@BushidoToken Threat Intel

  Discord is one of the best platforms that has helped me get through 2020 after joining various online communities such as The Many Hats Club or participating in virtual conferences such as conINT .  As a cyber threat intelligence (CTI) analyst myself, I am often looking for new ways to consume news and find new threats, which I believe Discord (if configured correctly) can offer.  Although I do work for a Threat Intelligence Provider (TIP) with the ability to generate powerful dashboards that can scrape and feed me any source on the internet, not everyone else does. I like having a backup and having custom notifications that Discord can provide.  The Discord bot ecosystem is a great place due to developers generously offering their services for the community for free. There are premium services that can remove the rate limits and other caps but that's not really necessary if you use multiple bots like in this write up and for this specific use case. Here is how I ...

  Executive summary: Threat actors continue to leverage the NetWire Remote Access Trojan (RAT) in malicious spam email attacks using low-detection scripts, URL shorteners, and the Discord content delivery network (CDN).  The Infection chain begins with a targeted email from the t-online[.]de mail service. These contain an XLS file or ZIP archive that, if opened, triggers embedded VBScript and PowerShell scripts. The secondary stage leverages  URL shorteners in the PowerShell script that pull down a batch file from the attacker’s server or from the Discord CDN. If successfully executed the victim’s device is infected with NetWire RAT and a connection is made to the command and control (C&C) server. Post-exploitative activities can then be initiated from here. NetWire RAT is a widely used off-the-shelf malware used by cybercriminals groups and Business Email Compromise (BEC) scammers. This includes features such as stealing credentials, recording audio, screen capture,...

“ The cloud is not a physical entity, but instead is a vast network of remote servers around the globe which are linked together and meant to operate as a single ecosystem. These servers are designed to either store and manage data, run applications or deliver content or a service such as streaming videos, web email, office productivity software or social media. ” - Microsoft Azure Cloud services are increasingly being leveraged by cybercriminals and advanced persistent threat groups in attack campaigns. These cloud services include consumer accounts for OneDrive, Google Drive, DropBox, compromised SharePoint and GSuite accounts, as well as the Discord CDN. These are leveraged to host malicious files, phishing pages, redirector links, and other parts of attack campaigns. These services are often used for business operations and are regarded as safe by default by most detection systems. Any threat actor can leverage these services for free or could compromise user accounts. The most com...