SS-NEWS-076: Criminal Groups Moving to Sliver Framework over Cobalt Strike

Episode 76 September 05, 2022 00:32:40
SS-NEWS-076: Criminal Groups Moving to Sliver Framework over Cobalt Strike
Security Serengeti
SS-NEWS-076: Criminal Groups Moving to Sliver Framework over Cobalt Strike

Sep 05 2022 | 00:32:40

/

Show Notes

In this episode, we discuss Cloudflare IP's being banned in Austria due to overzealous Copyright enforcement, how attackers are moving off of Cobalt Strike as it's getting too well known, and finally Stego!  Yes, that's right, all of that CTF experience in stegonagraphy will finally come in handy!  Attackers were spotted downloading malware hidden in the cert of a JPG.

Article 1 - Pirate sites ban in Austria took down Cloudflare CDNs by mistake
Supporting Links:
How content delivery networks (CDNs) work
Wahrnehmung von Leistungsschutzrechten GmbH - Informationen

Article 2 - Cybercrime Groups Increasingly Adopting Sliver Command-and-Control Framework
Supporting Links:
A How-To Guide for Using Sliver

Article 3 - James Webb telescope images used to hide malware
Supporting Links:
How to monitor/detect Microsoft Office macro execution?
Command line process auditing

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

Other Episodes

Episode 54

March 28, 2022 00:36:59
Episode Cover

SS-DYST-054: Cyber Dystopia - Facial Recognition used in Ukraine War

Welcome to our first episode of a new sub-series - The Coming Tech Dystopia.  We had so much fun ranting about the state a...

Listen

Episode 129

November 07, 2023 00:57:58
Episode Cover

SS-NEWS-129: Solarwinds CISO Charged, AI Executive Order

We had originally planned on a discussion about Threat Intel AI this week, but after some discussions with a few vendors, I don't think...

Listen

Episode 126

September 25, 2023 00:49:16
Episode Cover

SS-NEWS-126: Hackers as Insider Traders and AI Study on Effectiveness

Title 1: Russian infosec boss gets nine years for $100M insider-trading caper using stolen dataSummary: Vladislav Klyushin, owner of Russian firm M-13, was sentenced...

Listen