In this report, we describe how we tracked for several months a sustained espionage campaign against the government, media, and news sectors in several countries including Laos, Cambodia, Singapore, the Philippines and Indonesia.

Since early 2025, China’s involvement in the Indo-Pacific has been more prolific, from escalating maritime tensions, to being peacebroker in Myanmar’s military junta and more recently, espionage activities on joint exercises the Philippines naval forces have been conducting together with the US, Australia, Canada and New Zealand.

The attacker, which we believe is a China-nexus threat actor, showcases a love of DLL sideloading techniques in order to compromise their targets of interest. Governments and media are high-value targets because they shape policy, public opinion, and international alignment.

The report details the full attack chain of one particular compromise we discovered, and goes further into detail on victimology, other campaigns and finally lists indicators of compromise.

 Link to the report: https://cyberarmor.tech/blog/autumn-dragon-china-nexus-apt-group-targets-south-east-asia 

Earth Estries, also known as Salt Typhoon and a few other names, is a China-nexus APT actor, and is known to have used multiple implants such as Snappybee (Deed RAT), ShadowPad, and several more.

In their latest campaign, the actor leverages one of the latest WinRAR vulnerabilities that will ultimately lead to running shellcode.

The execution flow is as follows:

That is all. Find below indicators of compromise and Yara rules.

Indicator	Type	Purpose
f8c119bfc057dc027e6c54b966d168ee1ef38c790e581fb44cf965ca0408db1d	SHA256 Hash	CAB file storing ccwkrlib.dll
94aa6619c61d434e96ca8d128731eb7ee81e399a59a17f751a31b564a7f3a722	SHA256 Hash	Encrypted stub
3c84a5255e0c08e96278dea9021e52c276b4a6c73af9fa81520aefb4a8040a8b	SHA256 Hash	CAB file storing RES.RC
3822207529127eb7bdf2abc41073f6bbe4cd6e9b95d78b6d7dd04f42d643d2c3	SHA256 Hash	Dropper
64ca55137ba9fc5d005304bea5adf804b045ec10c940f6c633ffde43bc36ff3f	SHA256 Hash	Fake PDF with ADS stream
6c6af015e0bfec69f7867f8c957958aa25a13443df1de26fa88d56a240bdd5ad	SHA256 Hash	Hijacked DLL, bloated
5e062fee5b8ff41b7dd0824f0b93467359ad849ecf47312e62c9501b4096ccda	SHA256 Hash	Hijacked DLL
3b47df790abb4eb3ac570b50bf96bb1943d4b46851430ebf3fc36f645061491b	SHA256 Hash	Downloads CommonSDK.exe
ccwkrlib.dll	Filename	Hijacked DLL
RES.RC	Filename	Encrypted stub
CommonSDK.exe	Filename	Fake PDF with ADS stream
doc20250921133625.pdf	Filename	Fake PDF with ADS stream
startup.bat	Filename	Downloads CommonSDK.exe
WindowsTarys	Filename	Scheduled task
38[.]54[.]105[.]114	IP Address	Download server
mimosa[.]gleeze[.]com	Domain	C2 Server

 

Associated Yara rules are available on my Github: 

https://github.com/bartblaze/Yara-rules 

Rule names:

• EE_Loader 
• EE_Dropper 
• WinRAR_ADS_Traversal

References / Resources:

WinRAR CVE:

https://nvd.nist.gov/vuln/detail/CVE-2025-8088

https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/

Earth Estries:

https://jsac.jpcert.or.jp/archive/2025/pdf/JSAC2025_1_5_leon-chang_theo-chen_en.pdf 

https://www.trendmicro.com/en_us/research/25/j/premier-pass-as-a-service.html  

https://malpedia.caad.fkie.fraunhofer.de/actor/earth_estries 

https://malpedia.caad.fkie.fraunhofer.de/actor/ghostemperor

A month or so ago a friend of mine received the following message on Steam from someone in their Friends list (they were already friends):

Figure 1 - 'this is for you'

 

 

 

 

 

The two links are different and refer to a Gift Card on Steam's community platform. As you might have noticed, the domain is not related to Steam at all, but rather is an attempt at phishing.

 The URLs are:

stermcormmunity[.]com/gift-card/
steamcoummuniity[.]com/gift-card/

The differences are subtle enough that you may just miss it. When you click on the link, you are redirected to a 'Summer Gift Marathon'.

