Profile picture
Nick Carr @ItsReallyNick
, 8 tweets, 11 min read Read on Twitter
In light of the #FIN7 "Combi Security" DOJ indictment, we've released our massive technical post and indicator release: fireeye.com/blog/threat-re…

We reveal new information from @Mandiant IRs about the extent of FIN7's crimes, their innovative techniques, & how to find them today.
#FIN7 targeted other financial data when they encountered encryption in POS networks. New information today - and certainly helped stack up the charges against Combi Security.

Also @BarryV @stvemillertime first shared SEC filing targeting in March 2017: fireeye.com/blog/threat-re…
Crime doesn't pay. Unless you worked for Combi Security, in which case it paid a pretty decent wage for Russian/Ukrainian "pen testers" 😄

Sidenote: @FireEye's red team is hiring but their operations *are* authorized and the only payment card hijinks is over who expenses dinner.
Does the #FIN7 news mean the #BATELEUR document graphic designer is looking for work?

I've been a fan of their graphics and they are obviously a fan of @FireEye since most of their phishing docs also included our Managed Defense landing page language.
#FINdigestion is the best #DFIR hashtag of all times and that's why it's in our blog: fireeye.com/blog/threat-re…

Shout out @RealParisi & long-time #FIN7 tummy trouble trackers:

@stvemillertime's hunting tips today are way better than
Early #FF for awesome #FIN7 people!

Blog co-authors: @BarryV @tiskimber @stvemillertime - fireeye.com/blog/threat-re…

FireEye: @mykill @jtbennettjr @SElovitz @cglyer @DavidPany @danielhbohannon @DJPalombo @MrDanPerez @bwithnell

Industry: @darienhuss @mesa_matt @sixdub @RealParisi
This indictment is without question the most significant financial takedown since Monday when infosec twitter teased me for only offering up $10 for interesting tradecraft. 😄
@subTee @SwiftOnSecurity @NotMedic
Nice chatting with @brbarrett from @WIRED:
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Nick Carr
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Related hashtags

#FIN7 #BATELEUR #FINdigestion #DFIR #FF

More from @ItsReallyNick see all

Profile picture
What they thought *might* be a boring IR based on initial leads, quickly became interesting when the attacker snapped up the endpoint tooling they just deployed.

Peep that renamed rar.exe snapping up our files for nation state attackers (PLATINUM) to analyze 😅

#FireEyeSummit
It takes hard #DFIR work to get this point but there is nothing quite like uncovering novel/rare persistence and playing around with new attacker tools to understand them. A bit jealous of Adrien and Matias finding Platinum's #REDSALT.
Platinum undetected for 9 years at victim.
These guys found multiple APT groups on network.

The talk then gets into additional advanced backdoors with crazier capabilities that were first.

There's so much here. I'm hearing we *might* upload #FireEyeSummit videos to YouTube 🤞
Read 4 tweets
Profile picture
Fresh APT loader technique for today's #DailyScriptlet:

cs=Array(#,#,#,#,...): cmd="": For each c in cs: cmd=cmd&Chr(c): Next: cmd=cmd&vbcrlf: Execute(cmd)

This is remotely loaded into memory from source phishing doc that uses renamed wscript & pubprn.vbs to load COM Scriptlet.
@bwithnell and I shared an earlier version of this #APT32 phish technique:
Relevant slide screenshots attached.

They are continually improving each phase of their dynamic, multi-stage infection chain.
@bwithnell SPOILER: the VBScript *still* doesn't properly convert temperatures as promised, but it *will* load good tidings of great Cobalt Strike 🎅🏽
Read 6 tweets

Related threads

Profile picture
Long rumored @TheJusticeDept indictment of #APT10 is out. sc.cnbcfm.com/applications/c…
Here are my observations/highlights from reading the indictment (channeling my inner @pwnallthethings):
-the indictment indicates #APT10 operations started in 2006 and went through 2018. The 2006 activity was likely focused on US Government, Military, and defense contractors

1/n
Interestingly the indictment calls out multiple government organizations by name that were victims including:
@NASAGoddard, @NASAJPL, @LLNL, and the @USNavy

2/n
Read 24 tweets
Profile picture
There are more of these thread.

