⚠️ SEXi Ransomware attack on IXMETRO POWERHOST linked to broader campaign that has hit at least three Latin American countries and Thailand 🧵

"LIMPOPOx32.bin" an ELF 32-bit Babuk-tagged Binary
58ba94be5c2c7d740b6192fea1cc829756da955bb0f2fcf478ab8355bf33a31a

1/n

I believe this ransomware binary is connected to the SEXi attack on IXMETRO POWERHOST.

From a simple VirusTotal search for contents of the note in the BleepingComputer article, I found three other variants of this ransomware using Session targeting Latin American countries. 2/n

Interesting Thread on a massive dump from a Chinese 🇨🇳 Ministry of Public Security (MPS) private industry contractor called iSoon (aka Anxun)

Leak contains:
- Spyware
- Espionage Ops
- “Twitter Monitoring Platform”
- And a lot more 🔥

This is a crazy NTC Vulkan-level leak ⚠️

https://twitter.com/azakasekai_/status/1759326049262019025

Literal APT operations sales pitch slides to the Chinese MPS

Tracking hacktivism & the 🇮🇱Israel/🇵🇸Hamas War from: 🇸🇩🇲🇦🇧🇩🇮🇳🇵🇰🇮🇷🇷🇺

(Since 7-Oct-23)
Types of hacktivists attacks shared on Telegram so far:
- DDoSing *.il websites
- Sharing of credentials for *.il sites
- Hijacking APIs to send mobile push messages
- Leaking stolen documents Regional APT actors worth researching, are as follows:
- 🇵🇸 Molerats / Gaza Cybergang / Extreme Jackal, AridViper / Desert Falcon / APT-C-23 / Mantis
- 🇱🇧 POLONIUM / Plaid Rain, Dark Caracal, Volatile Cedar, Tempting Cedar
- 🇮🇷 MERCURY / MuddyWater, DarkBit, Agrius, BlackShadow

🧵New #CTI assessment based on OSINT research:

🔎ScatteredSpider/0ktapus is a BlackCat (ALPHV) affiliate, but doesn't deploy ransomware

- Based on some temporal, technical, and behavioral analysis

Follow me 🐇🕳 (1/6) 9 Feb 23, Reddit faced a 'highly-targeted phishing attack' & had docs and source code stolen

TTPs are very similar to ScatteredSpider/0ktapus campaigns:
- a landing page impersonating its intranet site
- stolen employees' credentials and 2FA codes
reddit.com/r/reddit/comme… (2/6)

Kudos to @DragosInc for being transparent over a recent security incident:
dragos.com/blog/deconstru… CTI vendors and their platforms are lucrative target for cybercriminals. They host tons of valuable reports and threat intel data, including breach data.

Cybercriminals have targeted multiple CTI platforms to see this information. Cybercrime Counterintelligence, if you will.

My iCloud is recently getting a few #16Shop #phishing emails, I RE'd the links (for lack of a better term) and found a whole trawl of their previous phish. Highly organised operation which has been going on for a few years. The links are text which have been highlighted and use s[.]id URL shorteners & IP logging service from (surprise surprise) Indonesia. More specifically: Pengelola Nama Domain Internet Indonesia.
They also use app[.]link from Branch.io that uses "Deep Linking".