Figure 2 - Fake Steam website

Once you log in to the fake Steam website, your credentials are stolen and will be used to spread more phishing, likely steal your inventory items and so on.

Other phishing sites related to this campaign are:

steam-pubgvn[.]top
steamauthconnection[.]store
steamcommnunity[.]com
steamcommunitay[.]com
steamcommunitfy[.]com
steamcommunitihy[.]icu
steamcommunitiny[.]com
steamcommunitweya[.]art
steamcommunl1ty[.]com
steamcommunllity[.]com
steamcommunty[.]ru
steamcommununity[.]cam
steamcommunutiy[.]com
steamcomnunityty[.]com
steamcomnunlity[.]com
steamcomnuty[.]com
steamcomrnnunlty[.]com
steamcomun1ty[.]com
steamcomuniry[.]com
steamconmunify[.]com
steamconnection[.]store
steamcornmunlty[.]ru
steamcornrnunlty[.]ru
steamlinks-short[.]com
stearncommunjty[.]com
stearncommunnity[.]com
stearncomnunity[.]com
stearncornnunity[.]com
steeamcommunitty[.]com
unevwsteeamcommunitty[.]com 

New ones do pop up from time to time, so stay vigilant. 

Tips  

 

 

Today's post is a brief one on some Microsoft Word and sandbox detection / discovery / fun.

Collect user name from Microsoft Office

Run a Microsoft Word doc with.. .asd extension

 

In recent months, North Korean based threat actors have been ramping up attack campaigns in order to achieve a myriad of their objectives, whether it be financial gain or with espionage purposes in mind. The North Korean cluster of attack groups is peculiar seeing there is quite some overlap with one another, and it is not always straightforward to attribute a specific campaign to a specific threat actor.

In this research paper we analyse a new threat campaign, discovered in late May, and which features multiple layers and ultimately delivers a seemingly new and previously undocumented backdoor.

The threat campaign is specifically focused on Aerospace and Defense companies: sectors appealing to multiple threat actors, but of particular interest to North Korean threat groups in other recent campaigns. We have named this threat campaign “Niki” as it refers to the potential malware developer(s).

Read the report here: https://cyberarmor.tech/new-north-korean-based-backdoor-packs-a-punch/

Direct link to report, PDF: https://cyberarmor.tech/wp-content/uploads/2024/06/New-North-Korean-based-backdoor-packs-a-punch.pdf

Introduction

Earlier last week, I ran into a sample that turned out to be PureCrypter, a loader and obfuscator for all different kinds of malware such as Agent Tesla and RedLine. 

Upon further investigation, I developed Yara rules for the various stages, which can be found here (excluding the final payload):

• PureZip
• 2nd stage downloader (PureLogStealer related)

With that out of the way, all of this reminded me of the fact that we can also write Yara rules for unique identifiers specific to malware written in .NET, or any other .NET assemblies for that matter.

A bit of history

This isn’t my first encounter with analysing .NET malware at scale: several years ago, I co-authored a presentation with Santiago on hunting SteamStealer malware, which was surging exponentially at the time (the malware intended to steal your Steam inventory items and/or your account). A huge thanks goes to Brian Wallace who had developed a tool at the time called GetNetGUIDs which made it trivial to extract all the GUID types and start clustering to identify patterns: basically, which of the malware samples are likely authored by the same person or belong to the same attack campaign.

.NET assemblies or binaries often contain all sorts of metadata, such as the internal assembly name and GUIDs, specifically; the MVID and TYPELIB.

• GUID: Also known as the TYPELIB ID, generated when creating a new project.

• MVID: Module Version ID, a unique identifier for a .NET module, generated at build time.

• TYPELIB: the TYBELIB version – or number of the type library (think major & minor version).

These specific identifiers can be parsed with the strings command and a simple regular expression (regex): [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}

Taking a sample of PureLogStealer posted by James_in_the_box, you could then write a Yara rule based on the MVID or Typelib detected.

As shown on VirusTotal for this sample:

Figure 1 - Sample with MVID 9066ee39-87f9-4468-9d70-b57c25f29a67

And the resulting (simple) Yara rule, could then be as follows:

rule PureLogStealer_GUID

{

strings:

$mvid = "9066ee39-87f9-4468-9d70-b57c25f29a67" ascii wide fullword

condition:

$mvid

}

There are however some issues with this: 

• The MVID is stored as a binary value rather than a string, whereas the Typelib GUID is effectively stored as a string and since we only have the MVID here, the sample above will not be detected with this rule.

