@BushidoToken Threat Intel

Aviation is an interest of mine as some of my family worked on airlines and I enjoy volunteering my time to work with organisations such as the Aviation ISAC with vulnerability disclosure, threat intelligence, and security research. So when a nother interesting OSINT challenge with aviation-related attributes cropped up on my radar this week, shared by @fs0131y , I was keen to get stuck into it. Let's begin. Immediate analysis of this image can give us several clues and help us along. From the initial tweet, there are multiple attributes that will help with the rest of the challenge, this includes the time of day and the date, as well as what the aircraft's engine looks like. Using these attributes we can pivot to the next stage of our investigation. Some Googling of engines, as well as Boeing and Air Bus planes, using the grey circle around the front of the engine and the logo on the site, I found a similar looking plane belonging to Air France - an A318 to be precise. Some ...

  Executive summary: Threat actors continue to leverage the NetWire Remote Access Trojan (RAT) in malicious spam email attacks using low-detection scripts, URL shorteners, and the Discord content delivery network (CDN).  The Infection chain begins with a targeted email from the t-online[.]de mail service. These contain an XLS file or ZIP archive that, if opened, triggers embedded VBScript and PowerShell scripts. The secondary stage leverages  URL shorteners in the PowerShell script that pull down a batch file from the attacker’s server or from the Discord CDN. If successfully executed the victim’s device is infected with NetWire RAT and a connection is made to the command and control (C&C) server. Post-exploitative activities can then be initiated from here. NetWire RAT is a widely used off-the-shelf malware used by cybercriminals groups and Business Email Compromise (BEC) scammers. This includes features such as stealing credentials, recording audio, screen capture,...