StrikeReady Labs

Something tells me this isn't the real Trusteer
ibmtrusteermobile[.]com/Down/IBMtrusteermobile.apk

If you're an MFA, you're used to getting targeted by DPRK actors. If not, this phish from this morning, may be illustrative of the detection needs --- URL scanning, password cracking, trusted partner spoof detection, leveraging github for c2 without true "exe" malware ...
github.com/StrikeReady-...

Sri Lanka must have gotten a new hosting provider #apt

big run of these customized pass-protected pdf phishes #dailyphish

samples/2025-06-20 susp sandworm at main · StrikeReady-Inc/samples shared samples from #dailyphish and/or #apt tweets - StrikeReady-Inc/samples

smells like sandworm
Лист на повернення предоплати.lnk
Договір _2025.lnk
Укрспецзв_Акт_30_05_25_ДР25_2313_13 від 26_02_2025.lnk
github.com/StrikeReady-...

#dailyphish clearly a red team/authorized phish scenario, but this one is just mean

Learn to hunt apt: flag archives where the extensions contain 3+ of a doc/pdf, lnk, exe, dll, where one is newly seen. The volume will be low enough to eyeball every hit

Stay tuned for next week's advanced lesson -- leveraging Vi to track binaries used to sideload dlls
github.com/StrikeReady-...

#dailyphish #meta

#dailyopendir #malware howwasthetea.ddns[.]net

these types of terrorism threats happen every day to governments, and they have to chase them down. it's ddos, but in real life.

#dailyphish #crimeware if you liked 2FA-themed phishing, you'll love 3FA-themed phishing

#dailyphish #crimeware @vercel.com invoice-8094.vercel[.]app/success.html

Great deep research into "bitter", one of the longer running South Asian APTs

samples/2025-06-03 Riga2025 NATO at main · StrikeReady-Inc/samples shared samples from #dailyphish and/or #apt tweets - StrikeReady-Inc/samples

download here github.com/StrikeReady-...

#apt Targeting Bosnia and Herzegovina
Riga2025.pptm
3476eeb72a6138d75bf7d922062674fb50323f6bdd41b391e846f6f9462398df
-> f6c127a01cadf49b0da0d12b6836c6e12b6a6705ef3b6285a90f4d38038725ff ow123msadmasj41.exe
#dailyphish

#dailyopendir also see adm001-4 #malware

interesting way to drop a malicious .js

interesting apk... "base.apk" b3ca9b9f4ac9701e662e117437b80ed22e00c2792334c8594ed7bf99b034baf3
sends an sms worm ("this subscriber has been hacked")

"脱密 中央国安办.IMG" (Declassified Central National Security Office.img)
ced7fe9c5ec508216e6dd9a59d2d5193a58bdbac5f41a38ea97dd5c7fceef7a5

"gov-pk.pk" hmmmm

#apt
플랜아이 작업계획서 및 작업완료서_기계연 이명화.scr
123aefe0734da130b475bfdad6c3ebe49688569ab8310e71ec5252ec46cb67eb

#apt
a16bbc8acf626a966bec45d1ecac4681dafde23127aabc3ada5ccfc16c02bdb9
news-telephone1.space

#apt
KB국민은행 소명자료 제출 요청의 건_20250430TS5869570S.zip
#dprk
3f92ea810aecf95898fb07293e5fcca3374462638c0ecf86cac86fe3104a6738

#apt
useof. org/my-files/DistributionDocument-90421.pdf.zip
useof. org/my-files/3.PL_PIEC001-L20250227-GLOBAL_ATOP.pdf.zip
0bbbd415060a96c175c7fe7376a8bad40f3a05d84603548c18973cf695af6fac -> 92.119.114.128/ov4_dd_p.rar

dteofmediapsyops. army-lk. com

#apt #phishing
Caution Against Propaganda and Misinformation Campaigns. zip
66d285ad9df2d14ce57a86568eb382c4a4cb31fe917dacd9ade1da46860a203a

#apt
Action Plan 2025 and the Strategic Plan for the period 2025-2029.docx
558de2a01fbd76be171561c3c82fd6a8e2d4c913444850af99d44a4cfb41b680
www-presidentsoffice-gov-lk.dwnlld.com

#apt PMYP Sub Domains.rar
d41c86bf77f83ae42b97ffa8d9b01d510711f4bac59fbf91feacd59abaa9861a -> ntplugnplay. com/jb5.php

#dailyopendir #malware #msc

don't often see phishing in hebrew #dailyphish