• It is important to note that VirusTotal does not seem to report the Typelib.

• It is cumbersome to “do it the manual way” with strings and regex, especially on larger data sets – and it’s prone to issues such as:

• false positives: if you run "strings" on the sample and then use the following CyberChef recipe – we get plenty of GUIDs, but only 1 is the actual Typelib;

• false negatives: we miss out on unique identifiers, which means we might miss detection of samples, campaigns or actors.

Note that with tools such as IlSpy or dnSpy(Ex), you can also view the Typelib GUID and MVID, however, not all tools display all data, for example:

Figure 2 - dnSpy detects the Typelib GUID of the sample

And if we go the "oldschool" route using ildasm:

Figure 3 - ildasm displays the MVID or Module Version ID

For all the above reasons, let’s go beyond and do more: both with Yara, and with a new Python tool I’ve created.

The now and the tooling

Before we dive into the tooling, some final history to say that Yara has evolved and thanks to that, we can now hunt and detect more effectively due to the following modules added:

• 2017: introduction of .NET module (link)

• 2022: introduction of console module (link)

This means that using the .NET module, we can now write a Yara rule like so instead:

import "dotnet"

rule PureLogStealer_GUID

{

condition:

dotnet.guids[0]== "9066ee39-87f9-4468-9d70-b57c25f29a67"

}

And indeed:

Figure 4 - Yara now detects the sample

Yara rule

Let’s now leverage the power of Yara and its dotnet and console modules to write a new Yara rule that displays useful data of any given .NET sample that can be leveraged to create meaningful rules, for example: assembly name, typelib and MVID. 

Figure 5 - Yara rule to display .NET information to the console

We first verify if the binary is a .NET compiled file, if so, log certain Portable Executable (PE) or binary information to the console as well, and then display all relevant .NET information.

And the output will be, again for the same sample:

Figure 6 - Yara rule output: sample metadata!

Meaning we can now write a rule as follows:

import "dotnet"

rule PureLogStealer_GUID

{

condition:

dotnet.guids[0]=="9066ee39-87f9-4468-9d70-b57c25f29a67" or

dotnet.typelib=="856e9a70-148f-4705-9549-d69a57e669b0"

}

Python tool

But what if we want to run this on a large set of samples and produce statistics, which we can then use to hunt or classify malware families, or cluster campaigns?

A newly developed Python tool will help you do exactly just that. It supports both a single file as well as a whole folder of your samples or malware repository. It will skip over any non-.NET binary and simply report the typelib, MVID and typelib ID (if present, which is seldom the case and rarely useful).

If we run it on our single sample like before:

Figure 7 - New tool output on single sample

The tool (or script) has the following capabilities:

Figure 8 - Run the tool with -h to display usage or help

FARA, or Faux YARA, is a simple repository that contains a set of purposefully erroneous Yara rules. It is meant as a training vehicle for new security analysts, those that are new to Yara and even Yara veterans that want to keep their rule writing (and debugging) sharp.

Example "faux" rule

Find it over on Github:

https://github.com/bartblaze/FARA 

Quite a while ago, I've published some of my private Yara rules online, on Github.

They can be found here:

https://github.com/bartblaze/Yara-rules

There's two workflows running on that Github repository:

• YARA-CI: runs automatically to detect signature errors, as well as false positives and negatives.
• Package Yara rules: allows download of a complete rules file (all Yara rules from this repo in one file) for convenience from the Actions tab > Artifacts (see image below).

The Yara rules are divided into:

• APT
• Crimeware
• Generic
• Hacktools
• Ransomware
  

Furthermore, the rules can work natively with AssemblyLine due to the CCCS Yara rule standard adoption.

PR's are welcome where you see fit. 

