Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 989692" data-attributes="member: 32260">SWH vs. SocGholish[URL unfurl=&quot;true&quot;]https://www.cybereason.com/blog/threat-analysis-report-socgholish-and-zloader-from-fake-updates-and-installers-to-owning-your-systems[/URL]According to the Red Canary’s 2022 Threat Detection Report, this threat is among the most prevalent threats:[ATTACH=full]266821[/ATTACH]The cases of SWH vs. Qbot (Quakbot) and Gootkit (Gootloader) can be found here:[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/simple-windows-hardening.102265/post-978585[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/simple-windows-hardening.102265/post-971785[/URL]The difference between GootLoader and Gootkit (not important in this post):[URL unfurl=&quot;false&quot;]https://redcanary.com/blog/gootloader/[/URL]I will try to post about other prevalent threats like TA551 in my next post.SocGholish and&nbsp; Gootkit used a similar infection chain:[URL unfurl=&quot;false&quot;]https://redcanary.com/threat-detection-report/threats/socgholish/[/URL][URL unfurl=&quot;false&quot;]https://redcanary.com/threat-detection-report/threats/gootkit/[/URL][ATTACH=full]266822[/ATTACH]SWH can block this threat by default via SRP restrictions for scripts.</blockquote>

[QUOTE="Andy Ful, post: 989692, member: 32260"] [B][SIZE=5]SWH vs. SocGholish[/SIZE][/B] [URL unfurl="true"]https://www.cybereason.com/blog/threat-analysis-report-socgholish-and-zloader-from-fake-updates-and-installers-to-owning-your-systems[/URL] According to the Red Canary’s 2022 Threat Detection Report, this threat is among the most prevalent threats: [ATTACH type="full" alt="1653237375621.png"]266821[/ATTACH] The cases of SWH vs. Qbot (Quakbot) and Gootkit (Gootloader) can be found here: [URL unfurl="false"]https://malwaretips.com/threads/simple-windows-hardening.102265/post-978585[/URL] [URL unfurl="false"]https://malwaretips.com/threads/simple-windows-hardening.102265/post-971785[/URL] The difference between GootLoader and Gootkit (not important in this post): [URL unfurl="false"]https://redcanary.com/blog/gootloader/[/URL] I will try to post about other prevalent threats like TA551 in my next post. SocGholish and Gootkit used a similar infection chain: [URL unfurl="false"]https://redcanary.com/threat-detection-report/threats/socgholish/[/URL] [URL unfurl="false"]https://redcanary.com/threat-detection-report/threats/gootkit/[/URL] [ATTACH type="full" alt="1653237539311.png"]266822[/ATTACH] [B][COLOR=rgb(0, 168, 133)]SWH can block this threat by default via SRP restrictions for scripts.[/COLOR][/B] [/QUOTE]

Verification