Author: HOTSAUCE | S2W TALON First Publihsed: July 6, 2022. Last Modified : July 8, 2022. As @CrazymanArmy and @ShadowChasing1 pointed out, our conclusion is also same that there is no concrete evidence to connect Teng Snake with the previously known APT-C-61. Executive Summary The “Teng Snake” team has created Telegram channels…

Author: S2W TALON Last Modified : June 30, 2022. Executive Summary As LockBit ransomware group has been updated twice without rebranding for a long time and continues to strengthen their brand reputation with their recently announced update to 3.0. As a result, the copycat groups that imitate LockBit ransomware’s logo or the…

Author: HOTSAUCE | S2W TALON Executive Summary LockBit ransomware was previously known as ABCD ransomware and belonged to the Maze ransomware cartel, but started independent activity in September 2019 as the Maze gang announced its retirement. Instead of rebranding the existing name like other ransomware groups, LockBit updated its own brand to…

Author : HOTSAUCE | S2W TALON Executive Summary On June 15th, 2022, a user who is operating the carding market “BidenCash” uploaded an advertisement with a link for downloading free carding information on underground forums. From April 27, 2022, until now, the user has been active on underground forums that trade carding…

Author: S2W TALON Last Modified : 2022.06.16. Executive Summary On March 25, 2022, the operator of Raccoon Stealer, who was active on the dark web forum, temporarily suspended his activities since a key developer died in the Russia-Ukraine War. On May 17, 2022, the operator mentioned that the development of a new…

Author: Sigma| S2W TALON Last Modified: 2022.05.30. About Raidforums.com Raidforums.com was launched by Omnipotent on January 1, 2015, and was operated for about seven years until February 2022. In this forum, user account information on specific corporate-related websites, personal information by country, VPN/RDP credentials, and ransomware-related leakage information were mainly sold. Raidforums…

Author: S2W TALON Last Modified : 2022.05.25. 최근 가상화폐, 그중에서도 NFT를 타겟으로 하는 다양한 공격이 발생하고 있어 NFT 생태계를 위협하고 있다. NFT 시장에 대한 관심은 2017년도 CryptoPunks의 등장으로 주목을 받기 시작하였고, 이후 2020년도부터 급 …

Author: Jiho Kim | S2W TALON Last modified: May 12, 2022 Introduction of BlackGuard Stealer With the recent rapid expansion of the blockchain market including NFTs, cybercriminals are mainly using info stealer malware to steal credentials and wallet data stored in personal PCs. In addition, as it is known that the LAPSUS$ group, which…

Author: Jiho Kim | S2W TALON Last Modified : 2022.04.01. Executive Summary BlackGuard Stealer, which collects and exfiltrates credentials and device information from infected PC, first appeared when the official seller posted a promotion article on the dark web forum in January 2022 BlackGuard Stealer collects and exfiltrates not only credentials such…