[***] Summary: [***]
9 new OPEN, 10 new PRO (9 + 1) Oscorp/UBEL, SideCopy, and IRS Theme Cred
Phishing.
Please note that there will be no signature release tomorrow (Friday, Aut
6th) due to a company holiday.
Please share issues, feedback, and requests at
https://feedback.emergingthreats.net/feedback
[+++] Added rules: [+++]
Open:
2033672 - ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (quantumbots
.xyz in TLS SNI) (mobile_malware.rules)
2033673 - ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (marcobrando
.xyz in TLS SNI) (mobile_malware.rules)
2033674 - ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (montanatony
.xyz in TLS SNI) (mobile_malware.rules)
2033675 - ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (smoothcbots
.xyz in TLS SNI) (mobile_malware.rules)
2033676 - ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (omegabots
.xyz in TLS SNI) (mobile_malware.rules)
2033677 - ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (gogleadser
.xyz in TLS SNI) (mobile_malware.rules)
2033678 - ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (callbinary
.xyz in TLS SNI) (mobile_malware.rules)
2033679 - ET MOBILE_MALWARE Oscorp/UBEL Activity (mobile_malware.rules)
2033680 - ET TROJAN SideCopy Group Activity (GET) (trojan.rules)
Pro:
2849553 - ETPRO CURRENT_EVENTS Successful IRS Themed Credential Phish
2021-08-05 (current_events.rules)
[///] Modified active rules: [///]
2033658 - ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M2
(trojan.rules)