THREATOPS

THREAT OPS › Threat News › StormBamboo Compromises ISP to Abuse Insecure Software Update Mechanisms

StormBamboo Compromises ISP to Abuse Insecure Software Update Mechanisms

lowvolexityPublished 2024-08-02

<p></p> <div style="display: none;"> <section class="mgpb-hero mgpb-hero--detail mgpb-hero--black mgpb-hero--background-image mgpb-hero--image"> <div class="mgpb-hero__image mgpb-hero__image--background"> <img alt="" class="attachment-16-9-large size-16-9-large" height="1080" src="https://www.volexity.com/wp-content/uploads/2024/08/Volexity-StormBamboo-Compromise

Attributed threat actors

DaggerflyG1034

MITRE ATT&CK techniques

Adversary-in-the-MiddleT1557
IP AddressesT1590.005
JavaScriptT1059.007
Malicious FileT1204.002
AppleScriptT1059.002

Indicators of compromise

ee28b3137d65d74c0234eea35fa536afmd5
6abf9a7926415dc00bcb482456cc9467md5
https://malpedia.caad.fkie.fraunhofer.de/details/win.mgboturl
https://www.5kplayer.com/url
https://obfuscator.io/url
103.96.130.107ipv4
122.10.90.20ipv4
www.msftconnecttest.comdomain

Original source: https://www.volexity.com/blog/2024/08/02/stormbamboo-compromises-isp-to-abuse-insecure-software-update-mechanisms/