Toots for abuse_ch@ioc.exchange account

Written by abuse.ch :verified: on 2025-02-04 at 12:54

📢 UPDATE | We've had to make the difficult decision to reschedule tomorrow's YouTube Live with Roman and Carel Bitter, CEO at Spamhaus Technology, as one of our presenters is still unwell. 🤧

We're sorry for any inconvenience caused, as we know how tricky it can be to juggle a busy schedule!

🎉 The good news is that you won't have to wait too long - new date/time below:👇👇

📅 February 12th

⏰ 10 AM EST | 3 PM GMT | 4 PM CET

Here's a reminder of the link to join ⤵️

https://www.youtube.com/live/dRmqWob3WSk

Hit "notify me" on YouTube to ensure you don't miss it. 🙌

[#]NewDate #abusech #Spamhaus #StrengthInUnity #SharingIsCaring

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2025-02-03 at 16:41

Apparently, this #Mirai threat actor was feeling creative when registering the #botnet C2 domain names! 🤦

Mirai sample:

👉 https://bazaar.abuse.ch/sample/2e82e8d271a19c6c2429c420b6a8d5d5c25bebf27e29d82c94ef0e85c9e904fe/

Botnet C2 domains:

📡 https://threatfox.abuse.ch/browse/malware/elf.mirai/

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2025-02-03 at 07:05

[#]opendir with lots of PowerShell fun (spreading #FormBook it seems) ⤵️

https://urlhaus.abuse.ch/host/87.120.120.56/

=> View attached media | View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2025-02-01 at 14:23

Canada Revenue Agency (CRA) 🇨🇦 themed #ClickFix campaign, using a fake captcha to spread #malware ⤵️

FakeCaptcha:

🖱️ https://urlhaus.abuse.ch/url/3423002/

HTA download URL:

🌐 https://urlhaus.abuse.ch/url/3418524/

Dropped HTA:

📄 https://bazaar.abuse.ch/sample/06e2adebb2b96be6cf7c2482c9948d9d21dcd1e16618800c71231951bed7b4d0/

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2025-01-29 at 14:00

Next month, our platforms are evolving! 🎉

Authenticated users can expect more threat-hunting features 🔍 with access to NEW capabilities, including false-positive lists, URLhaus hunting functionality, and more!

⏰ Reminder: API query limits for unauthenticated users start in February- to avoid disruptions, authenticate now.

You can find all the details here ➡️ https://abuse.ch/blog/community-first/

[#]PlatformUpdates #February2025 #AuthenticateNow

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2025-01-24 at 14:55

🎉 Our YouTube Live with Spamhaus has a new date! 👇👇

📅 February 5th

⏰ 10 AM EST | 3 PM GMT | 4 PM CET

Roman and Carel will be back, fully recharged, and ready to answer your questions! 💪

Here's a reminder of the link to join ⤵️

https://www.youtube.com/live/dRmqWob3WSk

Hit "notify me" on YouTube to make sure you don't miss it 🙌

[#]SeeYouThere #abusech #Spamhaus #StrengthInUnity

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2025-01-22 at 15:32

📢 UPDATE | We're postponing tomorrow's YouTube Live. The lurgy has hit one of our presenters, and they’re currently resting (drowning!) under a mountain of tissues. 🤧

...and let’s face it: a snotty presenter is not a camera-friendly presenter!

We'll share a new date and time soon, so keep an eye out - thanks for your patience and understanding! 🙏

[#]GetWellSoon #StrengthInUnity

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2025-01-16 at 15:40

🎥 Join us Jan 23rd at 10am EST | 3pm GMT | 4pm CET on YouTube LIVE!

Roman Hüssy, will be joined by Carel Bitter, CEO at Spamhaus, to answer your questions. Want to know more about our alliance, history, or what the future holds? 🤔 Bring your questions and we’ll do our best to answer them!

Here’s the link to join (click “notify me” to mark it in your calendar 🗓️):

➡️ https://youtube.com/live/dRmqWob3WSk?feature=share

PS. We’ve never done a live before so it should be fun!! 🤩

[#]Spamhaus #abusech #StrengthInUnity #YouTubeLive

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2025-01-14 at 12:26

abuse.ch and Spamhaus share a significant history together 🤲. Today, we are really excited to share this video where we talk about our alliance 🤝

We share the importance of putting community at the heart of everything we do, and the impact we’re making 💥 Take a look and see why this collaboration is so important for our community.

🎥 Watch now here: https://youtu.be/20qfQWgOQXQ

[#]SharingIsCaring #Spamhaus #abusech #StrengthInUnity

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2025-01-09 at 14:14

🎉 Only a few weeks left until our new features and authentication launch! Here’s a reminder of what to expect. ✨

NEW capabilities, including:

✅ False-positive lists to refine your searches

✅ URLhaus hunting tools for deeper insights

✅ And so much more!

And don’t forget: API query limits for unauthenticated users start soon. If access to this data is important to you, please start to plan for authentication now.

👉 Discover all the benefits of authenticating here ⤵️

https://abuse.ch/blog/community-first/

[#]PlatformUpdates #February2025 #AuthenticateNow

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2024-12-31 at 11:02

The year is about to end 🎆 So let's have a look which networks are hosting most active malware distribution sites 👀

Actually, it doesn't surprise that the networks leading the ranking, proton66 and ELITETEAM, are bulletproof hosters who refuse to react on abuse reports sent by URLhaus ✉️ Both get upstream connectivity from Russian network operators 🇷🇺

If you want to do yourself something good, drop 🛑connections from/to these network at your perimeter!

