Updated 2023-12-15-IOCs-for-TA577-Pikabot-infection.txt

PaloAltoNetworks · Dec 15, 2023 · 3a0ddb8 · 3a0ddb8
1 parent 3c34049
commit 3a0ddb8
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/2023-12-15-IOCs-for-TA577-Pikabot-infection.txt b/2023-12-15-IOCs-for-TA577-Pikabot-infection.txt
@@ -1,5 +1,10 @@
 2023-12-15 (FRIDAY): TA577 PIKABOT INFECTION
 
+REFERENCES:
+
+- https://www.linkedin.com/posts/unit42_ta577-pikabot-timelythreatintel-activity-7141526098479149056-6DCW
+- https://twitter.com/Unit42_Intel/status/1735760477391552670
+
 INFECTION CHAIN OF EVENTS:
 
 - TA577 email --> link --> downloaded zip --> js file --> retrieves and runs Pikabot DLL --> Pikabot C2
@@ -69,4 +74,4 @@ PIKABOT C2 TRAFFIC:
 - 139.99.222[.]29 port 5631 - attempted TCP connections
 - 141.95.108[.]252 port 2078 - HTTPS traffic
 - 154.211.12[.]126 port 2967 - HTTPS traffic
-- 172.232.173[.]141 port 2226 - HTTPS traffic
+- 172.232.173[.]141 port 2226 - HTTPS traffic