Discover and read the best of Twitter Threads about #EnvyScout
Most recents (1)
Today we are releasing a new blog and technical information regarding TTPs & new malware families observed during previously disclosed #NOBELIUM phishing campaigns we have observed/tracked since as early as Jan 2021.
microsoft.com/security/blog/…
Thread on the new families & TTPs ⬇️
microsoft.com/security/blog/…
Thread on the new families & TTPs ⬇️
Notable new malware families:
#EnvyScout: HTML/JS dropper, drops a next-stage ISO file
#BoomBox: Downloader, downloads #VaporRage and #NativeZone from Dropbox
#VaporRage: Shellcode downloader
#NativeZone: Loader observed to load VaprorRage and Cobalt Strike stage shellcode
#EnvyScout: HTML/JS dropper, drops a next-stage ISO file
#BoomBox: Downloader, downloads #VaporRage and #NativeZone from Dropbox
#VaporRage: Shellcode downloader
#NativeZone: Loader observed to load VaprorRage and Cobalt Strike stage shellcode
#EnvyScout de-obfuscates an embedded ISO file & uses code from FileServer JS to save the ISO to disk. It contains potential tracking & credential-harvesting URLs. Some variants of EnvyScout contain execution guardrails that utilize recon data previously collected by Firebase JS. 