This blog post is divided into four parts:

• Introduction: provides an overview of what happened
  
• Analysis: analysis of the attack and the malware used
  
• Detection: how to detect and remove the malware (skip to Detection if you just want to clean this up)
  
• Prevention: how to prevent this from happening again
  
• Conclusion: a brief conclusion and additional thoughts
  

Introduction

From at least last Thursday, 10th of June 2021, multiple users report on Twitter that they got hacked after being approached to create new digital art. These users, accomplished digital artists and publishing their work on NFT marketplaces, were approached either via Instagram, Twitter DM (message) or directly via email. The attacker has masqueraded themselves behind multiple personas, often claiming to be from South Korea. A few of the users that reported the attack:

Ariel:

Small thread on the recent attacks to NFT artists, and how to prevent it. #NFTLamers #StolenNFT #NFTArt pic.twitter.com/KvrsuyQaeT

— 🌈 ArielBeckerArt.eth #SquidGang 🦑 (@arielbeckerart) June 10, 2021

 

fvckrender:

Be really careful out there I was dumb enough to not overlook this and open their SCR file and got my metamask swiped from à to Z all my tokens gone. They tried to access other app but my 2fa blocked them to. I’m an idiot don’t me an idiot like me and secure your shit. pic.twitter.com/gAins00taH

— FVCKRENDER (@fvckrender) June 11, 2021

 

Nicole:

 

Really terrible day. My Metamask got hacked and now my @withFND account is compromised. Opened a scam project proposal with a .scr file and a Microsoft Word icon. Anyone experience this before? Trying to figure out what to do

— Nicole Ruggiero (@_NicoleRuggiero) June 11, 2021

 

ARC:

 

New scam just dropped, specifically targeting artists, the file seems to be a virus pic.twitter.com/IFv8N5RBSg

— ARC (@arc4g) June 11, 2021

 

Cloudy Night:

 

WARNING TO ALL ARTISTS
Got a DM from "John Billmate" claiming to be "Responsible for distribution of photo editor" from @SkylumSoftware

DO NOT OPEN ANY LINKS FROM THIS PERSON. This is a scam, and if you got this DM, or get a dm in the future, block it. #NFTCommunity #skylum pic.twitter.com/yQv68bRIjW

— Cloudy Night ☁️ (@CloudyNight_k) June 11, 2021

 

There are many, many more examples - however, we won't list them here. Of note is Ariel's tweet, where you can note the presence of a file named "Rizin_Fight_Federation_Presentation.scr". I'll circle back to that in the next section, Analysis.

Analysis

After scouring the internet for a while, I was unable to discover any of the files mentioned by the artists that reported the attack, that is until I stumbled upon Cloudy Night's tweet - their screenshot included a link to a website "skylumpro.com".

 

 

 

 

 

 

As expected, this is not the legitimate website, but rather a clever copycat of the real Skylum product website (to note, the real website is: https://skylum.com/luminar-ai-b). After clicking the "Download Now" button, a file named "SkylumLuminar (NFT Beta).rar" is downloaded, which you need to unzip with the password "NFT", as we can observe from Cloudy Night's tweet.

The unzipped content looks as follows:

 

 

 

 

 

 

 

One of the first things you may notice is the large filesize of the so called beta version. As you've seen from before in Ariel's tweet, the filesize was 745MB, while this file is a whopping 791MB!

But why is this file so large and why does it matter? 

• The attacker has appended their original file with a large chunk of overlay data; to put it simply - a bunch of extra data that does nothing.
• The attacker has increased the filesize this much to try and evade antivirus software and scanning tools; for example, a well-known service to scan suspicious files, VirusTotal, only accepts files up to 650MB, while some antivirus scanners may not even scan a file this large.
• While you could upload the original RAR file; the attacker has password-protected it and VirusTotal will be unable to scan it properly. You could re-package it, but the file itself may not be scanned.

Having said all that, after removing the excessive overlay, a much more reasonable filesize is obtained: 175KB. This new file's properties are:

• MD5: d93de731781723b3bb43fa806c5da7d1
• SHA-1: 1d49e7d163bce8cc6591ea33984796c531893b47
• SHA-256: b9923cdcd07e3e490a729560aa6f7c9b153ac0359cc7fa212c65b08531575a5a
• Creation Time: 2021-06-12 20:46:31
• VirusTotal results: https://www.virustotal.com/gui/file/b9923cdcd07e3e490a729560aa6f7c9b153ac0359cc7fa212c65b08531575a5a/detection
  

Of note is the creation or compilation time: this is the date and time the file has originally been created. While this can be spoofed, I do not believe it is the case here. This time matches with when the attack appeared. It is however highly likely more files, such as the one in Ariel's tweet, do the round.

