Threat video1:00
DarkBlinders ShelbyLoader V2 Attacks: Detection & IOCs
DarkBlinders delivers ShelbyLoader V2 through fake coding assessments and abuses GitHub for C2, with 9 detection rules, 31 IOCs and a free Splunk SPL rule.
Read the full threat intel for DarkBlinders ShelbyLoader V2 Attacks: Detection & IOCs →
Chapters
- 0:00The hookIran state actor hits two targets.
- 0:04The storyRecruitment opened Visual Studio trap, GitHub hosted C2.
- 0:10Attack pathReportedly, recruitment message opened compromised Visual Studio.
- 0:24AttributionAttributed to DarkBlinders.
- 0:28Indicators of compromise26 indicators to hunt: 5 IPs, 12 domains and 8 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques15 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation5 steps now: Block and sinkhole the listed phishing and StarkMeet domains.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Iran state actor hits two targets.
0:05Recruitment opened Visual Studio trap, GitHub hosted C2.
0:11Reportedly, recruitment message opened compromised Visual Studio.
0:15ETW disabled, persistence set, GitHub dead drop.
0:19Blackwood tunnel staged for espionage.
0:24Attributed to DarkBlinders. Confidence: medium.
0:2926 indicators to hunt: 5 IPs, 12 domains and 8 SHA-256 hashes, and more.
0:3815 ATT&CK techniques, from resource development to command and control.
0:445 steps now: Block and sinkhole the listed phishing and StarkMeet domains.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.