They range from low interaction to high interaction, and can mimic just about anything: IOT devices, SSH, WordPress, databases, ICS, and APIs, to name a few. By emulating vulnerable systems, services, and applications, honeypots attract attackers and capture their activities in a controlled environment. Here are some of the key types of attacks that you can effectively detect by utilizing honeypots for threat intelligence:

  1. Break-In Attempts: Honeypots are adept at capturing break-in attempts, where attackers try to gain unauthorized access to systems or networks. By mimicking enticing entry points, such as open ports or weakly protected services, honeypots can lure attackers and record their attempts to exploit vulnerabilities.
  2. Malware Propagation: Honeypots can also detect attempts to spread malware across networks. Attackers often use compromised systems as launchpads for distributing malware to other targets. Honeypots, acting as seemingly vulnerable hosts, attract malware propagation attempts and allow researchers to analyze the behavior and characteristics of the malicious code.
  3. Port Scanning and Reconnaissance: Cybercriminals often perform port scanning to identify potential entry points into a network. Honeypots, configured with various open ports and services, can capture these scanning activities. The data collected provides insights into the attacker’s scanning techniques and the extent of their reconnaissance efforts.
  4. Credential Theft and Brute Force Attacks: Honeypots can mimic login pages and services to attract attackers attempting to steal credentials through phishing or brute force attacks. By capturing these login attempts, organizations can gain insights into the attackers’ methods and strategies for credential theft.
  5. Botnet Activities: Honeypots can act as alluring targets for botnets seeking to recruit new compromised hosts. By engaging with these botnets, researchers can gain insights into command and control mechanisms, as well as the scale and distribution of the botnet infrastructure.
  6. Distributed Denial of Service (DDoS) Reconnaissance: Attackers often conduct reconnaissance to identify potential targets for DDoS attacks. Honeypots can capture these reconnaissance activities, shedding light on the attacker’s infrastructure and the potential targets they are assessing.
  7. Exploitation of Vulnerabilities: Honeypots can replicate systems with known vulnerabilities, inviting attackers to exploit these weaknesses. This allows security teams to analyze the techniques used by attackers to compromise systems and the specific vulnerabilities they target.
  8. Insider Threat Detection: Honeypots can also be used to detect insider threats, where authorized individuals misuse their privileges to compromise systems or steal sensitive data. By tracking unusual activities within the controlled environment of a honeypot, organizations can identify potential insider threats.
  9. Zero-Day Exploits: Honeypots can be configured to mimic specific software versions and configurations that may be vulnerable to zero-day exploits. Detecting attackers attempting to exploit unknown vulnerabilities provides crucial insights into emerging threats.
  10. Command and Control (C2) Communications: Honeypots can capture communications between compromised systems and command and control servers. This helps researchers understand the communication protocols, techniques, and infrastructure used by attackers to control compromised hosts.

Introducing Malware Patrol’s Intrusion Insights Feed

Our newest offering, Intrusion Insights Data Feed, is derived from honeypots strategically deployed across the globe. Until now, our decade-old honeynet has been used for internal purposes only. We are thrilled to finally be sharing this information with our customers. The JSON-formatted data feed, updated every 15 minutes and spanning the last 36 hours of activity, provides a treasure trove of insights into live, ongoing attacks against cyber infrastructure.

Conclusion

At Malware Patrol, we believe that some of cyber security’s most mature and commonly used tools still offer high ROI and impacts well beyond those of their contemporary, super-hyped counterparts. The use of honeypots for threat intelligence collection is a dependable classic. The basics are always in style around here!

With their ability to attract, capture, and analyze attacks, honeypots provide a unique and incomparable vantage point into the strategies employed by malicious actors. Embrace the power of using honeypots for threat intelligence and request a free evaluation of our Intrusion Insights feed today.

Leslie Dawn

Technical Account Manager

Leslie Dawn is a Technical Account Manager / Threat Intelligence Analyst at Malware Patrol. Her background of nearly a decade in cyber threat intelligence provides her with a nuanced understanding of threat landscapes and client security needs.

 

?

New OSINT Feeds: High Risk IPs – Risk Indicators – Tor Exit Nodes

Insights

?????

OSINT feed

Sharing is Caring

To our industry’s credit, there are many good OSINT feeds and data sharing platforms. Even better, they are relatively easy to find. A simple Google search for open source intelligence (OSINT) threat feeds or open source cybersecurity tools will yield many, many results. This is really a testament to the goodwill and collaborative spirit of the cybersecurity community.

