Thx greg! If any home gamers is looking to test your JS deobfuscation skills on a lazy friday, grab the samples here : github.com/StrikeReady-...

Quite a bit of CN APT activity in europe in the past week strikeready.com/blog/cn-apt-... As always, if you're interested in tuning your skills, download the samples here github.com/StrikeReady-...

bb491248bb8f6067af39e196b11f4e408a7a3885704cadbd4266db52ae4b03e2 Agenda_Meeting 26 Sep Brussels\.zip #china #apt e53bc08e60af1a1672a18b242f714486ead62164dda66f32c64ddc11ffe3f0df c2 racineupci\.org

Decoy tracking is a great indicator for potentially interesting payloads --- decoys that contain 'defence' or 'nato' related keywords have paid dividends for many years 218ed813d8a4d9d05473338795021c66012cd6c36368561d3aaf831a5c494740 utensils\.zip cseconline[.]org

blocking vt via htaccess ... pretty good indicator that you may not be up to any good ....

interesting use of @vercel.com for today's #dailyphish mscsharepoint[.]vercel[.]app/?email=[]

seeing approximately a million of these #dailyphish today

Spearphishing the news: sidewinder using the Nepal protests as APT lures strikeready.com/blog/sidewin...

south asian threat actor continuing to target Nepal, this time by leveraging personas involved in their ongoing civil unrest apks playservicess[.]com/Emergency_Help.apk playservicess[.]com/Gen_Ashok_Sigdel_Live.apk

interesting #dailyphish .. send them a message talking about a previously sent password protected pdf (that wasn't ever sent), to get the person to reach out and ask for the malicious file

#apt #ru gamaredon 9a95ba01961c0ae96047c2145978da04899975b1d6eeae6f3b2ccd124ad45bba 2-1180-25_03.06.2025.html

Fișa de facturare pentru al doilea trimestru.doc 15c9203b107020b0b7b70a04c0268c83 moldova submitters often give interesting threads to pull on...

new format from our .desktop friends, made famous by ZS researchers Proposal_Posting_of_Offrs_to_RMC_Mumbai.pdf.desktop 0a671f5849a24aceb605d41dcb607230

large trawling campaign against MFAs - specifically reps to Egypt Online Seminar.FM.gov.om.doc Online Seminar.MFA.gov.ct.tr.doc pivot: DPR for dredging in FreeSpan_16082025.2.doc c2 screenai[.]online 3ab16bd1c339fd0727be650104b74dd1 1de19958e7c2ef14addfb35b43a594ec e73ba93d008affdc4cce0cb4e18ae5c6

Fun to collab with Pham Duy Phuc at Trellix on this research into DPRK's recent embassy phishing campaigns. Although other novel vectors get the headlines, Email is still a major component of most APT groups. www.trellix.com/blogs/resear...

A South Asian APT has been persistently targeting Sri Lanka, Bangladesh, Pakistan, and Turkey. This post walks through how to pivot from the well-publicized phishing infrastructure to expose APK tooling that compromised members of the military of Asian countries. strikeready.com/blog/apt-and...

who doesn't love a phish with a <marquee> tag? dgdppakistan.securecloudfilesdownload[.]com

Learn to hunt: oddball file extensions + frequency analysis. Today we see an Indian APT leveraging "ProgressReport.jse.xz" to target Sri Lanka, and a Russian APT using "Щодо фактів отримання неправомірної вигоди 2-1273-2025_12.08.2025.HTA.BZ2" to target UKR github.com/StrikeReady-...

Something tells me this isn't the real Trusteer ibmtrusteermobile[.]com/Down/IBMtrusteermobile.apk

If you're an MFA, you're used to getting targeted by DPRK actors. If not, this phish from this morning, may be illustrative of the detection needs --- URL scanning, password cracking, trusted partner spoof detection, leveraging github for c2 without true "exe" malware ... github.com/StrikeReady-...

Sri Lanka must have gotten a new hosting provider #apt

big run of these customized pass-protected pdf phishes #dailyphish

smells like sandworm Лист на повернення предоплати.lnk Договір _2025.lnk Укрспецзв_Акт_30_05_25_ДР25_2313_13 від 26_02_2025.lnk github.com/StrikeReady-...

