Approach me at dancho.danchev@hush.com
Wednesday, November 15, 2017
Project Proposal - Cybercrime Research - Seeking Investment
Approach me at dancho.danchev@hush.com
Book Proposal - Seeking Sponsorship - Publisher Contact
Approach me at ddanchev@cryptogroup.net
Thursday, November 09, 2017
New Mobile Malware Spotted in the Wild, Hundreds of Users Affected
We've recently, intercepted, a
currently, circulating, malicious, spam, campaign, affecting,
hundreds, of users, globally, potentially, exposing, the,
confidentiality, availability, and, integrity, of, their, devices,
to, a, multi-tude, of, malicious, software. Largely, relying, on, a,
multi-tude, of social engineering, vectors, the, cybercriminals,
behind, the, campaign, have, managed, to, successfully, impersonate,
Adobe Flash Player, users, into, thinking, that, they're, visiting,
a, legitimate, Web
site, on, their, way, to, infect,
their, devices, relying, on, bogus "Please update Flash on
your device", messages.
Over, the, last, couple, of, years,
we've, been, monitoring, an, increase, in rogue Google Play, type,
of, Android, applications, capable, rogue online Web sites, tricking,
tens, of, thousands, of, users, on, a, daily, basis, into,
installation, rogue, applications, largely, relying, on, a,
multi-tude, of, social engineering, vectors. Next, to, rogue, online,
Web, sites, we've, been, also, actively, monitoring, an, increase,
in, compromised, Web sites, serving, malicious, software,
potentially, exposing, the, confidentiality, availability, and,
integrity, of, their, devices, to, a, multi-tude, of, malicious,
software. We've, been, also, busy, monitoring, an, increase, in,
ongoing, monetizing, of, hijacked, traffic, type, of, underground,
market, traffic, exchanges, with, more, cybercriminals, successfully,
monetizing, the, hijacked, traffic, while, earning, fraudulent,
revenue, in the, process.
In, this, post, we'll, profile, the,
malicious, campaign, provide, actionable, intelligence, on, the,
infrastructure, behind, it, and, discuss, in-depth, the, tactics,
techniques, and, procedures, of, the, cybercriminals, behind, it.
Related malicious MD5s known to have
participated in the campaign:
MD5: 288ad03cc9788c0855d446e34c7284ea
Related malicious URLS known to have
participated in the campaign:
hxxp://brutaltube4mobile.com -
37.1.200.202
hxxp://xxxvideotube.org - 5.45.112.27;
37.140.192.196; 184.82.244.166
Known to have responded to the same
malicious C&C server IP (37.1.200.202), are, also, the following
malicious domains:
hxxp://nudism-nudist.com
hxxp://yumail.site
hxxp://hot-images.xyz
hxxp://nudism-klub.com
hxxp://nudism-nudist.com
hxxp://family-naturism.org
hxxp://teen-nudism.com
hxxp://family-naturism.net
hxxp://teen-media.net
hxxp://01hosting.biz
hxxp://jp-voyeur.com
hxxp://link-protector.biz
hxxp://brutaltube4mobile.com
hxxp://adobeupdate.org
hxxp://australiamms.com
hxxp://brutaltube4mobile.com
hxxp://donttreadonmike.com
hxxp://german-torrent.com
hxxp://fondazion.com
hxxp://derechosmadre.org
hxxp://torsearch.net
hxxp://4mytelecharger55.net
hxxp://4mytelecharger66.net
hxxp://fondazion.net
hxxp://fondazion.org
hxxp://sevajug.org
hxxp://defilez2.net
hxxp://downloadfrance22.com
hxxp://derechosmadretierra.org
Related malicious MD5s, known, to,
have, phoned, back, to, the, same, C&C server IPs
(brutaltube4mobile.com - 37.1.200.202):
MD5: 18327d619484112f81dc7da4169ba088
MD5: 090f7349fef4e1624393383e145d5982
MD5: d2e3d9d0e599cfce1af8b2777c3a071a
Related malicious MD5s known to have
phoned back to the same C&C server IP (xxxvideotube.org -
5.45.112.27; 37.140.192.196; 184.82.244.166):
MD5: 288ad03cc9788c0855d446e34c7284ea
Once executed a sample malware
phones back to the following C&C server IPs:
hxxp://5.196.121.148
Related malicious MD5s known to have
phoned back to the same C&C server IP (5.196.121.148):
MD5: 7bef1c5e0dcf5f6fd152c0723993e378
MD5: 10e6c3f050b24583abf708d6afb34db2
MD5: 5a122660a3d54d9221500224f103d7b0
Thanks, to, the, overall, availability,
of, mobile, affiliate, network, type, of, monetization, vectors, we,
expect, to, continue, observing, an, increase, in, mobile, malware,
type, of, fraudulent, and, rogue, Web sites, serving, malicious,
software, to, unsuspecting, users, internationally.
