Hello, welcome to the Thursday, October 15th, 2020 edition of the Sandcent Storm Center's Stormcast. My name is Johannes Ulrich.

And then I'm recording from Jacksonville, Florida. Brad, today gave us an update on what's going on with Shad Hack or TA551.

This is Malbert that typically arrives as a... with Shadhack or TA551.

This is Malbreda typically arrives as a password-protected zip file, and then in the email,

you do get the password for this zip file.

Now, once un-sipped, you'll see a Word document that then, of course, turns out to be malicious.

The passwords differ for each email, which of course makes it a little bit more difficult for anti-malver to take these attachments apart.

And encrypted zip files have actually become somewhat common in order to prevent data leakage in

some organizations. Of course, if you're trying to prevent data leakage, then don't include

the password in the email, but this may explain why people are falling for this and actually

are opening these emails. Brad states that he sees this particular

campaign mostly target non-English speakers, but in his environment, most of the English speakers

actually fell for this particular attack. Other than that, the particular malware still behaves pretty much like it

back in August when Brad was talking about that this one last. It opens a word document,

then it retrieves additional malware from a URL that ends in dot CAB. This is then a DLL that's the installer and it installs

more matter, which well in this case was Iced ID or Bockbot. And just a couple of updates

for Microsoft's patch Tuesday. Some one interesting tweet that pointed out that the two SharePoint vulnerabilities that allow remote code execution are probably actually the ones that you really should worry about in this set.

I actually tend to agree somewhat.

CVE 2020 16951 as well as 169522. Now, as far as my favorite goes, the ICMPV6 vulnerability about the corrupt

router advertisements haven't seen any proof-of-concent exploits yet. There's a fairly obvious fake

exploit going around. It's really just meant to sort of trick

script kitties that like to basically download random proof of concept exploits. Snort or Cisco has come up

...