$~: WHOAMI

Hi there 👋 Welcome to my blog bushidotoken.net

Popular posts from this blog

Deep-dive: The DarkHotel APT

Image
PART 1: DARKHOTEL DarkHotel is a sophisticated and active advanced persistent threat (APT) group. It’s highly capable and is known for finding and taking advantage of previously unknown vulnerabilities in common software also known as a 0day. It is a well-established group that has been active since 2007, are known Korean-speakers, and are working on behalf of a nation state.  DarkHotel was first disclosed in 2014 and is also known as DUBNIUM, Black Shop, Fallout Team, Karba, Luder, Nemim, Nemain, Tapaoux, Pioneer, Shadow Crane, APT-C-06, and TUNGSTEN BRIDGE. From the NSA’s sigs.py script (also known as Territorial Dispute or TeDi) DarkHotel is signature number 25 (SIG25). Malware associated with DarkHotel includes Asruex, Parastic Beast, Inexsmar, Retro backdoor, Gh0st RAT, and the new Ramsay toolkit. Vulnerabilities leveraged in its 0day exploits include CVE-2018-8174, CVE-2018-8373, CVE-2019-1458, CVE-2019-13720, CVE-2019-17026, and CVE-2020-0674. DarkHotel also often exploits CVE-
Read more

Gathering Intelligence on the Qakbot banking Trojan

Image
Background:  The Qakbot banking Trojan is one of the top-tier malware families on the current threat landscape. It is distributed in mass spam campaigns, steals confidential information, and has also provided access to ransomware operators. Preventing and detecting this threat has become a priority for many organisations as a successful infection can lead to a costly cyber incident. In this blog, I aim to share more information on this malware, provided by open sources, and highlight the intelligence gathering process it takes to combat this threat. Qakbot (also known as Quakbot or Qbot) has been around since 2008. It has targeted the customers of various financial institutions worldwide. While Qbot's targeting has mostly remained the same - with the aim of stealing bank details and enabling wire fraud - its propagation methods have changed across various campaigns. Despite its age, Qakbot still remains a significant threat with established connections in the organised cybercrime u
Read more

My first year in Cyber Threat Intelligence

Image
As of 1 August, I have been working in the cyber threat intelligence industry for one whole year. It has been a steep, but rewarding, learning curve that gives as much back as you put into it. In 2016, I started university doing a cybersecurity-specific course as I knew it was what I wanted to do since I was about 15 years old. I graduated in 2019 with a 2:1 in BSc (Hons) Computer and Information Security. Within three weeks of finishing my course I was offered a job in July and started in August. It could not have been better.  It was only until the end of my course that I began to learn about threat intelligence and emerging threats in an interesting module that educated us about 0day vulnerabilities and the darknet. Initially, I wanted to be a penetration tester (like most students on my course), but I was only just about able to make it through the labs on Kali and Metasploit through hard work and frustration. This put me off and made me look elsewhere into other areas of security
Read more