Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
August 18, 2023
Severity High Analysis Summary Since April 2023, an ongoing phishing campaign has been actively targeting Zimbra Collaboration email servers globally, as reported by researchers. The campaign […]August 18, 2023
Severity High Analysis Summary Russian threat actors are reportedly involved in an ongoing campaign that targets the foreign affairs ministries of NATO-aligned nations. This campaign employs […]August 18, 2023
Severity High Analysis Summary Shuckworm APT – aka Actinium, Armageddon, Primitive Bear, Gamaredon, and Trident Ursa – is a Russia-backed advanced persistent threat (APT) that has […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
August 18, 2023
Severity High Analysis Summary Since April 2023, an ongoing phishing campaign has been actively targeting Zimbra Collaboration email servers globally, as reported by researchers. The campaign […]August 18, 2023
Severity High Analysis Summary Russian threat actors are reportedly involved in an ongoing campaign that targets the foreign affairs ministries of NATO-aligned nations. This campaign employs […]August 18, 2023
Severity High Analysis Summary Shuckworm APT – aka Actinium, Armageddon, Primitive Bear, Gamaredon, and Trident Ursa – is a Russia-backed advanced persistent threat (APT) that has […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Rewterz Threat Alert – Windows and macOS Systems Targeting By An Iran-Linked APT; TA453 – Active IOCs
July 10, 2023
Rewterz Threat Advisory – CVE-2023-37450 – Apple iOS, iPadOS and macOS Ventura Vulnerability
July 10, 2023
Severity
High
Analysis Summary
SolarMarker, also known as Jupyter or Yellow Cockatoo, is a sophisticated and concerning infostealer malware that emerged in early 2021. It spreads through phishing emails containing malicious attachments or links, and once installed on a system, it collects sensitive information and transmits it to attackers. SolarMarker’s primary objective is to steal login credentials, personal data, and financial information from its victims.
The malware employs various techniques to achieve its goals, including keylogging, form grabbing, and screen capturing. By capturing keystrokes and monitoring web browsing activities, SolarMarker gains access to sensitive data entered by users. It also utilizes obfuscation and anti-analysis techniques to evade detection by security tools.
One notable feature of SolarMarker is its ability to propagate within a network, potentially compromising multiple devices and entire infrastructures. This poses a significant threat to businesses and enterprises.
To protect against SolarMarker and similar threats, it is crucial to implement robust cybersecurity measures. These include keeping software and systems up to date, using strong and unique passwords, deploying reliable anti-malware solutions, and providing user education on phishing and online safety practices.
Impact
- Sensitive Information Theft
- Credential Theft
Indicators of Compromise
IP
146.70.157.224
MD5
- eff4dee32ca0f188b0f6ebe24799a489
SHA-256
- 278ec8f7a0cd969ebb84e72f60f19bb6f6fd6f7268ebe68245c46e6de2a43cf1
SHA-1
- d3980fba6bf04a63567954fa7ce8b645fc20367c
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Emails from unknown senders should always be treated with caution.
- Never trust or open links and attachments received from unknown sources/senders.
- Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
- Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.