tag: Malware-Delivery · 5 items
- Engineer — Learn: ROMULUS abuses ClickFix lures on fake landing pages to trick users into self-executing malicious commands — worth reviewing whether your security awareness training covers this social-engineering pattern and whether endpoint controls block clipboard-paste command execution.
- SOC/IR — Plan: Research the ROMULUS/ClickFix TTP and build or tune detections for suspicious clipboard-executed commands (e.g., PowerShell/cmd spawned from browser processes) and LegionLoader indicators when Forescout publishes IOCs.
- Leader — Skip
- Engineer — Learn: Highlights that DWG files can carry embedded VBA projects, a non-obvious attack surface if AutoCAD or DWG-processing pipelines are in scope; no exploitation signal or patch action required today.
- SOC/IR — Learn: Awareness that DWG files can conceal executable macro content is useful for tuning file-type inspection rules, but no IOCs or active campaign are described here.
- Leader — Skip
- Engineer — Learn: The campaign highlights how SEO poisoning and gaming-themed lures bypass conventional download controls; no specific vulnerable software to patch, but useful context for reviewing employee software sourcing policies and endpoint allowlisting.
- SOC/IR — Learn: No enrichment signals or IOCs surfaced in the summary; the campaign technique (commodity infra plus multi-payload staging) improves triage intuition but lacks enough detail here to write detections or run a hunt without reading the full report.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: The DFIR Report writeup on BengalSEO provides actor profiling and delivery-chain context (Bing SEO poisoning → MayaBot) useful for triage, but no IOCs or ATT&CK-mapped TTPs are surfaced in available signals to act on today.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: PhantomEnigma’s use of hijacked government websites as delivery infrastructure is a notable TTP worth tracking, but the summary surfaces no IOCs, Sigma rules, or ATT&CK mappings to act on yet — monitor ANY.RUN’s full report for detection artifacts.
- Leader — Skip