Threat video1:00
Exvicy, Graphalgo, RemControl Week 39: Detection & IOCs
Exvicy clones ErrTraffic's ClickFix kit, Graphalgo ships a Go RAT, RemControl hits banking apps. Covers 9 detection rules, 30 IOCs and a free Splunk SPL rule.
Read the full threat intel for Exvicy, Graphalgo, RemControl Week 39: Detection & IOCs →
Chapters
- 0:00The hook4 threats in one week.
- 0:04The storyExvicy copies ErrTraffic's code.
- 0:11Attack pathSekoia reports a malware service panel.
- 0:23AttributionNo threat actor is attributed.
- 0:28Indicators of compromise25 indicators to hunt: 3 IPs, 9 domains and 3 URLs, and more.
- 0:35MITRE ATT&CK techniques9 ATT&CK techniques, from resource development to collection.
- 0:40Remediation5 steps now: Audit Terraform lock files, provider sources and go[.]mod/go[.]sum for gocommunity-io/dockerd.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:004 threats in one week.
0:05Exvicy copies ErrTraffic's code.
0:07Lures ride compromised WordPress sites.
0:11Sekoia reports a malware service panel.
0:14Compromised WordPress sites show a fake Turnstile check.
0:17Victims are tricked into pasting a PowerShell command.
0:23No threat actor is attributed. Confidence: low.
0:2825 indicators to hunt: 3 IPs, 9 domains and 3 URLs, and more.
0:359 ATT&CK techniques, from resource development to collection.
0:405 steps now: Audit Terraform lock files, provider sources and go[.]mod/go[.]sum for gocommunity-io/dockerd.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.