Threat video1:00
Exvicy ClickFix Copycat of ErrTraffic: Detection & IOCs
Exvicy copies ErrTraffic's ClickFix code and spreads through compromised WordPress sites. 9 detection rules, 29 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for Exvicy ClickFix Copycat of ErrTraffic: Detection & IOCs →
Chapters
- 0:00The hookAbout 80 hosts serve Exvicy.
- 0:04The storySold as a service since May.
- 0:11Attack pathDomains get registered, WordPress sites compromised.
- 0:26AttributionAttributed to Exvicy.
- 0:31Indicators of compromise28 indicators to hunt: 8 IPs, 19 domains and 1 URL.
- 0:37MITRE ATT&CK techniques9 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation4 steps now: Block and hunt for Exvicy C2 domains and IPs listed.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 80 hosts serve Exvicy.
0:05Sold as a service since May.
0:07Customer hosts contact its servers.
0:11Domains get registered, WordPress sites compromised.
0:14A script shows a fake Turnstile lure.
0:17The victim runs the pasted command.
0:19An MSI installs PuTTY, giving a remote shell.
0:26Attributed to Exvicy. Confidence: low.
0:3128 indicators to hunt: 8 IPs, 19 domains and 1 URL.
0:389 ATT&CK techniques, from resource development to command and control.
0:434 steps now: Block and hunt for Exvicy C2 domains and IPs listed.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.