Threat video1:00
Imperial Kitten TWOSTROKE Toolset: Detection & IOCs
Imperial Kitten spearphishes aerospace and defense staff with job lures. 9 detection rules, 30 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for Imperial Kitten TWOSTROKE Toolset: Detection & IOCs →
Chapters
- 0:00The hookIranian spies target aerospace and defense.
- 0:04The storySince 2017, fake recruiters lure.
- 0:11Attack pathFake career portals deliver a ZIP.
- 0:24AttributionAttributed to Bohrium.
- 0:29Indicators of compromise30 indicators to hunt: 6 IPs, 16 domains and 5 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques24 ATT&CK techniques, from reconnaissance to command and control.
- 0:43Remediation6 steps now: Block and alert on the listed domains, IPs and file.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Iranian spies target aerospace and defense.
0:05Since 2017, fake recruiters lure.
0:08Compromised vendor logins open doors.
0:12Fake career portals deliver a ZIP.
0:14Vendor logins reach desktops, then hosts.
0:17Backdoors may beacon to Azure for months.
0:20Then domain credentials are stolen.
0:25Attributed to Bohrium. Confidence: medium.
0:2930 indicators to hunt: 6 IPs, 16 domains and 5 SHA-256 hashes, and more.
0:3824 ATT&CK techniques, from reconnaissance to command and control.
0:446 steps now: Block and alert on the listed domains, IPs and file.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.