tag: Malvertising · 4 items
- Engineer — Skip
- SOC/IR — Learn: StreamRat demonstrates a malvertising delivery chain for Android banking trojans capable of near-complete device takeover; worth noting the ad-platform distribution vector for mobile threat modeling, though no IOCs or ATT&CK mappings are available to act on today.
- Leader — Skip
- Engineer — Learn: No patch or configuration action required; this is a delivery-side evasion technique exploiting the browser as an assembler using Bun runtime, relevant for understanding how malware bypasses file-hash detections on endpoints you defend.
- SOC/IR — Plan: Build or tune detections for Bun runtime executing assembled payloads and browser-initiated process chains; hunt for SourTrade IOCs published by Confiant since late 2024, focusing on impersonation of TradingView, Solana, and Luno lures in web traffic and endpoint telemetry.
- Leader — Skip
- Engineer — Learn: This technique—assembling malware entirely within browser memory via JavaScript—bypasses file-based detection and signals a shift in delivery model worth factoring into client-side defense strategies (CSP hardening, browser isolation). No specific software to patch; no KEV or PoC signals.
- SOC/IR — Plan: The campaign is described as large-scale and targets users of crypto/trading sites; build or tune EDR behavioral rules for in-browser memory injection and anomalous JS execution patterns this quarter. The summary provides no specific IOCs to hunt on immediately.
- Leader — Skip
- Engineer — Learn: No direct infrastructure vulnerability here; the attack targets end users via social engineering. Worth noting that AI-tool-themed lures are an emerging pattern that should inform employee software-download guidance.
- SOC/IR — Act: Active SectopRAT delivery campaign in progress — query EDR telemetry for downloads of unofficial Claude installers and sweep endpoints for SectopRAT indicators; the BleepingComputer writeup likely contains file hashes and C2 indicators to feed into your SIEM.
- Leader — Learn: AI-tool-themed malvertising is a growing employee-targeting vector; useful context for justifying security-awareness investment, but no immediate leadership action required absent evidence of internal compromise.