Each month Sekoia.io updates the configuration of its collection playbooks to automatically gather Indicators of Compromise (IoCs) of new threats. Our collection playbooks are aggregating, enriching and contextualising IoCs from community threat intelligence feeds (URLhaus, ThreatFox, and others) and analysis of Hatching Triage sandbox.

This time, we have mostly added cybercrime threats:

• RATs and backdoors: Borat RAT, ChaosRat, Gh0stRat, Octopus, More_eggs, Viper;
• Droppers and downloaders: FakeUpdateRU, Godzilla Loader, CloudEyE;
• Infostealers and spyware: BadBazaar, ClipBanker, CrealStealer, Hydra and Serpent Stealer.