Technical

[Asyn]

Genesis Marketplace, a Digital Fingerprint Darknet Store
https://www.f5.com/labs/articles/threat-intelligence/genesis-marketplace--a-digital-fingerprint-darknet-store

[Asyn]

German users targeted with Gootkit banker or REvil ransomware
https://blog.malwarebytes.com/threat-analysis/2020/11/german-users-targeted-with-gootkit-banker-or-revil-ransomware/

[Asyn]

Impersonation-as-a-Service: Characterizing the Emerging Criminal Infrastructure for User Impersonation at Scale
https://arxiv.org/pdf/2009.04344.pdf

[Asyn]

Threat actor leverages coin miner techniques to stay under the radar – here’s how to spot them
https://www.microsoft.com/security/blog/2020/11/30/threat-actor-leverages-coin-miner-techniques-to-stay-under-the-radar-heres-how-to-spot-them/

[Asyn]

There’s a RAT in my code: new npm malware with Bladabindi trojan spotted
https://blog.sonatype.com/bladabindi-njrat-rat-in-jdb.js-npm-malware

[Asyn]

DarkIRC bot exploits recent Oracle WebLogic vulnerability
https://blogs.juniper.net/en-us/threat-research/darkirc-bot-exploits-oracle-weblogic-vulnerability

[Asyn]

Turla Crutch: Keeping the “back door” open
https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/

[Asyn]

Unauthorized Access of FireEye Red Team Tools
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html
https://github.com/fireeye/red_team_tool_countermeasures

[Asyn]

The December 2020 Security Update Review
https://www.zerodayinitiative.com/blog/2020/12/8/the-december-2020-security-update-review

[Asyn]

APT Group Targeting Governmental Agencies in East Asia
https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/

[Asyn]

IceRat evades antivirus by running PHP on Java VM
https://www.gdatasoftware.com/blog/icerat-evades-antivirus-by-using-jphp

[Asyn]

TrickBot Now Offers ‘TrickBoot’: Persist, Brick, Profit
https://eclypsium.com/2020/12/03/trickbot-now-offers-trickboot-persist-brick-profit/
https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf

[Asyn]

What did DeathStalker hide between two ferns?
https://securelist.com/what-did-deathstalker-hide-between-two-ferns/99616/

[Asyn]

IBM Uncovers Global Phishing Campaign Targeting the COVID-19 Vaccine Cold Chain
https://securityintelligence.com/posts/ibm-uncovers-global-phishing-covid-19-vaccine-cold-chain/

[Asyn]

AMNESIA:33 – Forescout Research Labs Finds 33 New Vulnerabilities in Open Source TCP/IP Stacks
https://www.forescout.com/company/blog/amnesia33-forescout-research-labs-finds-33-new-vulnerabilities-in-open-source-tcp-ip-stacks/
https://www.forescout.com/company/resources/amnesia33-how-tcp-ip-stacks-breed-critical-vulnerabilities-in-iot-ot-and-it-devices/