@BushidoToken Threat Intel

  Images made with Bing Create AI Prologue I find uncovering new campaigns and sharing research on novel threats is one the most enjoyable parts of my job as a CTI researcher. Especially the types of threats not many other researchers really spend much time investigating, or at least those who do rarely disclose their findings publicly. My investigation on the RedZei group is also an example of this. Background I have recently been investigating a financially motivated threat actor I've dubbed "GreenMwizi" that I believe to be from Kenya. They have setup a dozen fake Booking.com Twitter accounts and are currently targeting users who make public complaints. The main aim of these scammers is to socially engineer users over the phone into sending them funds via  Remitly, an  international money transfer service.  By interacting with the scammers myself I was able to find out their phone number and trace their IP address and device information. This type of activity is ...

  Cryptocurrency is experiencing a huge boom. With this explosion in popularity, and people getting rich quick, come the cybercriminals looking to exploit this new technology. Unfortunately, while there may be a large amount of money to be made from cryptocurrecny there are very little controls or regulations preventing scams. Unlike other centralised financial services, such as banks, cryptocurrency users are only as protected as their own personal operational security (OPSEC). While there are long guides on OPSEC for cryptocurrency users, many new users are lacking here and do not use a strong password or two-factor authentication (2FA). This makes them sitting ducks for cybercriminals. This blog will detail how users of a relatively new platform, PancakeSwap, are being highly targeted.  In their own words "PancakeSwap is the leading decentralized exchange on Binance Smart Chain, with the highest trading volumes in the market". Despite its comical name, PancakeSwap is ...

  A “dead drop” is a well-known espionage tactic of passing items or information between two parties using secret locations. The two parties never meet and any sign of communication is concealed. This tactic is commonly used by intelligence officers to interact with their assets in the field to avoid any suspicious meetings or either caught talking to each other. For decades, intelligence agencies have used dead drops. Two infamous double agents from the CIA and FBI - Aldrich Ames and Robert Hanssen respectively - both used dead drops to supply information to their handlers from the Soviet Union. Cyber adversaries have also come to adapt this technique into their espionage campaigns. However, instead of a human source, state-backed computer network operations (CNOs) have leveraged legitimate services for covert communications or so-called “dead drop resolvers”.  In October 2019, ESET Research disclosed a report on Operation Ghost Dukes which detailed the activities of an APT...

  Discord is one of the best platforms that has helped me get through 2020 after joining various online communities such as The Many Hats Club or participating in virtual conferences such as conINT .  As a cyber threat intelligence (CTI) analyst myself, I am often looking for new ways to consume news and find new threats, which I believe Discord (if configured correctly) can offer.  Although I do work for a Threat Intelligence Provider (TIP) with the ability to generate powerful dashboards that can scrape and feed me any source on the internet, not everyone else does. I like having a backup and having custom notifications that Discord can provide.  The Discord bot ecosystem is a great place due to developers generously offering their services for the community for free. There are premium services that can remove the rate limits and other caps but that's not really necessary if you use multiple bots like in this write up and for this specific use case. Here is how I ...