Hello and welcome to the Thursday, February 9th, 2020,

3 edition of the Sands and the Storm Center's Stormcast.

My name is Johannes Ulrich, and I am recording from Jacksonville, Florida.

Well, I wrote up a pretty sort of simple fish today that I received.

It arrived as an email that sort of had actually a little

bit of emails going forth and back here regarding an order and detachment claimed to

be an payment confirmation. The attachment was just an HTML file, so nothing malicious in the sense

that there was no exploit or so involved, but if you open the HTML file, so nothing malicious in the sense that there was no exploit or so involved,

but if you open the HTML file, it will mimic an Office 365-like page and, of course,

trick you to log in. The way the password is then collected is by sending a request via JavaScript to the Telegram API.

Another sort of interesting twist here is on Monday I wrote about APIs that are being used to

look up your public IP address. It actually uses one of those APIs and also then includes the IP address of the host

or of the victim. If Telegram is not used in your environment, then of course looking for

Telegram API requests, maybe something worthwhile to search for. And I already mentioned that these IP lookup APIs are

certainly something to keep an eye on.

And in case your organization got affected by the recent VMware ESXI, Ransomware ESXI,

SISA, the cybersecurity and infrastructure security agency, came up with some guidance as to how to recover from this compromise.

Of course, there is sort of no fail-proof recovery here, but Sissai came up with a little bash script that will assist you trying to recover

what there is to recover by essentially creating new BMX configuration files, if possible

and trying to recover the machines. It'll also create backups of the encrypted files. Overall, looks pretty

straightforward, nice that it's just a batch file, so relatively easy to review what it does.

Kind of sad that it's almost easier to come up with a recovery script like that than with a good way to actually patch

...