Just Another Blue Teamer<p>Happy Monday everyone!</p><p>The AhnLab, Inc. Security Intelligence Center (ASEC) has been monitoring infostealer malware that is disguised as illegal software and keygens and found that most of the malware that is distributed in this manner has been the <a href="https://ioc.exchange/tags/LummaC2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>LummaC2</span></a> infostealer BUT there has been an increase in distribution of the <a href="https://ioc.exchange/tags/ACRStealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ACRStealer</span></a> as well. What is pretty interesting is the technique they use for C2. In this case they have used Steam, telegra.ph, Google Docs (Form) and Google Docs (Presentation). Enjoy and Happy Hunting!</p><p>ACRStealer Infostealer Exploiting Google Docs as C2<br><a href="https://asec.ahnlab.com/en/86390/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">asec.ahnlab.com/en/86390/</span><span class="invisible"></span></a></p><p>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatHunting</span></a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatDetection</span></a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HappyHunting</span></a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>readoftheday</span></a></p>