# Weekly Community Review - April 7, 2023 **URL:** \ **Category:** Announcements\ **Created:** [April 7, 2023, 11:18pm UTC](https://community.emergingthreats.net/t/weekly-community-review-april-7-2023/446 "2023-04-07T23:18:43Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [April 7, 2023, 11:18pm UTC](https://community.emergingthreats.net/t/weekly-community-review-april-7-2023/446/1 "2023-04-07T23:18:43Z")
We’re wrapping up the week here and we want to thank the [#infosec](https://twitter.com/hashtag/infosec?src=hashtag_click) [#suricata](https://twitter.com/hashtag/suricata?src=hashtag_click) [#IDS](https://twitter.com/hashtag/IDS?src=hashtag_click) community for tips, tags, and public blogs that lent knowledge to the creation of 58 ET Open sigs! A sampling of that coverage… With their daily [#Gamaredon](https://twitter.com/hashtag/Gamaredon?src=hashtag_click) [#APT](https://twitter.com/hashtag/APT?src=hashtag_click) domain drops and kind tags of [@etlabs](https://twitter.com/ETLabs),[@malPileDiver](https://twitter.com/malPileDiver) continues to contribute to [#ETopen](https://twitter.com/hashtag/ETopen?src=hashtag_click) - this week SIDs 2044867-2044869 & 2044899-2044902. > From[@1ZRR4H](https://twitter.com/1ZRR4H), a couple [#NetSupport](https://twitter.com/hashtag/NetSupport?src=hashtag_click) DNS SIDs, 2044890 and 2044891. > Reminder: [#NetSupport](https://twitter.com/hashtag/NetSupport?src=hashtag_click) is a remote access manager/tool (RAT) which can be abused for malicious purposes. While it has legitimate uses, when it comes to detection logic, signatures, and these DNS query alerts–these rule fires call for investigation. Thanks to[@tosscoinwitcher](https://twitter.com/tosscoinwitcher), 2 SIDs to identify [#SnakeKeyLogger](https://twitter.com/hashtag/SnakeKeyLogger?src=hashtag_click) activity, with the payload request (2044887) and associated domain DNS query alert (2044888). Great [@hatching\_io](https://twitter.com/hatching_io) run! > Our supported IDS engines ([https://community.emergingthreats.net/t/supported-engines/71…](https://t.co/3MYYlNpM87)) give us the ability to alert on both the presentation of a phishing landing page and credential submission. Thanks for 2044889,[@ecarlesi](https://twitter.com/ecarlesi), to catch this [#credphish](https://twitter.com/hashtag/credphish?src=hashtag_click) try! [https://twitter.com/ecarlesi/status/1643443146733281280](https://twitter.com/ecarlesi/status/1643443146733281280) From a [@joe4security](https://twitter.com/joe4security)run, [#JA3](https://twitter.com/hashtag/JA3?src=hashtag_click) has within SID 2044912 is courtesy of [@malware\_traffic](https://twitter.com/malware_traffic) and [@Unit42\_Intel](https://twitter.com/Unit42_Intel) for [#STRRAT](https://twitter.com/hashtag/STRRAT?src=hashtag_click) malware detection. > SIDs 2044903-2044905 are thanks to [@trustwave](https://twitter.com/Trustwave) for the Rilide Stealer they discovered! DNS IOCs from here: > **[Rilide: A New Malicious Browser Extension for Stealing Cryptocurrencies](https://t.co/HNmbvgZY5b)** > > Trustwave SpiderLabs uncovered a new strain of malware that it dubbed Rilide, which targets Chromium-based browsers such as Google Chrome, Microsoft Edge, Brave, and Opera. From [@unmaskparasites](https://twitter.com/unmaskparasites) and [@sucurisecurity](https://twitter.com/sucurisecurity), SID 2044913 for [#BALADA](https://twitter.com/hashtag/BALADA?src=hashtag_click) [#malware](https://twitter.com/hashtag/malware?src=hashtag_click) and the byte patterns enabling the content matches for the alert within: > **[Balada Injector: Synopsis of a Massive Ongoing WordPress Malware Campaign](https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html)** > > A synopsis of the massive ongoing WordPress malware campaign: Balada Injector, including common techniques, functionalities, and vulnerability exploits used in attacks. Lastly,[@Unit42\_Intel](https://twitter.com/Unit42_Intel)’s blog (SID 2044908) and [@urlscanio](https://twitter.com/urlscanio) comprehensive information (2044907) enabling the Traffic Distribution Systems (TDS) landing page and subsequent request leading to [#CryptoClipper](https://twitter.com/hashtag/CryptoClipper?src=hashtag_click)! [https://unit42.paloaltonetworks.com/crypto-clipper-targets-portuguese-speakers/](https://unit42.paloaltonetworks.com/crypto-clipper-targets-portuguese-speakers/)