This file will then execute a new file; which is the RedLine infostealer malware. This file has the following properties:

• MD5: b7df882c1b75c753186eec8fcb878932
• SHA-1: a04339be16a3b48d06017f44db7e86b3c8982110
• SHA-256: 2917305ac2959a98296578c46345691ccf638bdcc0559134432f5993da283faa
• Creation Time: 2042-10-31 08:29:02
• VirusTotal results: https://www.virustotal.com/gui/file/2917305ac2959a98296578c46345691ccf638bdcc0559134432f5993da283faa/detection
  

Note the creation time is different: set in 2042 - this is obviously faked by the attacker to reveal when exactly it has been created. However, with the above data, we can assume it was created in the last 5 days or so.

As mentioned before, once you execute the SkylumLuminarNFTBetaVersion.exe file, you will be infected with the RedLine infostealer malware. ProofPoint has reported on this malware first in March 2020: New Redline Password Stealer Malware. This malware has many capabilities, including, but not limited to:

• Steal username and password from browsers;
• Collect extensive system information;
• Execute commands, such as downloading and uploading other files, opening links and so on;
• Steal cryptowallet information - both from Chrome extensions as well as typical wallet.dat files. The extensions targeted are:
• YoroiWallet
• Tronlink
• NiftyWallet
• Metamask (refer also to Nicole's tweet)
• MathWallet
• Coinbase
• BinanceChain
• BraveWallet
• GuardaWallet
• EqualWallet
• JaxxxLiberty
• BitAppWallet
• Steal data from other software, such as:
• Steam;
• Telegram;
• FTP clients such as FileZilla.

The screenshot below displays part of RedLine's functionalities:

 

 

 

 

 

 

 

 

 

 

 

 

RedLine will first gather some basic information about your machine, such as the machine name, external IP address, your geography and so on. It gathers external information by querying one of the following IP lookup services:

• https://api.ipify.org
• https://icanhazip.com
• https://wtfismyip.com/text
• http://bot.whatismyipaddress.com/
• http://checkip.dyndns.org 

Note these services are not malicious, they are simply being used by the attacker to gather more information. Interestingly enough, RedLine will use SOAP HTTP (POST) requests to its command and control server (the server or machine controlled by the attacker where your data will end up) using the following IP: 

• 185.215.113.60;
• On port 59472;
• This IP resides in the Seychelles.
  

Another domain and IP observed is (from ARC's tweet above, the files in that archive were almost 600MB):

• xtfoarinat.xyz;
• On IP 92.38.163.189;
• This IP also has sinaryaror.xyz resolve to it, another RedLine command and control server.
  

One may also observe connections to tempuri.org. This is a default placeholder for web services, and is not atypical when using SOAP over HTTP. Tempuri is not malicious.

Finally, after receiving all this data, the attacker can start logging into your accounts, attempt to steal your tokens, impersonate you and so on. The attacker can also install other malware if they wish, such as ransomware.

What now? Detection

 

Good news:

The variant discussed in this blog does not appear to persist: in other words, after a reboot, its process will not be active anymore, at least for the variant discussed in this blog post.

Bad news:

Everything else - unfortunately, RedLine works pretty fast and a few minutes are enough to exfiltrate all your data and for the attacker to fully compromise all your accounts.

Luckily for us, RedLine stealer should be detected by most commercial and free antivirus software products on the market. A few recommendations to get rid of the RedLine variant discussed in this blog post - note this may not fully cover the variant you encountered: 

1. Contact your NFT provider, cryptowallet provider and so on as soon as possible via telephone call or another computer and inform them of what happened; ask for a temporary block of your account or to at least temporarily block any funds from now on.
   >>> It is very important you do this first! <<<
   
   
2. If you can, change your credentials from another machine; such as your phone, your partner's laptop, ... Note it's recommended to change your credentials at least for your email accounts and for your wallets - focus on the most important accounts first! If you do not have this possibility, continue with the steps below.
   
   
3. Open Task Manager, go to the Details tab and search for any process with the following names:
1.  SkylumLuminarNFTBetaVersion.exe;
    Flamingly.exe;
    FieldTemplateFactory.exe;
   PaintingPromoProject;
    Alternatively, the name of the file you executed. 
2. Now, kill the process by right-clicking on it  > select End Process (or End Task).
   
