Threat video1:00
Bottle Exploit Kit Japan Malvertising: Detection & IOCs
Bottle EK exploits IE and Flash for Japanese users, and Operation Overtrap used it to drop Cinobi. 9 detection rules, 23 IOCs and a free Splunk SPL rule.
Read the full threat intel for Bottle Exploit Kit Japan Malvertising: Detection & IOCs →
Chapters
- 0:00The hookBanking kit targets Japan, Internet Explorer.
- 0:04The storySeptember: Japan-targeted malvertising campaign begins.
- 0:12Attack pathMalvertising loads browser exploits.
- 0:26AttributionNo threat actor is attributed.
- 0:30Indicators of compromise17 indicators to hunt: 2 IPs, 4 domains and 8 SHA-256 hashes, and more.
- 0:39MITRE ATT&CK techniques11 ATT&CK techniques, from execution to command and control.
- 0:44Remediation4 steps now: Block priv[.]inteleksys[.]com, sales[.]inteleksys[.]com.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Banking kit targets Japan, Internet Explorer.
0:05September: Japan-targeted malvertising campaign begins.
0:09Later: Banking trojan Cinobi spreads.
0:12Malvertising loads browser exploits.
0:15Checks for Japanese Explorer.
0:17Decodes stealer, drops to disk.
0:19Downloads Tor executable, connects to onion.
0:22Injects into browser, steals data.
0:27No threat actor is attributed. Confidence: low.
0:3117 indicators to hunt: 2 IPs, 4 domains and 8 SHA-256 hashes, and more.
0:3911 ATT&CK techniques, from execution to command and control.
0:444 steps now: Block priv[.]inteleksys[.]com, sales[.]inteleksys[.]com.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.