👉 https://www.spamhaus.org/blocklists/do-not-route-or-peer/

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2024-12-30 at 11:23

MalwareBazaar will now parse shell scripts automatically and will try to identify any payload URLs present in it 📄🔍👁️ This will make your life easier when hunting for Linux/Unix malware such as #Mirai and #Gafgyt 💪

Here's an example:

👉 https://bazaar.abuse.ch/sample/ec46f105b049d6674acbf45639883623f2f1cb3eed50eedb4b0e25a27a7b67e2/

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2024-12-24 at 11:35

You can now manage your YARA rules for live hunting on #YARAify using the API 🥳👏

Deploy a YARA rule through the API:

https://yaraify.abuse.ch/api/#deploy-yara

Sample script:

https://github.com/abusech/YARAify/blob/main/upload_yara_rule.py

Happy hunting! 🎯

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2024-12-16 at 16:39

Can someone label this #Ransomware family? Spread through malspam with a VBS attachment 🔍👀

Ransom note: Decryptfiles.txt 🔐

Email: edfr789@tutanota.com / edfr789@tutamail.com 📧

VBS:

📄 https://bazaar.abuse.ch/sample/f7cbe1d0926c6e0895951882ff430d624630cd14b4d3b1a4c837a3feac71dd48/

Payload (exe):

⚙️ https://bazaar.abuse.ch/sample/d2100ffe58eb50c05d97a3da738ccd1f0be9672c057c26a10140af80595b78c3/

Payload (dll):

🖱️ https://bazaar.abuse.ch/sample/4b4a87552c44158fb53a72c7294319b0ddde9f99f460425ad5997d3b9121cd1e/

Decoy PDF ⤵️⤵️⤵️⤵️

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2024-12-13 at 10:11

ZLoader threat actor 🇷🇺 👀

IP address: 45.138.74.40 (Aeza International LTD 🇬🇧 )

User Agent: PresidentPutin

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2024-12-12 at 13:00

📅 Reminder: Updates are coming to all our platforms in Feb 2025! 🎉 🎉

Here’s a quick recap: 👇

➡️ Authenticated users will gain access to NEW features, including false-positive lists, URLhaus hunting functionality, and more!

➡️ API query limits are coming for unauthenticated users to improve platform stability for all users.

Why wait? In addition to uploading contributions, API users should also authenticate now to retrieve data across all platforms.

Learn more about these updates and authentication benefits here ⤵️

https://abuse.ch/blog/community-first/

=> View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2024-12-05 at 10:41

On the 1st of December, the notorious Socks5Systemz payload server hosted at AS57678 (Cat Technologies 🇭🇰) that is already active for several months started to serve a new version of Socks5Systemz ⤵️

🌐 https://urlhaus.abuse.ch/url/3189430/

This is the first major change since 2023 in Socks5Systemz and includes:

🔑 New RC4 key used during C2 communication: hi_few5i6ab&7#d3

👋 Direct IP communication through HTTP(s) for botnet command and control instead of the usage of a DGA and a custom DNS server

🔙 Backconnect TCP port changed from 2023 to 2024

Current botnet C2 servers:

188.119.66.185:443 CHANGWAY 🇭🇰

45.155.249.212:443 RACKPLACE 🇩🇪

91.211.249.30:443 PODAON 🇱🇻

Malware sample:📄 https://bazaar.abuse.ch/sample/528334ed9e4567a89f3cf4e4700946056499624dcfdd3b32a7800abc08eff9fe/

Socks5Systemz IOCs:🦊 

https://threatfox.abuse.ch/browse/malware/win.socks5_systemz/

=> View attached media | View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2024-12-04 at 10:01

We've observed a #BumbleBee malspam campaign using Cisco AnyConnect as a lure 🪝👀

The malspam contains a PDF with a link to a fake AnyConnect installer. Once downloaded and executed, the payload will open Cisco AnyConnect on the Microsoft App Store to mask the BumbleBee infection🔥

The BumbleBee payload comes with a DGA of 300 .live domains. Active #botnet C2s ⤵️

45urhm0ldgxb .live (149.154.153.2 - EDIS-AS-EU, 🇦🇹)

gx6xly9rp6vl .live (45.155.37.158 - SHOCK-1, 🇺🇸)

bw59chpi635u .live (79.132.130.23 - SERVINGA, 🇩🇪)

peck4grakjq3 .live (45.83.20.213 - STARK-INDUSTRIES, 🇬🇧)

7mhh5gky493r .live (46.249.38.179 - SERVERIUS-AS, 🇳🇱)

Payload delivery URLs:

🌐 https://urlhaus.abuse.ch/host/95.164.90.189/

BumbleBee payload:

📄 https://bazaar.abuse.ch/sample/b8794c9251e2c6fbb96c458a5e1821ddd029335933dfbb03efa7db63673562e8/

=> View attached media | View attached media

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2024-12-03 at 12:50

More new stuff for our valued community! 🎉 👇

A dedicated Slack channel, exclusively for our top contributors 🤩 This will be a space to connect, collaborate, and share CTI.

Hang tight, invites are coming! 💌

[#]TopContributors #CTI #SharingIsCaring

=> More informations about this toot | View the thread

Written by abuse.ch :verified: on 2024-11-22 at 13:22

We’re seeing an increase in activity from Coper (Octo2) 📈 Recent investigations into malware samples have identified approximately 30 distinct threat actors using the malware to target and infect Android devices 🪲 🔍

In the past few days, 10,000 IPs have connected to our sinkhole 🗣️

The majority of these IPs are located in Türkiye 🇹🇷, followed by Spain 🇪🇸

Coper IOCs are available on ThreatFox 🦊

👉 https://threatfox.abuse.ch/browse.php?search=malware%3Aapk.coper

=> View attached media

=> More informations about this toot | View the thread

=> This profile with reblog | Go to abuse_ch@ioc.exchange account