In recent days, we've identified targeted campaigns against major organizations . Cybercriminals are using Skype to distribute seemingly harmless PDF documents. However, these files are indeed binary executables that, once opened, install an infostealer.
This makes it quick and easy to perform complete remote volume acquisitions, triages, or analyses with the investigator's favorite tools and scripts on his own workstation without installing anything on the endpoints.
SPECTR3: Remote Acquisition Tool
Alpine Security would like to share with the community a new project we have been working on for some time now:
github.com/alpine-sec/SPE…
SPECTR3 aims to facilitate live forensics work by making remote endpoint block devices available to the investigator as if they were a local disk drive.