BlogTrace : Curated intelligence from security blog posts.

Threat Actor Groups, Including Black Basta, are Exploiting Recent ScreenConnect Vulnerabilities

Blog Source: Trendmicro

IOC Available: no

YARA Rules: no

Timestamp: 2024.02.27
YARA Rules for the detection ScreenConnect exploit

Blog Source: github

IOC Available: no

YARA Rules: yes

Timestamp: 2024.02.23
Technical Advisory: Critical ConnectWise ScreenConnect Authentication Bypass

Blog Source: Bitdefender

IOC Available: yes

YARA Rules: no

Timestamp: 2024.02.22
Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors

Blog Source: Mandiant

IOC Available: yes

YARA Rules: yes

Timestamp: 2024.02.14
New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization

Blog Source: Talosintelligence

IOC Available: yes

YARA Rules: no

Timestamp: 2024.02.08
Exploring the Latest Mispadu Stealer Variant

Blog Source: Unit42

IOC Available: yes

YARA Rules: yes

Timestamp: 2024.02.02
Ransomware Deployment Attempts Via TeamViewer

Blog Source: Huntress

IOC Available: yes

YARA Rules: no

Timestamp: 2024.01.17
CVE-2023-36025 Exploited for Defense Evasion in Phemedrone Stealer Campaign

Blog Source: Trendmicro

IOC Available: yes

YARA Rules: no

Timestamp: 2024.01.12
Black Basta-Affiliated Water Curupira’s Pikabot Spam Campaign

Blog Source: Trendmicro

IOC Available: yes

YARA Rules: no

Timestamp: 2024.01.09
Akira, again: The ransomware that keeps on taking

Blog Source: Sophos

IOC Available: yes

YARA Rules: no

Timestamp: 2023.12.21