Hello, welcome to the Monday, November 24, 2020 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich. And today I'm recording from Jacksonville, Florida. The year today has a quick diary showing one of his new tools, 1768. 1768, well, that number happens to be the

melting point in Kelvin for Cobalt, and the tool that he's introducing here helps you

analyze Cobalt Strike beacons. Given, of course course the ubiquity of Cobalt Strike in somewhat more sophisticated attacks

these days, this is certainly a new tool to speed up the reverse engineering of these

beacons.

Now Cobalt Strike, of course, is a commercial tool.

It's used for pen testers, but yes, bad guys, of course, have gotten their hands on it to and are using it to compromise networks.

But it looks like attacks against domain registrars are back, and the latest registrar to facilitate these attacks is GoDaddy.

A number of crypto coin currency related sites were essentially compromised by an attacker socially engineering GoDaddy

and using access to the victim's domains to then, for example, change MX records, intercept

email, and use that for password resets. This is an attack that keeps coming back, and of course,

it's difficult to defend against because really the attack is totally external to your organization.

It's just really between the attacker and the domain registrar.

Best you can probably do is monitor your DNS records,

make sure that you are alerted if any unauthorized change is made.

And of course, yes, you should do your best to

secure any credentials and enable to factor authentication, but against this social engineering

attack, this would not necessarily protect you. So having detective controls in place is certainly

important.

And talking about various mischief being done with domain names, the FBI is warning that they're seeing an increase in spoofed FBI domains.

Essentially what the attacker is doing here is just registering a domain with the letters FBI in the domain name,

and then using that to full victims into believing that this is the actual FBI or an FBI-related

...