# Weekly Community Review - March 31, 2023 **URL:** \ **Category:** Announcements\ **Created:** [April 7, 2023, 11:11pm UTC](https://community.emergingthreats.net/t/weekly-community-review-march-31-2023/445 "2023-04-07T23:11:44Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [April 7, 2023, 11:11pm UTC](https://community.emergingthreats.net/t/weekly-community-review-march-31-2023/445/1 "2023-04-07T23:11:45Z")
It’s a rainy Friday to close out the week here at [@et\_labs](https://twitter.com/ET_Labs)- with your help we released 93 sigs out into the ET Open ruleset - lets chat on them and thank those that contributed to their existence! [https://rules.emergingthreatspro.com/open/](https://t.co/j7Vc3tNy6L) The infosec researcher community continues to tip us up to Gamaredon APT activity daily! This is a great resource for giving us visibility and is such a timely heads-up to new domains and activity. From [@malPileDiver](https://twitter.com/malPileDiver), thanks on the tags that led to 2044782-2044786 & 2044836-2044839. These domain alerts will let our users know whether assets within their networks are making DNS requests against comprised domains - an indicator of potential compromise. > And from [@Cyber0verload](https://twitter.com/Cyber0verload) a kind tag with domain tips leading to SIDs 2044826, 2044772-2044780, as well as a hash that allowed us to model Gamaredon C2 recon callback activity in SIDs 2044827-2044829! > On that note, remember there are many ways to reach out to us with a tip-up on a hash, intel, or detection logic you’ve created. [Here](https://twitter.com/ET_Lab) on twitter, here on our Discourse on our mailing list via support[at]emergingthreats[dot]net, or on our Discord (his us up via DM for an invite!) Here’s the origin of SID 2044768 from this tweet by [@suyog41](https://twitter.com/suyog41), giving us a URI pattern and PCRE match guidance to fire on this mugglestealer outbound activity: > SID 2044796 from this[@James\_inthe\_box](https://twitter.com/James_inthe_box) tweet - pswstealer exfil guidance from an [@anyrun\_app](https://twitter.com/anyrun_app). Thanks for sharing with the suricata IDS community! > Good friend of [@ET\_Labs](https://twitter.com/ET_Labs) @tgreen contributes SID 2044825 for CVE-2022-25237 SCADA Altenergy Power Control Software Command Injection Attempt modeled from the exploit here: > **[GitHub - superzerosec/CVE-2023-28343: CVE-2023-28343 POC exploit](https://github.com/superzerosec/CVE-2023-28343)** > > CVE-2023-28343 POC exploit. Contribute to superzerosec/CVE-2023-28343 development by creating an account on GitHub. Thanks for the twitter tag[@Gi7w0rm](https://twitter.com/Gi7w0rm), which led to Hunting SID 2044835 - their analysis shows Raccoonv2 RecordBreaker loading a malicious binary which grabs google account details and exfils! > All week the infosec landscape has been working hard to cover the potentialities of the [#3CX](https://twitter.com/hashtag/3CX?src=hashtag_click) / [#3CXpocalypse](https://twitter.com/hashtag/3CXpocalypse?src=hashtag_click) - we’d particularly like to thank [@patrickwardle](https://twitter.com/patrickwardle), [@objective\_see](https://twitter.com/objective_see), and [@Volexity](https://twitter.com/Volexity)… > **[3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/)** > > \[Update: Following additional analysis of shellcode used in ICONIC, in conjunction with other observations from the wider security community, Volexity now attributes the activity described in this post to the Lazarus threat actor. Specifically, in... …for the work they’ve shared - this helped us not only release alerts for DNS queries for the observed domains (2044802-2044822) but today detection logic around the user agents and other related http header information! (SIDs 2044857, 2044848-2044849) > From our industry friends, this [@zscaler](https://twitter.com/zscaler) blog, providing guidance for 2044842, firing alerts on a c2 domain called out in their posting. > **[DBatLoader Actively Distributing Malwares Targeting Europea](https://www.zscaler.com/blogs/security-research/dbatloader-actively-distributing-malwares-targeting-european-businesses)** > > The latest malware campaign of DBatLoader, which is being used by threat actors to target various businesses in European countries with Remcos RAT and Formbook SID 2044824 is from this [@Mandiant](https://twitter.com/Mandiant) APT43 report - BRAVEPRINCE outbound/GET activity: [http://mandiant.widen.net/s/zvmfw5fnjs/apt43-report](http://mandiant.widen.net/s/zvmfw5fnjs/apt43-report) On the homefront,[@aRtAGGI](https://twitter.com/aRtAGGI) and his research on WinterVivern and CVE-2022027926 - wonderful insight on TA473, phishing, and the malicious actor standby of exploiting unpatched vulnerabilities. With [@ET\_Labs](https://twitter.com/ET_Labs) signatures for reference and visibility! > **[Exploitation is a Dish Best Served Cold: Winter Vivern Uses Known Zimbra...](https://www.proofpoint.com/us/blog/threat-insight/exploitation-dish-best-served-cold-winter-vivern-uses-known-zimbra-vulnerability)** > > Key Takeaways > > Proofpoint has observed recent espionage-related activity by TA473, including yet to be reported instances of TA473 targeting US elected officials and staffers. And also don’t forget to check out the great [@threatinsight](https://twitter.com/threatinsight) blog on IcedID from the wonderful Threat Research team here - with extra [@ET\_Labs](https://twitter.com/ET_Labs) signature coverage goodness at the end! > **[Fork in the Ice: The New Era of IcedID | Proofpoint US](https://www.proofpoint.com/us/blog/threat-insight/fork-ice-new-era-icedid)** > > ​Key Findings