   
4. If you have a firewall or proxy, block the IPs 185.215.113.60 and 92.38.163.189.
   
   
5. Run a scan with your currently installed antivirus and a scan with an alternative product, for example, Malwarebytes (has a free version);
1. You can also use Eset's Online Scanner (free): https://www.eset.com/int/home/online-scanner/
   
   
6. Enable the Windows Firewall: https://support.microsoft.com/en-us/windows/turn-microsoft-defender-firewall-on-or-off-ec0844f7-aebd-0583-67fe-601ecf5d774f
1. While this might not have much impact at this point, it will give you an additional layer of protection from other threats;
    
   
7. Delete all the files you have previously downloaded if they still exist on your system; if you'd like me to analyse them, you may send me a copy first;
   
   
8. If the above scans have turned up:

• Clean: have you executed the file? 

1. If not, you are not infected. 
2. If you did, and the scanners turn up with nothing, it's possible your current antivirus product has blocked the attack. 
3. You might also want to Refresh your PC to have peace of mind.

• Not clean (there were detections): let the above product (e.g. Malwarebytes or Eset) clean them up and reboot your computer.
  
  

Finally, reset all (or the rest of) your credentials. Do this only when you know your machine is clean! Alternatively, reset your credentials from another machine as indicated earlier.

It's important to follow these steps as soon as possible to prevent any damages. 

Prevention

You've come this far, or perhaps you simply skipped to this part - arguably the most important one: to prevent this attack from happening in the first place. So how can this be achieved?

1. First and foremost: ensure you are using Windows 8.1 or later. Older Operating Systems, such as Windows 7, are no longer supported by Microsoft and have additional vulnerabilities attackers may exploit;
   
   
2. Install an antivirus and enable the Windows Firewall. It does not matter if the antivirus is free or not; paid versions do offer more features, but a free version will do just as much.
1. Starting from Windows 10, Windows Defender should protect adequately from attacks such as the one described in this blog post. Other free alternatives are Kaspersky's free cloud antivirus and Malwarebytes.
2. When you get any file, scan it with your antivirus first! (typically done by right-clicking on the file or folder) 
3. When in doubt, upload the file to VirusTotal. Note however the tactics used here: if there's a really large file, it may not be able to be scanned properly - this can be an indication of malicious intent!
   
   
3. Set UAC (User Account Control) to the maximum level: Always Notify - this will stop some additional attacks (you will get more prompts; if you do, take a pause and verify what's on the screen should indeed be executed). Here's how to do that: https://www.digitalcitizen.life/how-change-user-account-control-uac-levels/
   
   
4. Enable file extensions: some extensions, such as .scr, historically a screensaver file; are in fact executables - which could contain malicious code, as was the case in Ariel's tweet. Do not open or run these files. This will also protect you against the "double extensions" trick. A file named commission.jpg.exe will now be visible as such - if file extensions are disabled, you would see commission.jpg - see the difference? Here's how you can enable file extensions: https://www.howtogeek.com/205086/beginner-how-to-make-windows-show-file-extensions/
   
   
5. Create unique passwords where possible; if feasible; use a password manager;
   
   
6. Enable MFA (or 2FA if MFA is not available) on all your sensitive accounts; this will add an additional layer which is typically very hard for the attacker to guess or crack. Google "your service/ account + MFA" for specific instructions;
   
   
7. If you receive a new commission or request to create art, stop and think first - ask yourself these questions:
1. Is this coming from a reputable account or from a totally new account?
1. If reputable, can I verify their claim or request somehow?
2. If from a new account: be extra wary!
3. If from an account with very low followers/following: be extra wary!
   
2. How will they pay me? 
1. Are they using a verified cryptowallet, or trying to set me up for something shady?
2. Do they have any reviews on their (public) profile, if any?
3. What are they asking of me exactly?
1. Are they indeed sending just images, or is there an executable file or "special software" I am supposed to download/open?
   
4. Where are their links or attachments leading to?
1. Are these leading to another service, e.g. imgur.com, or something different altogether?
   
5. I have downloaded the file(s), but I do not trust the source;
1. Delete it or ask for more information;
2. Block the sender if you are suspect and report their account, delete any files;
3. You can double-check by scanning the files with your antivirus, or uploading it to VirusTotal. The same nuance as above applies however.
6. You can also Google any information they send through to further verify their claims.
   
   
8. Finally and where possible;
1. Use a hardware instead of software wallet;
2. Secure your seed phrase; store it offline, for example, on an external drive or use pen and paper;
3. Verify the security settings in your wallet or crypto provider: perform a check of which other security features you can enable, and enable them. 

