The IT Nerd

The Weekly Threat Intelligence Report from David Brunsdon, Threat Intelligence Security Engineer with HYAS, is a (curated) analysis of what the threat intel team has seen within the HYAS Insight threat intelligence and investigation platform this past week and deemed the most significant to report externally. It names the most prominent malware families active over the last week, as well as the top C2-generating locations worldwide for the week. 

Analysis by Adam Lopez, Director of Solutions Engineering at HYAS:

   “Reviewing the top ASNs and malware origins generating C2 communications reveals involvement of ISPs from South Korea (AS9318), Italy (AS8968), the UK (AS216309 and AS216319), and Japan (AS7684), which underscores the global nature of cybersecurity threats. Malware does not discriminate by geography, affecting ISPs worldwide, indicating the pervasive risk across different network infrastructures. A recurring theme is the presence of malware activity despite the ISPs’ reputations for quality service. 

   “This suggests that even well-managed networks can become vectors for malware dissemination, highlighting the importance of constant vigilance, sophisticated monitoring, and robust security protocols to detect and mitigate threats. 

   “The identification of specific malware families (Amadey, Redline, Urelas, Sality, Stealc) indicates a range of cyber threats, from information stealers to polymorphic viruses, showcasing the complexity and adaptability of cyber adversaries. The diversity of these threats necessitates a multifaceted security approach, combining technical, procedural, and educational strategies to counteract them effectively.”

The full HYAS Threat Intel Report April 1, 2024, is linked above and is very much worth reading.

HYAS Infosec, the adversary infrastructure platform provider that offers unparalleled visibility, protection, and security against all kinds of malware and attacks, today announced the launch of its free HYAS Insight Intel Feed.

HYAS leverages data from diverse authoritative sources, including exclusive, private, and commercial datasets, to provide organizations with unparalleled insights into emerging threats. By offering this invaluable resource at no cost, HYAS aims to empower security teams to detect, mitigate, and better defend against cyber threats and safeguard organizational assets.

Bridging the Threat Intel Gap

Unlike conventional intelligence feeds, which often lack context and actionable insights, the intelligence generated by the HYAS Adversary Infrastructure Platform delivers concentrated and actionable intelligence on specific malware families and associated infrastructure. This unique approach enables security operations centers (SOCs), cyber threat intelligence (CTI) teams, and fraud investigation units to readily identify and respond to emerging threats effectively.

The HYAS Insight Intel Feed incorporates information on IP addresses, domains, and other forms of infrastructure leveraged by threat actors to orchestrate malicious activities. By providing timely and relevant insights into exploited infrastructure, HYAS enables organizations to enhance their security posture and proactively mitigate risks. HYAS ensures the continual validation, prioritization, and enrichment of its free intelligence feed providing users timely and proactive insights to bolster organizational security effectively.

Driving Operational Excellence

The free HYAS Insight Intel Feed caters to a wide range of use cases, including:

• Intelligence enrichment and improved context for SOAR, TIP, and threat intel management programs
• Real-time IOC/observables for detection and blocklisting
• SIEM event correlation and analysis
• Improves SOC teams’ triage process, incident response, and threat hunting
• Provides cyber threat intelligence (CTI) teams previously unavailable insight and analysis
• Gives fraud teams meaningful, powerful new investigative abilities 

Register for the Feed

Access the free HYAS Insight Intel Feed