![A threat actor spreads #DanaBot using Google #malvertising via websites impersonating the Advanced IP scanner download page.
It has probably been targeting IT admins (valuable hosts) for several months.
Distribution infra of 40+ domain names:
advancd-ip-scanner.]com
⬇️](https://pbs.twimg.com/media/GB02kWLXIAAGyZL.jpg "crep1x (@crep1x) on Twitter photo 2023-12-21 08:05:01 A threat actor spreads #DanaBot using Google #malvertising via websites impersonating the Advanced IP scanner download page.
It has probably been targeting IT admins (valuable hosts) for several months.
Distribution infra of 40+ domain names:
advancd-ip-scanner.]com
⬇️")
Malvertising injects malicious code into legit ads, exploiting ad network & browser vulnerabilities. When users interact, it redirects to malicious sites or downloads malware. Keep software updated & use ad-blockers! 🚫🖥️ #Malvertising #BrowserSecurity
X #Malvertising #FakeWallet
A malicious ad appears on my timeline🤣
im-token[.]us -> hxxps://im-token[.]us/down/imtoken.apk -> 738d0e0def50ddf40df81ed4ed2faf50e8a8db196360826e39e69de8981ed8aa
Collect and send mnemonic to remote server
C2: api.bvip[.]dev
MalwareHunterTeam
![X #Malvertising #FakeWallet
A malicious ad appears on my timeline🤣
im-token[.]us -> hxxps://im-token[.]us/down/imtoken.apk -> 738d0e0def50ddf40df81ed4ed2faf50e8a8db196360826e39e69de8981ed8aa
Collect and send mnemonic to remote server
C2: api.bvip[.]dev
@malwrhunterteam](https://pbs.twimg.com/media/GA-To5FbIAAHIZG.jpg "Cuser (@Cuser07) on Twitter photo 2023-12-10 08:38:44 X #Malvertising #FakeWallet
A malicious ad appears on my timeline🤣
im-token[.]us -> hxxps://im-token[.]us/down/imtoken.apk -> 738d0e0def50ddf40df81ed4ed2faf50e8a8db196360826e39e69de8981ed8aa
Collect and send mnemonic to remote server
C2: api.bvip[.]dev
@malwrhunterteam")
The latest update for #KnowBe4 includes 'Top Tax Scams of 2024 Your Organization Should Watch Out For' and 'Malvertising Campaigns Surged in 2023'.
#Cybersecurity #RiskManagement opsmtrs.com/3ZJvoEF
![A threat actor distributes the #Sliver C2 framework via websites impersonating Advanced IP scanner / WinSCP / Putty, likely using malvertising.
Distribution website:
hxxps://advanced-ip-scann.]org/av/download.php
Sliver C2:
94.156.65.]115:8443
⬇️](https://pbs.twimg.com/media/GKyRpHrW0AA1JiS.jpg "crep1x (@crep1x) on Twitter photo 2024-04-10 07:09:37 A threat actor distributes the #Sliver C2 framework via websites impersonating Advanced IP scanner / WinSCP / Putty, likely using malvertising.
Distribution website:
hxxps://advanced-ip-scann.]org/av/download.php
Sliver C2:
94.156.65.]115:8443
⬇️")
![✔️The attack chains use scripts loaded from the threat actor-controlled server ('jscdnpack[.]com'). This specifically targets a page structure that is common to several banks.
✔️The malware is delivered to targets by some other means like phishing emails or malvertising.](https://pbs.twimg.com/media/GDf23CGXMAAh240.jpg "CyberPreserve (@CyberPreserve) on Twitter photo 2024-01-10 17:25:36 ✔️The attack chains use scripts loaded from the threat actor-controlled server ('jscdnpack[.]com'). This specifically targets a page structure that is common to several banks.
✔️The malware is delivered to targets by some other means like phishing emails or malvertising.")
What are these? Developed in Delphi🤔
joesandbox.com/analysis/14046…
(now offline)
https[:]//traclom1[.]buzz/uptodate/data[.]zip
https[:]//www.checkthedifference[.]online/updates/info[.]zip
Perhaps related to some malvertising activities?
RussianPanda 🐼 🇺🇦 Yogesh Londhe crep1x
![What are these? Developed in Delphi🤔
joesandbox.com/analysis/14046…
(now offline)
https[:]//traclom1[.]buzz/uptodate/data[.]zip
https[:]//www.checkthedifference[.]online/updates/info[.]zip
Perhaps related to some malvertising activities?
@RussianPanda9xx @suyog41 @crep1x](https://pbs.twimg.com/media/GKYTwN6WcAA6I75.jpg "Gabriele Orini (@greenplan_it) on Twitter photo 2024-04-05 06:05:13 What are these? Developed in Delphi🤔
joesandbox.com/analysis/14046…
(now offline)
https[:]//traclom1[.]buzz/uptodate/data[.]zip
https[:]//www.checkthedifference[.]online/updates/info[.]zip
Perhaps related to some malvertising activities?
@RussianPanda9xx @suyog41 @crep1x")
A Facebook page with 1.2 million followers claiming to offer free access to Midjourney AI got caught for pushing malware and infostealers.
|
bitdefender.com/blog/labs/ai-m…
|
#InfoSec #CyberSecurity #Malvertising #SocialMedia #Facebook #GenerativeAI #InfoStealers #MidjourneyAI