We'll, continue, monitoring, the,
market, segment, for, mobile, malware, and, post, updated, as, soon,
as, new, developments, take, place.
Friday, July 28, 2017
Introducing Obmonix - The World's Most Comprehensive Sensor Network
The world's leading expert in the field of the security cybercrime research and threat intelligence gathering presents the World's Most Comprehensive Sensor Network for offensive cybercrime/cyberterrorism fighting introducing active sensor deployment cybercrime/cyberterrorism forum and dark-web infiltration launching the Disruptive Individuals startup successfully disrupting and undermining the cybercrime/cyberterrorism ecosystem.
What is the Obmonix Platform?
The Obmonix platform aims to build the World's most versatile and comprehensive sensor network for intercepting monitoring and responding to cybercrime and cyber jihad events successfully deploying a variety of proprietary sensor network based of honeypot appliances industry-wide partnership including the utilization of proprietary cybercrime and cyber jihad forum and community monitoring and infiltration campaigns successfully positioning the platform as the leading indicator for cybercrime and cyber jihad activity globally empowering the operator law enforcement and the security industry with then necessary tactics techniques and procedures (TTPs) for successfully responding and monitoring cybercrime and cyber jihad activity globally leading to successful launch of the Disruptive Individuals startup successfully serving the needs of the Intelligence Community, the security industry and law enforcement agencies globally successfully anticipating an emerging set of malicious and fraudulent tactics techniques and procedures successfully protecting millions of users globally.
How you can help and contribute?
Feel free to join the Indiegogo funds raising campaign and stay tuned for the associated perks.
Looking forward to receiving your response at disruptive.individuals@gmail.com
Stay tuned!
The Obmonix platform aims to build the World's most versatile and comprehensive sensor network for intercepting monitoring and responding to cybercrime and cyber jihad events successfully deploying a variety of proprietary sensor network based of honeypot appliances industry-wide partnership including the utilization of proprietary cybercrime and cyber jihad forum and community monitoring and infiltration campaigns successfully positioning the platform as the leading indicator for cybercrime and cyber jihad activity globally empowering the operator law enforcement and the security industry with then necessary tactics techniques and procedures (TTPs) for successfully responding and monitoring cybercrime and cyber jihad activity globally leading to successful launch of the Disruptive Individuals startup successfully serving the needs of the Intelligence Community, the security industry and law enforcement agencies globally successfully anticipating an emerging set of malicious and fraudulent tactics techniques and procedures successfully protecting millions of users globally.
How you can help and contribute?
Feel free to join the Indiegogo funds raising campaign and stay tuned for the associated perks.
Looking forward to receiving your response at disruptive.individuals@gmail.com
Stay tuned!
Monday, May 29, 2017
Historical OSINT - Mac OS X PornTube Malware Serving Domains
This summary is not available. Please
click here to view the post.
Historical OSINT - Massive Black Hat SEO Campaign Spotted in the Wild
Cybercriminals continue actively launching fraudulent and malicious blackhat SEO campaigns further acquiring legitimate traffic for the purpose of converting it into malware-infected hosts further spreading malicious software potentially compromising the confidentiality availability and integrity of the targeted host to a multi-tude of malicious software.
We've recently intercepted a currently active malicious blackhat SEO campaign serving scareware to socially engineered users with the cybercriminals behind it earning fraudulent revenue largely relying on the utilization of an affiliate-network based revenue-sharing scheme.
In this post we'll profile the campaign, provide actionable intelligence on the infrastructure behind it, and discuss in-depth the tactics techniques and procedures of the cybercriminals behind it.
