TOTPGuard

As observed in this and other incidents, phishing is not limited to email. Threat actors increasingly use social media platforms such as LinkedIn, as well as job portals, to approach selected targets and establish trust before delivering malware.

Threat actors increasingly use social media platforms such as LinkedIn, as well as job portals, to approach selected targets and establish trust before delivering malware.

Detects scheduled task used for persistence by Nimbus Manticore (UNC1549). The task is used to persistenly load a custom implant that features data exfiltration and remote control capabilities.

Detection should therefore focus not only on static indicators, but also on behavioral patterns such as suspicious sideloading chains, unusual .NET configuration abuse, newly registered domains, and cloud-hosted C2 infrastructure.

Detects link files, archives and binaries that contain keywords related to AppDomain hijacking/injection a technique used by malware to sideload payloads.

Detects scheduled task used for persistence by Nimbus Manticore (UNC1549). The task is used to persistenly load a custom implant that features data exfiltration and remote control capabilities.

Detects scheduled task used for persistence by Nimbus Manticore (UNC1549). The task is used to persistenly load a custom implant that features data exfiltration and remote control capabilities.

The operators increased the level of obfuscation, making static analysis more difficult and time-consuming.

The archive drops a payload set in which a malicious .NET implant masquerades inside the legitimate EbixExam.Desktop WPF application, executing through its updater service.

The fake but functional 2FA application added another layer to the pretext and helped keep the workflow believable after execution... Detection should therefore focus... on abuse of trusted host binaries.

Detection should therefore focus not only on static indicators, but also on behavioral patterns such as suspicious sideloading chains, unusual .NET configuration abuse, newly registered domains, and cloud-hosted C2 infrastructure.

Detects link files, archives and binaries that contain keywords related to AppDomain hijacking/injection a technique used by malware to sideload payloads.

Command-and-control runs over an Azure-typosquat domain, business-joiners-exam.azurewebsiets.net, reached by the abused updater component.

Employees should be trained to recognize suspicious recruiter outreach, externally hosted hiring portals, unusual authentication prompts, and requests to download tools as part of an application process.

SHA-256 of main.dll, the native implant used for persistence, C2 communication, and data exfiltration.