 

Manifold, a company that creates blockchain products for NFT communities, has also written an excellent post-mortem of this attack which includes additional advice - I highly recommend you to read it: https://manifoldxyz.substack.com/p/the-fvckrender-hack-post-mortem

 

Several years ago, I created a "malware puzzle" - basically, a crossword puzzle but with terms related to malware. You can find that puzzle here: https://bartblaze.blogspot.com/2013/08/malware-puzzle.html

Seeing crosswords are a hobby of mine, I thought it'd be fun to create another one more than seven years later - this time, all things blue team! Obviously you don't need to be part of a blue team to fill in the puzzle, it's for anyone in information or cyber security - but it does help if you've been on the defense side of things.

You can print the puzzle and fill it in, or you can use Adobe Reader to complete the PDF version, or use any tool to your liking (mspaint is also a candidate). There are no spaces - all words are one word.

You can find the puzzle in the following formats:

PNG: https://www.mediafire.com/view/0iuzvxal8redjz2/crossword-iiRh073oLn.png/file

PNG mirror: https://imgur.com/a/ASATRXf

PDF: https://www.mediafire.com/file/b3v7pebohp6c8vn/crossword-xp6dZUU9Ar.pdf/file

PDF mirror: https://www.filedropper.com/crossword-xp6dzuu9ar

If you have the solution, feel free to create a comment or @ me on Twitter: https://twitter.com/bartblaze. 

To make things more interesting, you can set up a competition between your fellow defenders to see who can complete it first!

If you're stuck, I can always send you a hint - see my About page for contact information, use Twitter, or leave a comment. Note there may be spoilers around. 

The cybercrime group that brought us Satan, DBGer and Lucky ransomware and perhaps Iron ransomware, has now come up with a new version or rebranding named "5ss5c".

In a previous blog post, Satan ransomware adds EternalBlue exploit, I described how the group behind Satan ransomware has been actively developing its ransomware, adding new functionalities (specifically then: EternalBlue) and techniques with each run. Then, it appeared the group halted operations on at least the ransomware front for several months.

However, as it turns out, the group has been working on new ransomware - 5ss5c - since at least November 2019.

The following tweet got my attention:

🧐Unknown #Ransomware captured tonight from #China, Encrypt only compressed files.
Email：5ss5c@mail.ru
ext：.5ss5c
IP：61.186.243.2 58.221.158.90@demonslay335 @Amigo_A_ @GrujaRS @BleepinComputer @Rmy_Reserve @VK_Intel pic.twitter.com/dTdgnMfoLX

— onion (@jishuzhain) January 12, 2020

After some quick checks, it appears this is a downloader for the 5ss5c ransomware, which is extremely reminiscent of how Satan ransomware operated:

Figure 1 - 5ss5c downloader

The malware will leverage certutil and even contains logging:

Figure 2 - certutil logging

It will download and leverage:

• Spreader (EternalBlue and hardcoded credentials);
• Mimikatz and what appears another password dumper/stealer;
• The actual ransomware.

Figure 3 - Hardcoded creds

For example, the following folders belonging to Qihoo 360 (an internet security company based in China also offering antivirus) were already excluded in Satan and DBGer ransomware:

• 360rec
• 360sec
• 360sand

While these are new in 5ss5c ransomware:

• 360downloads
• 360safe

As in previous iterations, 5ss5c ransomware will stop database-related services and processes.

It will however only encrypt files with the following extensions:

7z, bak, cer, csv, db, dbf, dmp, docx, eps, ldf, mdb, mdf, myd, myi, ora, pdf, pem, pfx, ppt, pptx, psd, rar, rtf, sql, tar, txt, vdi, vmdk, vmx, xls, xlsx, zip

This extension list is not like before, and includes mostly documents, archives, database files and VMware-related extensions such as vmdk.

The ransomware will then create the following URI structure to communicate with the C2 server (61.186.243[.]2):

• /api/data.php?code=
• &file=
• &size=
• &status=
• &keyhash=

Figure 5 - ransom note

部分文件已经被加密
如果你想找回加密文件,发送 (1) 个比特币到我的钱包
从加密开始48小时之内没有完成支付,解密的金额会发生翻倍.
如果有其他问题,可以通过邮件联系我

您的解密凭证是 :
Email:[5ss5c@mail.ru]