The Sekoia TDR team delved into the deep secrets and operations of #PikaBot.
Our lastest report provides insights resulting from the PikaBot reverse engineering.
Aditionally, this report shares technical details on tracking its C2 infrastructure.
https://blog.sekoia.io/pikabot-a-guide-to-its-deep-secrets-and-operations/
Today we celebrate a major cybersecurity victory. 
Operation Endgame, a global law enforcement effort supported by insights from experts at Proofpoint and other industry vendors, resulted in:
• The disruption of major botnets
• Four arrests
• Over 100 servers taken down across 10 countries
• Over 2,000 domains brought under the control of law enforcement
• Illegal assets frozen
Proofpoint’s mission is to provide the best human-centric protection for our customers against advanced threats. Whenever possible and appropriate to do so, Proofpoint uses its team’s knowledge and skills to help protect a wider audience against widespread malware threats.
For #OperationEndgame, Proofpoint threat researchers lent their expertise in reverse engineering malware, botnet infrastructure, and identifying patterns in how the threat actors set up their servers to help authorities understand the malware and safely remediate the bot clients.
Proofpoint’s unmatched threat telemetry and researcher knowledge played a crucial role in the operation, providing key insights in identifying the new botnets that are most likely to grow and become the dominant threats affecting the most number of people around the world.
More information on the takedown and Proofpoint’s involvement can be found in our blog: https://www.proofpoint.com/us/blog/threat-insight/major-botnets-disrupted-global-law-enforcement-takedown.
We are proud to announce that Sekoia #TDR team contributed to the joint international law enforcement operation #OperationEndgame, targeting the notorious botnets #IcedID, #Smokeloader, #SystemBC and #Pikabot
Operazione Endgame: Europol Demolisce Le Reti Botnet e Dropper e Arresta i Cybercriminali
Tra il 27 e il 29 maggio 2024 l’operazione #Endgame, coordinata dal quartier generale di #Europol, ha preso di mira i dropper tra cui #IcedID, #SystemBC, #Pikabot, #Smokeloader, #Bumblebee e #Trickbot.
#redhotcyber #online #it #ai #hacking #innovation #privacy #cybersecurity #technology #engineering #cybercrime #intelligence #intelligenzaartificiale #informationsecurity #ethicalhacking #dataprotection #cybersecurityawareness #cybersecuritytraining #cybersecuritynews #infosecurity
We are proud to announce that we assisted the joint international law enforcement operation #OperationEndgame, targeting the notorious botnets #IcedID, #Smokeloader, #SystemBC and #Pikabot 
abuse.ch has provided key infrastructure to LEA and internal partners to disrupt these botnet operations 
More information on the operation is available here:
https://operation-endgame.com/
#IcedID, #Smokeloader, #SystemBC, #Pikabot and #Bumblebee botnets have been disrupted by Operation Endgame!! This is the largest operation EVER against botnets involved with ransomware, with gargantuan thanks to a coordinated effort led by international agencies
As with the #Qakbot and #Emotet takedowns, Spamhaus are again providing remediation support - those affected will be contacted from today with steps to take.
For more information, read our write-up here: https://www.spamhaus.org/resource-hub/malware/operation-endgame-botnets-disrupted-after-international-action/
Zscaler identified Pikabot malware loader's string obfuscation algorithm. They describe the algorithm and their approach to decrypt the binary strings using IDA's microcode. They developed an IDA plugin to automatically decrypt Pikabot's obfuscated strings and released the source code. IOC provided. 
https://www.zscaler.com/blogs/security-research/automating-pikabot-s-string-deobfuscation
TA577 sotto i riflettori: la nuova minaccia del phishing per rubare hash NTLM
Il gruppo noto come #TA577, identificato come un initial access broker (#IAB) e precedentemente associato a Qbot e al #ransomware #BlackBasta, ha recentemente modificato le sue tattiche operative.
Sebbene in passato TA577 abbia mostrato una preferenza per l’implementazione di #Pikabot, due recenti ondate di #attacco hanno rivelato una strategia diversa.
Condividi questo post se hai trovato la news interessante.
