mastodon.ie

🛡 H3lium@infosec.exchange/:~# :blinking_cursor:"🔍 Unveiling Sandman APT: The Silent Menace Targeting Global Telcos 🎯"SentinelLabs has unearthed a new threat actor dubbed Sandman APT, primarily targeting telecommunication providers across the Middle East, Western Europe, and South Asia. This enigmatic group employs a novel modular backdoor named LuaDream, utilizing the LuaJIT platform, a rarity in the threat landscape. The meticulous movements and minimal engagements hint at a strategic approach to minimize detection risks. The LuaDream malware, a well-orchestrated and actively developed project, is designed for system and user info exfiltration, paving the way for precision attacks. The intriguing part? The attribution remains elusive, hinting at a private contractor or a mercenary group akin to Metador. The activities observed are espionage-driven, with a pronounced focus on telcos due to the sensitive data they harbor. The meticulous design of LuaDream showcases the continuous innovation in the cyber espionage realm, urging for a collaborative effort within the threat intelligence community to navigate the shadows of the threat landscape.Source: <a href="https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/" rel="nofollow noopener" target="_blank">SentinelOne Labs</a>Tags: <a href="https://infosec.exchange/tags/SandmanAPT" class="mention hashtag" rel="nofollow noopener" target="_blank">#SandmanAPT</a> <a href="https://infosec.exchange/tags/LuaDream" class="mention hashtag" rel="nofollow noopener" target="_blank">#LuaDream</a> <a href="https://infosec.exchange/tags/TelecomSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#TelecomSecurity</a> <a href="https://infosec.exchange/tags/CyberEspionage" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberEspionage</a> <a href="https://infosec.exchange/tags/ThreatActor" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatActor</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/LuaJIT" class="mention hashtag" rel="nofollow noopener" target="_blank">#LuaJIT</a> <a href="https://infosec.exchange/tags/SentinelLabs" class="mention hashtag" rel="nofollow noopener" target="_blank">#SentinelLabs</a> <a href="https://infosec.exchange/tags/APT" class="mention hashtag" rel="nofollow noopener" target="_blank">#APT</a> 🌐🔐🎯 Indicators of Compromise (IoCs):<ul><li>Domains: mode.encagil[.]com, ssl.explorecell[.]com</li><li>File Paths: %ProgramData%\FaxConfig, %ProgramData%\FaxLib</li><li>SHA1: <ul><li>fax.dat: 1cd0a3dd6354a3d4a29226f5580f8a51ec3837d4</li><li>fax.Application: 27894955aaf082a606337ebe29d263263be52154</li><li>ualapi.dll: 5302c39764922f17e4bc14f589fa45408f8a5089</li><li>fax.cache: 77e00e3067f23df10196412f231e80cec41c5253</li><li>UpdateCheck.dll: b9ea189e2420a29978e4dc73d8d2fd801f6a0db2</li><li>updater.ver: fb1c6a23e8e0693194a365619b388b09155c2183</li><li>fax.module: ff2802cdbc40d2ef3585357b7e6947d42b875884</li></ul></li></ul> Author: Aleksandar Milenkoski, a seasoned threat researcher at SentinelLabs, has meticulously dissected the activities of Sandman APT, shedding light on the LuaDream backdoor. His expertise in reverse engineering and malware research is evident in the detailed analysis provided.

Just Another Blue TeamerHappy Friday everyone!The SentinelOne Labs research team has discovered a new <a href="https://ioc.exchange/tags/APT" class="mention hashtag" rel="nofollow noopener" target="_blank">#APT</a> they named <a href="https://ioc.exchange/tags/Sandman" class="mention hashtag" rel="nofollow noopener" target="_blank">#Sandman</a>. This group targets telecommunication providers and uses a modular backdoor known as <a href="https://ioc.exchange/tags/LuaDream" class="mention hashtag" rel="nofollow noopener" target="_blank">#LuaDream</a>. They used techniques that included pass-the-hash and DLL hijacking to meet their objectives! Enjoy and Happy Hunting!Sandman APT | A Mystery Group Targeting Telcos with a LuaJIT Toolkit <a href="https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/" rel="nofollow noopener" target="_blank">https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/</a><a href="https://ioc.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://ioc.exchange/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#ITSecurity</a> <a href="https://ioc.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://ioc.exchange/tags/BlueTeam" class="mention hashtag" rel="nofollow noopener" target="_blank">#BlueTeam</a> <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatHunting</a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#HappyHunting</a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener" target="_blank">#readoftheday</a>

securityaffairs<a href="https://infosec.exchange/tags/Sandman" class="mention hashtag" rel="nofollow noopener" target="_blank">#Sandman</a> <a href="https://infosec.exchange/tags/APT" class="mention hashtag" rel="nofollow noopener" target="_blank">#APT</a> targets telcos with <a href="https://infosec.exchange/tags/LuaDream" class="mention hashtag" rel="nofollow noopener" target="_blank">#LuaDream</a> <a href="https://infosec.exchange/tags/backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoor</a> <a href="https://securityaffairs.com/151191/apt/sandman-apt-targets-telco.html" rel="nofollow noopener" translate="no" target="_blank">https://securityaffairs.com/151191/apt/sandman-apt-targets-telco.html</a> <a href="https://infosec.exchange/tags/securityaffairs" class="mention hashtag" rel="nofollow noopener" target="_blank">#securityaffairs</a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#hacking</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a>

Recent searches

Search options

Administered by:

Server stats:

#luadream