# Community Review - April 8, 2024 **URL:** \ **Category:** Announcements\ **Created:** [April 8, 2024, 5:00am UTC](https://community.emergingthreats.net/t/community-review-april-8-2024/1551 "2024-04-08T05:00:00Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [April 8, 2024, 5:00am UTC](https://community.emergingthreats.net/t/community-review-april-8-2024/1551/1 "2024-04-08T05:00:00Z")
Greetings all - time for some shout-outs to those researchers, industry partners, and public intel disclosures that’ve helped us research, analyze, and write our #IDS rules for #snort and #suricata as part of #etopen! Here’s only a few that’ve contributed… From @[BlackLotusLabs](https://twitter.com/BlackLotusLabs), their writeup on #TheMoon malware targeting EoL’d home networking equipment and IoT devices - SID 2051806 fires on an outbound checkin from a compromised device - byte patterened modeled from network traffic showcased in the blog: > **[The Darkside of TheMoon - Lumen](https://blog.lumen.com/the-darkside-of-themoon/)** > > Executive Summary The Black Lotus Labs team at Lumen Technologies has identified a multi-year campaign targeting end-of-life (EoL) small home/small office (SOHO) routers and IoT devices, associated with an updated version of “TheMoon” malware.... SID 2051842 comes from this @[cyfirma](https://twitter.com/cyfirma) research for #Sync-#Scheduler #Stealer activity - data is exfiltrated in the #POST request in the form of ‘form-data’ to the malicious receiver site. ![2051842 fire](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/2X/d/dbb22c98a588ae08a178a44c2ca24f6cf374c016.png) Our friend @Jane0sint tips #Konni #APT exfiltration domains in this tweet and @anyrun\_app sandbox share - SIDs 2051888 and 2051889 for DNS query alert and the TLS handshake to host will fire! > > > ANY.RUN @anyrun\_app An @[eSentire](https://twitter.com/eSentire) #parallax #checkin is modeled for alerting in SID 2051947 - our reference samples for this cracked #RAT alert on its outbound traffic. > **[Unveiling Parallax RAT: A Journey from Infection to Lateral Movement](https://www.esentire.com/blog/unveiling-parallax-rat-a-journey-from-infection-to-lateral-movement)** > > Learn more about the Parallax RAT (Remote Access Trojan) and get security recommendations from our Threat Response Unit (TRU) to protect your business from this cyber threat.  And lastly, a couple shout-outs on the homefront - This @[threatinsight](https://twitter.com/threatinsight) blog not only features valuable threat research on #Latrodectus #loader activity as identified within email threat campaigns, but the referenced #etopen signatures (on domains, GET/POST, and other related activity) will help you keep you alerted to this activity within your protected networks. > **[Latrodectus: This Spider Bytes Like Ice  | Proofpoint US](https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice)** > > Proofpoint’s Threat Research team joined up with the Team Cymru S2 Threat Research team, in a collaborative effort to provide the information security community with a comprehensive view of the thr... And (literally) even closer to home - beware of game cracks hawked on youtube - the @[threatinsight](https://twitter.com/threatinsight) team has identified multiple cases where channels are promoted quick-wins via cracks and pirated that end up in #vidar and #Lumma #stealer #malware infections! Check out the referenced #etopen SIDs as well! > **[Threat Actors Deliver Malware via YouTube Video Game Cracks  |...](https://www.proofpoint.com/us/blog/threat-insight/threat-actors-deliver-malware-youtube-video-game-cracks)** > > Key takeaways  Proofpoint identified multiple YouTube channels distributing malware by promoting cracked and pirated video games and related content.  The video descriptions include links leading t... Thanks all for us folks - have a great week.