Known malicious domains known to have participated in the campaign:
hxxp://doremisan7.net?uid=213&pid=3&ttl=319455a3f86 - 67.215.238.189
Known malicious redirector known to have participated in the campaign:
hxxp://marketcoms.cn/?pid=123&sid=8ec7ca&uid=213&isRedirected=1 - 91.205.40.5 - Email: JeremyLRademacher@live.com
Related malicious domains known to have been parked within the same malicious IP (91.205.40.5):
hxxp://browsersafeon.com
hxxp://online-income2.cn
hxxp://applestore2.cn
hxxp://media-news2.cn
hxxp://clint-eastwood.cn
hxxp://stone-sour.cn
hxxp://marketcoms.cn
hxxp://fashion-news.cn
Known malicious domains known to have participated in the campaign:
hxxp://guard-syszone.net/?p=WKmimHVmaWyHjsbIo22EeXZe0KCfZlbVoKDb2YmHWJjOxaCbkX1%2Bal6orKWeYJWfZW
VilWWenGOIo6THodjXoGJdpqmikpVuaGVvZG1kbV%2FEkKE%3D - 206.53.61.73
hxxp://yourspywarescan15.com/scan1/?pid=123&engine=pXT3wjTuNjYzLjE3Ny4xNTMmdGltZT0xMjUxMYkNPAFO - 85.12.24.12
Sample detection rate for sample malware:
MD5: 3d448b584d52c6a6a45ff369d839eb06
MD5: 54f671bb9283bf4dfdf3c891fd9cd700
We'll continue monitoring the campaign and post updates as soon as new developments take place.
We've recently intercepted a currently active malicious blackhat SEO campaign serving scareware to socially engineered users with the cybercriminals behind it earning fraudulent revenue largely relying on the utilization of an affiliate-network based revenue-sharing scheme.
In this post we'll profile the campaign, provide actionable intelligence on the infrastructure behind it, and discuss in-depth the tactics techniques and procedures of the cybercriminals behind it.
Known malicious domains known to have participated in the campaign:
hxxp://doremisan7.net?uid=213&pid=3&ttl=319455a3f86 - 67.215.238.189
Known malicious redirector known to have participated in the campaign:
hxxp://marketcoms.cn/?pid=123&sid=8ec7ca&uid=213&isRedirected=1 - 91.205.40.5 - Email: JeremyLRademacher@live.com
Related malicious domains known to have been parked within the same malicious IP (91.205.40.5):
hxxp://browsersafeon.com
hxxp://online-income2.cn
hxxp://applestore2.cn
hxxp://media-news2.cn
hxxp://clint-eastwood.cn
hxxp://stone-sour.cn
hxxp://marketcoms.cn
hxxp://fashion-news.cn
Known malicious domains known to have participated in the campaign:
hxxp://guard-syszone.net/?p=WKmimHVmaWyHjsbIo22EeXZe0KCfZlbVoKDb2YmHWJjOxaCbkX1%2Bal6orKWeYJWfZW
VilWWenGOIo6THodjXoGJdpqmikpVuaGVvZG1kbV%2FEkKE%3D - 206.53.61.73
hxxp://yourspywarescan15.com/scan1/?pid=123&engine=pXT3wjTuNjYzLjE3Ny4xNTMmdGltZT0xMjUxMYkNPAFO - 85.12.24.12
Sample detection rate for sample malware:
MD5: 3d448b584d52c6a6a45ff369d839eb06
MD5: 54f671bb9283bf4dfdf3c891fd9cd700
We'll continue monitoring the campaign and post updates as soon as new developments take place.
Subscribe to:
Posts (Atom)
About Me
- Dancho Danchev
- Independent Security Consultancy, Threat Intelligence Analysis (OSINT/Cyber Counter Intelligence) and Competitive Intelligence research on demand. Insightful, unbiased, and client-tailored assessments, neatly communicated in the form of interactive reports - because anticipating the emerging threatscape is what shapes the big picture at the end of the day. Approach me at dancho.danchev@hush.com
Dancho Danchev's Blog - Mind Streams of Information Security Knowledge is wearing HalfBaked. Free WP-Theme by GuyFisher. Converted to Blogger by Template-Godown.