PhatomCandle ThreatIntel

#MuddyWater #C2 #APT #Malware #IOC #ThreatIntel daily hunting 92[.]243[.]65[.]243

#MuddyWater #C2 #APT #Malware #IOC #ThreatIntel daily hunting web27[.]info 38[.]180[.]239[.]161

#MuddyWater #C2 #APT #Malware #IOC #ThreatIntel daily hunting 38[.]180[.]239[.]161 web27[.]info

#MuddyWater #C2 #APT #Malware #IOC #ThreatIntel daily hunting 185[.]76[.]79[.]125

#MuddyWater #C2 #APT #Malware #IOC #ThreatIntel daily hunting phoneaccessory[.]site 172[.]67[.]151[.]208

#MuddyWater #C2 #APT #Malware #IOC #ThreatIntel daily hunting formacja[.]info 104[.]21[.]58[.]50

#C2 #SneakyChef #APT #SpiceRAT #Malware #IOC #ThreatIntel daily hunting 31[.]58[.]220[.]250

#Kimsuky #C2 #APT #Malware #IOC #ThreatIntel daily hunting bigfile[.]navcloudstorage[.]n-e[.]kr 163[.]245[.]215[.]46

#Kimsuky #C2 #APT #Malware #IOC #ThreatIntel daily hunting auth[.]hrstrotage[.]n-e[.]kr 163[.]245[.]215[.]46

@jo3rg @skocherhan Yup,so we write suspected, but we think it is targeted attack,not advaced

@phatomcandle @skocherhan What gives away the APT attribution? On the first sight this doesn't look super sophisticated

#APT #ThreatIntel #cybersecurity #cyberattack Multi-Stage Cyber Campaign Targeting Tunisian Government and French Healthcare Infrastructure with Suspected State-Sponsored Attack Activity,check our new blog @phatomcandle/attack-campaign-tunisian-gov-database-breached-french-healthcare-data-stolen-5f599e70deda" target="_blank" rel="nofollow noopener">medium.com/@phatomcandle/…

#Kimsuky #C2 #APT #Malware #IOC #ThreatIntel daily hunting nid[.]navmercorp[.]n-e[.]kr 163[.]245[.]215[.]46

#Kimsuky #C2 #APT #Malware #IOC #ThreatIntel daily hunting nhls[.]o-r[.]kr 163[.]245[.]215[.]46

#Kimsuky #C2 #APT #Malware #IOC #ThreatIntel daily hunting 118[.]194[.]248[.]246

#SideWinder #APT #APT_Generic #Malware #IOC #ThreatIntel daily hunting 5d3b047763978146399cfe8c604b3d296e6b723bfd39adb4eb34c89c61231f07 1e875808f35b90d3ef5f81b0659a2452

#APT #C2 #EtherRAT #IOC #ThreatIntel #Lazarus something interesting about suspect DPRK threatactors targeting IT professionals，fake RDCMan/DelProf2/Procmon/PsTools/Autologon which maybe in malicious github repo ,check our blog @phatomcandle/spoofed-it-tools-distribute-etherrat-in-highly-stealthy-campaign-suspected-linked-to-dprk-apt-1aa6beab7dcb" target="_blank" rel="nofollow noopener">medium.com/@phatomcandle/…

#C2 #DCRat #Malware #IOC #ThreatIntel daily hunting 185[.]221[.]213[.]35

#C2 #CobaltStrike #Malware #IOC #ThreatIntel daily hunting 44[.]212[.]191[.]1

#AsyncRAT #Malware #IOC #ThreatIntel daily hunting 104[.]243[.]248[.]63

#C2 #DarkComet #Malware #IOC #ThreatIntel daily hunting 195[.]167[.]38[.]76