Threat video1:00
ShinyHunters Brand War, Forged PGP: Detection & IOCs
Rival ShinyHunters factions reuse download servers and forge PGP signatures. 9 detection rules, 21 IOCs and a free Splunk SPL rule.
Read the full threat intel for ShinyHunters Brand War, Forged PGP: Detection & IOCs →
Chapters
- 0:00The hookThree arrests spark ShinyHunters faction war.
- 0:05The storySeptember arrests split ShinyHunters.
- 0:11Attack pathThree factions share the same download servers and forged signatures.
- 0:25AttributionAttributed to ShinyHunters.
- 0:30Indicators of compromise9 indicators to hunt: 4 IPs, 2 domains and 1 hash, and more.
- 0:37MITRE ATT&CK techniques7 ATT&CK techniques, from resource development to impact.
- 0:42Remediation3 steps now: Block or alert.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Three arrests spark ShinyHunters faction war.
0:05September arrests split ShinyHunters.
0:08Three factions fight for the brand.
0:12Three factions share the same download servers and forged signatures.
0:16Then they auction the same data under different brands.
0:25Attributed to ShinyHunters. Confidence: medium.
0:309 indicators to hunt: 4 IPs, 2 domains and 1 hash, and more.
0:377 ATT&CK techniques, from resource development to impact.
0:423 steps now: Block or alert.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.