Hello, welcome to the Monday, September 12, 2020 edition of the Sands and at Storm Center's Stormcast.

My name is Johannes Ulrich and today I'm recording from New York City, New York.

One of the goals of analyzing malware can be to find out where, for example, a fishing page or a piece of malware that's being downloaded is hosted in order to either add it to some blocklist or maybe even take it down.

So to prevent additional damage being caused by this malicious file.

On the other hand, there are attackers that are, of course, then trying to find locations

that are hard to take down. But what we have this weekend is actually sort of the opposite

where an attacker is actively managing the location where the file is hosted in order to sort of

keep that URL ephemeral and make it

more difficult to actually then, for example, discover related events or also to analyze

the additional malware that's being downloaded in this case.

Guy wrote up a Word document that contained a URL that linked to a website that only

hosts files for 24 hours and automatically deletes them.

QAC.im, also known as QAC.ru.

The remainder of the URL is sort of your typical UUID format, so basically just a random string.

Now, if you never heard of QAC. I.m or QAC.r. You're not alone. The site was new to me, too. The site also offers ephemeral email addresses and appears to be not very popular.

The counter for how many messages they sent was around 3,000 when I looked at it before starting this recording.

So by using a site that's relatively unknown, the attacker may believe that it's less likely

going to be found in block lists that often are blocking file download sites like this.

And Noam with legit security post a blog post, shining a light on a well-known issue with GitHub's protected branches.

This feature is included with paid account, so you don't get it with the free GitHub account,

but the basic function here is that if you would like to merge a poll request with your main or default branch, then a second

developer first has to approve that poll request. And the problem here is that, well,

...