PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 3)

blog.viettelcybersecurity.com | blog | #apt | #malware-analysis | #api-hashing | #lotus-blossom | #signloader | #dll-sideloading
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part 3 of Viettel's Lotus Blossom series dissects SignLoader: DLL sideloading via a Bitdefender module, anti-analysis (junk code, exception abuse, Carbanak API hashing), and payload decryption.
Published
Collected

Related coverage

blog · blog.viettelcybersecurity.com
Chiến dịch tấn công mới của nhóm Lotus Blossom: Kỹ thuật Domain Fronting và Lợi dụng các hệ thống quản trị tập trung (Phần 3)
Vietnamese Part 3 of Viettel's Lotus Blossom series analyzes the SignLoader malware: DLL sideloading via a Bitdefender module, anti-analysis tricks (API hashing, junk code), and payload decryption.
vulnerability · blog.viettelcybersecurity.com
[CVE-2023-38831] Cảnh báo chiến dịch tấn công của nhóm APT Darkpink nhắm vào các nước Đông Nam Á
Viettel links a Vietnamese-language decoy campaign to Darkpink: it abuses WinRAR CVE-2023-38831 with DLL sideloading and persists PowerShell payloads via registry and shortcut persistence.
blog · blog.viettelcybersecurity.com
Chiến dịch tấn công mới của nhóm Lotus Blossom: Kỹ thuật Domain Fronting và Lợi dụng các hệ thống quản trị tập trung (Phần 2)
Part 2 of Viettel's Lotus Blossom series explains Domain Fronting, showing how attackers abuse CDN behavior to make C2 traffic resemble legitimate connections by mismatching TLS SNI and Host headers.
blog · blog.viettelcybersecurity.com
Chiến dịch tấn công mới của nhóm Lotus Blossom: Kỹ thuật Domain Fronting và Lợi dụng các hệ thống quản trị tập trung (Phần 1)
Vietnamese Part 1 overviews the Lotus Blossom APT, active in Southeast Asia since 2012, now using leaked VPN accounts, OTT-app phishing, abused IT management systems, and Domain Fronting to hide C2.
blog · blog.viettelcybersecurity.com
Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 2)
English Part 2 of the Lotus Blossom series explains Domain Fronting: how abusing CDN behavior and mismatching TLS SNI with the Host header lets C2 traffic look like legitimate connections.
blog · blog.viettelcybersecurity.com
Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 1)
Part 1 of the English Lotus Blossom series overviews the APT active in Southeast Asia since 2012: leaked VPN accounts, OTT-app phishing, abused IT management systems, and Domain Fronting to hide C2.
Back