[***] Summary: [***]
5 new OPEN, 16 new PRO (5 + 11). Lazarus APT, Various Phishkit, Raccoon Stealer.
Thanks: @ShadowChasing1, @JCyberSec_
Proofpoint is looking to hire a Product Manager to oversee the Emerging Threats products group. Interested? Check out the posting here<https://proofpoint.wd5.myworkdayjobs.com/ProofpointCareers/job/Sunnyval…;, and reach out with any questions.
Please share issues, feedback, and requests at https://feedback.emergingthreats.net/feedback
[+++] Added rules: [+++]
Open:
2034187 - ET TROJAN Suspected Lazarus APT Related Activity (GET) (trojan.rules)
2034188 - ET CURRENT_EVENTS Generic Phishkit Activity (GET) (current_events.rules)
2034189 - ET CURRENT_EVENTS Generic Phishkit Landing Page M1 (current_events.rules)
2034190 - ET CURRENT_EVENTS Generic Phishkit Landing Page M2 (current_events.rules)
2034191 - ET CURRENT_EVENTS Generic Phishkit Landing Page M3 (current_events.rules)
Pro:
2850190 - ETPRO CURRENT_EVENTS Generic Phishkit Activity (POST) M1 (current_events.rules)
2850191 - ETPRO TROJAN Win32.Raccoon Stealer Checkin Response M3 (trojan.rules)
2850192 - ETPRO INFO Observed Honeypot Validation M1 (info.rules)
2850193 - ETPRO INFO Observed Honeypot Validation M2 (info.rules)
2850194 - ETPRO TROJAN Win32.Raccoon Stealer Checkin M4 (trojan.rules)
2850195 - ETPRO TROJAN Win32.Raccoon Stealer - Telegram Mirror Checkin (telemirror .top) (trojan.rules)
2850196 - ETPRO TROJAN Win32.Raccoon Stealer - Telegram Mirror Checkin (tgmirror .top) (trojan.rules)
2850197 - ETPRO TROJAN Win32.Raccoon Stealer - Telegram Mirror Checkin (telegatt .top) (trojan.rules)
2850198 - ETPRO TROJAN Win32.Raccoon Stealer - Telegram Mirror Checkin (telegka .top) (trojan.rules)
2850199 - ETPRO TROJAN Win32.Raccoon Stealer - Telegram Mirror Checkin (telegin .top) (trojan.rules)
2850200 - ETPRO TROJAN Win32.Raccoon Stealer - Telegram Mirror Checkin (t .me) (trojan.rules)
[///] Modified active rules: [///]
2845585 - ETPRO TROJAN Win32.Raccoon Stealer - Telegram Mirror Checkin (telete .in) (trojan.rules)
2849100 - ETPRO TROJAN Win32.Raccoon Stealer - Telegram Mirror Checkin (tttttt .me) (trojan.rules)