Suspected Iranian Influence Operation Leverages Network of Inauthentic
News Sites & Social Media Targeting Audiences in U.S., UK, Latin
America, Middle East
fireeye.com/blog/threat-re…
we got 9 urls from FireEye's report.
and I had flagged another 13 back in march.

Mostly due to these reddit users:
/u/Mike_Rubin
/u/AllenDono
/u/finalin
/u/KevanKing
/u/Pazaj
/u/erickiskandar
Most of these sites share OR shared a common host at some point in time.
AS24940 hetzner[.]com
Read 61 tweets
Profile picture
1. A couple things that stick out about @FireEye's announcement regarding the discovery of an Iranian “influence operation” across websites, Facebook, and Twitter. This doesn't look like an Internet Research Agency type operation.
fireeye.com/blog/threat-re…
2. Let’s start with one of the primary websites identified as part of the network. Instituto Manquehue. You can check it out here: institutomanquehue.org
3. It is a weird site that is clearly trying to look legitimate. But it doesn’t seem inherently “fake.” The institute appears to have been around since 2014 offering a leftist vision for Latin American journalism free from the “foreign influences of West and East.”
Read 30 tweets
Profile picture
گراف وابستگی سایت‌ها و اکانت‌های فیسبوک و اینستاگرامِ مرتبط با ایران که با پنهان کردن ربطشون به ایران، اخبار خاورمیانه، بریتانیا و آمریکا رو پوشش می‌دادند و در پی تاثیرگذاری اجتماعی بودند. یکی از بخش‌های این سایت‌ها و اکانت‌ها، حدود ۶ هزار دلار هم خرج تبلیغ در فیسبوک کردند.
۱
مجموعه FireEye این گزارش خلاصه رو منتشر کرده و به زودی گزارش کامل رو منتشر می‌کنه.
پیش از انتشار، به فیسبوک اطلاع داده و فیسبوک هم اکانت‌ها رو شناسایی کرده و حذف کرده.
۲
fireeye.com/blog/threat-re…
توییت امیر و لینکی که منتشر کرده، جزییات بیشتری از اقدامات فیسبوک رو مشخص کرده.
۳
Read 18 tweets
Profile picture
⚖️Obstruction⚖️

Trump is obstructing justice in plain sight as he tweeted out to Sessions to shut down Mueller's probe into RU interference in the 2016 elex.

Mueller wants to askTrump about obstruction of justice.

Who says COLLUSION is a crime?

⚖️The Justice Department
⚖️Obstruction2⚖️

Three members of the notorious international cybercrime group “Fin7” In US custody for role in attacking over 100 US companies. 🤗
.
Paul Manafort = Evidence of Collusion with the Kremlin

Trump & Manafort have known each other since the 1980s.
⚖️Obstruction3⚖️

Manafort Trial Day 2: Fake bills (💰wash), a banned word & a Rick Gates surprise, a parade of luxury vendors testify for the pros’n

Senate GOP kill extra funds for elex security despite intel warning & evidence hacking has already occurred targeting DEMs
Read 82 tweets
Profile picture
Recall, Trump’s Baku hotel was a money laundering front for the Iranian Revolutionary Guard. ✌🏼
2/ Trump Baku money laundering scheme with Iran Revolutionary Guard:
3/
Read 33 tweets

Trending hashtags

#GoodbyeRR #DarkToLight #maga #NewWorldOrder #Freedom #NoDeals #StayVigilant #Showtime #ClockActivated #fakenews #TeamNutShellReport #ThesePeopleAreSick #SCOTUS #ClintonEmails #Winning #TrumpRussia #911hack #HammerTime #WRWY #BigBirdNineOffline #potus #Transparency #Twitter #QTeam #NAFTA

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($3.00/month or $30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!