Some examples of data sharing options include DHS CISA AIS, AlienVault OTX, and Abuse.ch, just to name a few. High quality open source security tools (TIP, SIEM, SOAR), such as MISP, are also readily available to help your organization utilize intelligence of all kinds.

Avoid Analysis Paralysis

As usual, there is a however to this good news: the number of available resources can be overwhelming. When faced with so many options, it can be difficult, or time consuming at the very least, to select, evaluate, and implement free intelligence and tools in your organization. Without some parameters or pre-defined goals, your research efforts may fall short.

If you are about to embark on this journey, we would like to offer a few suggestions about how to structure and organize your OSINT search process:

1) Determine your organization’s intelligence needs and priorities.

    • Review current goals or roadmaps related to threat intelligence to clarify and prioritize your needs.
    • Ask your security team – and other relevant stakeholders – for their input:
      • What are your data gaps? For example, what caused your last incident, and could it have been prevented with some additional type of data?
      • Do you know the tactics, techniques and procedures (TTPs) of threat actors targeting your organization’s industry and could OSINT help prepare for these specific kinds of attacks?
      • Is there a paid intelligence resource or tool you are unable to afford but really want? Maybe it is worth looking for a free/open source alternative?
      • Also consider other topics specific to your organization, industry, security environment, geopolitical events, and so on

2) Research and compile a list of potential sources.

    • Use one of the industry’s go-to OSINT resources as a starting point.
    • Ask around – nothing beats a firsthand recommendation.
    • Search for curated lists of OSINT feeds/sources. (Be mindful of the age and potential bias of the information source.) We found these helpful articles during our research: SOCRadar, Spiderfoot, Sunny Valley Networks and SENKI. GitHub rarely disappoints.

3) Evaluate and rate the sources for final decision making.

    • Criteria to consider:
      • Data quality – Are you familiar with the organization that generates it? Or how a crowd-sourced data community is managed, members vetted? Is the data rated or otherwise confirmed by group members in some way? How is it aged?
      • Update frequency (if applicable) – Hourly, Daily, Monthly, Other?
      • Coverage – Geography? Market vertical?
      • Aggregation/Efficiency – Does the provider aggregate multiple sources into one?
      • Ease of integration/retrieval – Do your tools ingest data in the formats provided? Can collection be easily automated or otherwise added to your team’s tasks without being burdensome?
      • Context – Does the data include context on the incident or campaign?
      • Licensing – Does it allow for your intended use of the data? Open source does not automatically mean the data can be used freely for commercial purposes.
    • Check for overlap with your current resources to prevent overloading your tools with repetitious data. For example, MISP has a Feed overlap analysis matrix. Other tools offer similar functionality.
    • Consider the reputation of the provider and any other applicable factors from your research to determine the confidence level you feel comfortable applying to the data:
      • High confidence – Decisions and alerts will be based on this data source
      • Medium confidence – Indicator must be confirmed by another source before acted upon
      • Low or N/A confidence – Not used for alerts or blocking, but useful for research and as a confirmation of an indicator’s maliciousness
    • Use all the above information to make a final list. Review and decide.

4) Decide which tool(s) and/or process(es) will use the OSINT feed or unstructured data and for what purpose. (Use details from step 1 to help with this.)

    • Integrate the threat data into your security tool(s) and processes. Set up automatic downloads and/or assign manual tasks.
    • Update documentation/SOPs to include your new resources.
    • Inform security teams and provide any necessary training on how to use/interpret the data.
    • Schedule a review (30, 60, 90 days) to evaluate the usefulness and quality of the data.
    • Wash, rinse, repeat to keep expanding your OSINT at regular intervals.

OSINT Feeds from Malware Patrol

If acquiring open source intelligence is a goal for your organization, we invite you to check out Malware Patrol’s free OSINT feeds. The curated data is derived from our internal research well as trusted third-party sources.

  • High Risk IPs: Addresses involved in a range of malicious activities, such as spam, malware distribution, botnets, and command-and-control communications.
  • Risk Indicators: A variety of threat related IoCs, including: MD5, SHA1, and SHA256 hashes, email addresses, cryptocurrency addresses, and CVEs.
  • Tor Exit Nodes: Addresses of active Tor exit nodes as reported by the Tor Project. Frequently involved in malicious activities, it is advisable to monitor, if not block, traffic from these IPs.

Here’s how Malware Patrol does OSINT:

  • We enrich the feeds with decision-enhancing context such as the associated malware family, threat actor, article links, and any other available metadata.
  • Entries are aged and removed at regular intervals to make sure the data stays fresh.
  • Our team manages the data quality and sources closely.

To find out more about our OSINT feeds, visit our Enterprise page.

 

OSINT feed
?