|
Task Description
Description:
I am doing research related to malware attacks and subsequent attacks on organizations. As far as you know, such attacks were committed against many large companies such as Uber, activision, rockstar, and others.
That might be helpful. Please check that as it can explain most of your questions
https://twitter.com/cglyer/status/1570965878480719873
https://medium.com/@group-ib/what-group-ib-found-about-the-uber-hack-c47cad571ea8
Recently there has been a surge in stolen logs for sale commonly known as Stealer Logs
Stealer logs are malware that is designed to seize login credentials, cookies and files from compromised systems. They work by silently working in the background and exfiltrating the data to an attacker's server.
Several variants of infostealer malware exist, but the primary groups we often encounter are Redline, Raccoon, Vidar, and LummaC2.
During my recent research of analyzing Stealer Logs from various sources, I identified that various credentials belonging to your organisation are leaked.
Intel Source:
IntelX and Telegram Monitoring
It's also important to note that in the event that some of the aforementioned passwords/credentials are no longer working, if the malware is still present on device, then all the accounts should still be considered compromised - My malware logs are not fully up to date and rely on threat intel sources making them available.
Impact
References:
https://flare.io/learn/resources/stealer-logs-and-corporate-access/
https://datadome.co/learning-center/what-is-otp-bot/
https://flare.io/learn/resources/blog/otp-bots/
https://www.infostealers.com/
- Implement mandatory credential rotation protocols.
- Thoroughly examine computing systems for any lingering malware presence.
- Institute Two-Factor Authentication (2FA) across all provided services without exception.
- Deploy a robust password management mechanism ensuring the encryption of stored passwords.
- Provide comprehensive guidance to users on refraining from engaging with unsolicited hyperlinks.
- Disseminate information discouraging the installation of unverified software.
- Foster awareness among users regarding the risks associated with accessing corporate services via non-corporate devices.
- Conduct routine validation exercises by cross-referencing compromised password datasets against the user database to preempt Account Takeover (ATO) incidents.
- Implement a DarkWeb Monitoring Service to capture any exposed logs/credentials/cookies etc.https://[[https://[[https://]]]]
|