#dailyphish clearly a red team/authorized phish scenario, but this one is just mean

Learn to hunt apt: flag archives where the extensions contain 3+ of a doc/pdf, lnk, exe, dll, where one is newly seen. The volume will be low enough to eyeball every hit Stay tuned for next week's advanced lesson -- leveraging Vi to track binaries used to sideload dlls github.com/StrikeReady-...

#dailyphish #meta

#dailyopendir #malware howwasthetea.ddns[.]net

these types of terrorism threats happen every day to governments, and they have to chase them down. it's ddos, but in real life.

#dailyphish #crimeware if you liked 2FA-themed phishing, you'll love 3FA-themed phishing

#dailyphish #crimeware @vercel.com invoice-8094.vercel[.]app/success.html

Great deep research into "bitter", one of the longer running South Asian APTs

#apt Targeting Bosnia and Herzegovina Riga2025.pptm 3476eeb72a6138d75bf7d922062674fb50323f6bdd41b391e846f6f9462398df -> f6c127a01cadf49b0da0d12b6836c6e12b6a6705ef3b6285a90f4d38038725ff ow123msadmasj41.exe #dailyphish

#dailyopendir also see adm001-4 #malware

interesting way to drop a malicious .js

interesting apk... "base.apk" b3ca9b9f4ac9701e662e117437b80ed22e00c2792334c8594ed7bf99b034baf3 sends an sms worm ("this subscriber has been hacked")

"脱密 中央国安办.IMG" (Declassified Central National Security Office.img) ced7fe9c5ec508216e6dd9a59d2d5193a58bdbac5f41a38ea97dd5c7fceef7a5

"gov-pk.pk" hmmmm

#apt 플랜아이 작업계획서 및 작업완료서_기계연 이명화.scr 123aefe0734da130b475bfdad6c3ebe49688569ab8310e71ec5252ec46cb67eb

#apt a16bbc8acf626a966bec45d1ecac4681dafde23127aabc3ada5ccfc16c02bdb9 news-telephone1.space

#apt KB국민은행 소명자료 제출 요청의 건_20250430TS5869570S.zip #dprk 3f92ea810aecf95898fb07293e5fcca3374462638c0ecf86cac86fe3104a6738

#apt useof. org/my-files/DistributionDocument-90421.pdf.zip useof. org/my-files/3.PL_PIEC001-L20250227-GLOBAL_ATOP.pdf.zip 0bbbd415060a96c175c7fe7376a8bad40f3a05d84603548c18973cf695af6fac -> 92.119.114.128/ov4_dd_p.rar

#apt #phishing Caution Against Propaganda and Misinformation Campaigns. zip 66d285ad9df2d14ce57a86568eb382c4a4cb31fe917dacd9ade1da46860a203a

#apt Action Plan 2025 and the Strategic Plan for the period 2025-2029.docx 558de2a01fbd76be171561c3c82fd6a8e2d4c913444850af99d44a4cfb41b680 www-presidentsoffice-gov-lk.dwnlld.com

#apt PMYP Sub Domains.rar d41c86bf77f83ae42b97ffa8d9b01d510711f4bac59fbf91feacd59abaa9861a -> ntplugnplay. com/jb5.php

#dailyopendir #malware #msc

don't often see phishing in hebrew #dailyphish

#dailyphish #maybeapt us02web-zoom-us.mulsue23.com/us02web.zoom.us2 us02web-zoom-us.tapizacar.com/us02web-zoom-us us02web-zoom-us.mulsue23. com/us02web.zoom.us2/Documents.zip

"CPEC Project Critical Load Approval.xlsx.iqy" -> kaatinteriordecor. com #apt 6a5f01d4cfdc4215a8a1b661e12b15b2208eb7f693989d2637471df78ac555c2

I wrote some details on LOSTKEYS: malware which we directly attribute to COLDRIVER. They don't deploy it often, but we have seen it a few times and want to make people aware of it. cloud.google.com/blog/topics/...

#dailyphish interesting use of a teams lure -> prognomi. com/themes/colors/?action=validate