#redhotcyber #online #it #web #ai #hacking #privacy #cybersecurity #cybercrime #intelligence #intelligenzaartificiale #informationsecurity #ethicalhacking #dataprotection #cybersecurityawareness #cybersecuritytraining #cybersecuritynews #infosecurity
New blog post! In this one I look at a Java-based dropper for Pikabot that TA577 used in mid-February 2024.
https://forensicitguy.github.io/dissecting-java-pikabot-dropper/
#malware #pikabot #ta577
From a post I wrote for my employer, posted at https://www.linkedin.com/posts/unit42_ta577-pikabot-unit42threatintel-ugcPost-7161507002416836610-YOYy and https://twitter.com/Unit42_Intel/status/1755741384982561175
2024-02-08 (Thursday): #TA577 #Pikabot activity. IOCs from an infection run available at https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2024-02-08-IOCs-from-TA577-Pikabot-infection.txt
A #pcap of the infection traffic and the associated malware samples is available at https://malware-traffic-analysis.net/2024/02/08/index.html
Nouveau malware alerte! Pikabot, identifié pour la première fois en février 2023, est un logiciel malveillant sophistiqué qui échappe à la détection et à l'analyse grâce à ses techniques de furtivité avancées. 
Distribué principalement via des campagnes de malspam et de malvertising, il évite les systèmes liés à la Russie et pourrait avoir des liens avec le maliciel Matanbuchus. 
Méfiez-vous des emails piégés et des fausses publicités, car Pikabot est associé à des cyberattaques et au ransomware Black Basta. #CyberSécurité #Malware #Pikabot
https://www.lemagit.fr/conseil/Maliciel-a-la-decouverte-de-Pikabot
From a post I wrote for my employer at https://www.linkedin.com/posts/unit42_ta577-pikabot-timelythreatintel-activity-7141526098479149056-6DCW and https://twitter.com/Unit42_Intel/status/1735760477391552670
2023-12-15 (Friday): #TA577 pushing #Pikabot again this week. Here are IOCs from an infection run we generated today: https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-12-15-IOCs-for-TA577-Pikabot-infection.txt
A carved #pcap of the infection traffic and the associated malware samples are available at https://www.malware-traffic-analysis.net/2023/12/15/index.html
From a post I authored for my employer at https://www.linkedin.com/posts/unit42_ta577-pikabot-unit42threatintel-activity-7126273089293713408-OBp1 and https://twitter.com/Unit42_Intel/status/1720507470290801122
2023-11-02 (Thursday) - Like many others, we've also seen #TA577 #Pikabot activity throughout this week. We collected indicators of compromise (IOCs) from a 10 hour infection run. List of IOCs available at https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-11-02-IOCs-for-TA577-Pikabot-activity.txt
A #pcap of the 10 hour Pikabot infection run, associated malware samples, and copies of the exported registry updates are available at https://www.malware-traffic-analysis.net/2023/11/02/index.html
Post I wrote for my employer at https://twitter.com/Unit42_Intel/status/1714375817491353966 and https://www.linkedin.com/posts/unit42_ta577-pikabot-cobaltstrike-activity-7120141441103794177-lKee
2023-10-17 (Tuesday): #TA577 #Pikabot infection with HTTPS #CobaltStrike traffic on 45.155.249[.]171:443 using ponturded[.]com.
Thanks to the @cryptolaemus1 group on for their initial post on today's Pikabot activity! IOCs from our infection run available at https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-17-IOCs-for-TA577-Pikabot-infection.txt
#pcap of the infection traffic, along with the associated malware and artifacts are available at https://www.malware-traffic-analysis.net/2023/10/17/index.html
Tweet I wrote for my employer at the bird site: https://twitter.com/Unit42_Intel/status/1659199751265595392
2023-05-17 (Wednesday): Today, this week's BB28 #Qakbot-style distribution chain pushed #Pikabot instead of Qakbot. Followed up with #CobaltStrike using #DNSTunneling. We later saw additional Cobalt Strike traffic over HTTPS. List of IOCs available at https://github.com/pan-unit42/tweets/blob/master/2023-05-17-IOCs-for-Pikabot-with-Cobalt-Strike.txt
A carved #pcap of the infection traffic (removed everything not related to the #Pikabot & #CobaltStrike) and the associated malware/registry updates available at https://malware-traffic-analysis.net/2023/05/17/index.html
