📢 Google TI Mondays. Quick reminder to Follow the Google TI Mondays series across our social platforms every week for quick, actionable practitioner tips and product adoption advice designed to enhance your efficiency. These actionable tips are essential. #GoogleTIMondays
💪 Detection Highlights. The Google Threat Intelligence Group and FLARE team are dedicated to enhancing Google TI's detection capabilities through continuous updates to YARA rules and malware configuration extractors. This week, we've released YARA rules covering 7 newly tracked malware families, and expanded our detection capabilities for 35 existing families, which includes updates to YARA rules and configuration extractors. Our prioritization focuses on threats actively observed in Mandiant incident response engagements, Google SecOps customer environments, and prominent Google TI search trends.
As we track new malware families found through our research, we build and release detection signatures. Some recent examples include:
- ROTORWIPE: a disruptive payload written in C++ which makes use of the Mersenne Twister algorithm to compute a random buffer which is used to overwrite data on the victim's device. ROTORWIPE identifies and enumerates the device's logical drives; it then enumerates files and folders on the given drive and begins overwriting the data while aiming to ignore files in specific root directories. After parsing all child directories, each file is then overwritten with random data from the Mersenne Twister algorithm in 16-byte chunks. After overwriting the files, ROTORWIPE sleeps for 5 seconds before enumerating the drives and attempting to delete each file. After the file deletion activity is complete, the malware exits. See its curated YARA detection rules.
- MISTBRICK: a post-exploitation agent written in Java, designed to target Ivanti MobileIron appliances. It employs a multi-stage loader that reassembles an encoded JAR file on disk before utilizing the Java Attach API to inject malicious bytecode into a running Tomcat process. The malware uses the Javassist library to patch the com.mi.filter.CacheFilter class in memory, creating a passive backdoor that intercepts HTTP requests containing a specific hard-coded UUID header. Communication is secured using AES-256-CBC encryption with a hard-coded key and IV. MISTRBRICK supports a custom binary protocol, allowing for the fileless loading and execution of arbitrary Java classes directly from memory. The malware operates as a memory-resident implant and does not establish persistence beyond the runtime of the hijacked service. See its curated YARA detection rules.
- CRYSOME: a Delphi-based Remote Access Trojan (RAT) and Loader. It utilizes a custom UDP-based command-and-control (C2) protocol for system espionage and remote execution. The malware features a modular architecture, enabling the deployment of additional functional plugins to minimize the initial static footprint of the loader. See its curated YARA detection rule.
In addition to providing detection rules for new and emerging threats, we continuously enhance our detection systems for known threats, including updates to YARA rules and configuration extractors. This week, we've updated YARA rules for 34 families and improved configuration extraction for the SENDSTATE family. These updates ensure you have the latest indicators and enhanced visibility into evolving threats. Some examples of families with recent YARA rule updates include: SHADOWLADDER, SOGU, and WARPWIRE.
See latest malware family profiles added to the knowledge base and the complete list of curated YARA rules in our database.
🆕 New Countries and Industries Profiles. Complementary to Threat Profiles, our newest Countries and Industries Profiles provide quarterly, AI-synthesized intelligence tailored to specific geographic or sectoral threats. By consolidating expert-curated data and OSINT into intuitive visual analytics, these profiles eliminate manual data triaging, allowing you to command a clear view of your specific threat landscape.
🆕 New Hacktivist DDoS Activity Dashboard. The Hacktivist DDoS Activity dashboard is a specialized monitoring interface within Google Threat Intelligence that tracks distributed denial-of-service threats claimed by a curated list of hacktivist groups. It integrates telemetry from actor-controlled botnet command-and-control (C2) infrastructure and data harvested from hacktivist Telegram channels. This specialized interface empowers analysts to monitor Channel Activity Trends and identify the Geographic and Industrial distribution of victims at a glance. By surfacing these targeted statistics, the dashboard enables organizations to move from general awareness to a tailored, industry-specific defensive posture.
🔄 Livehunt Rule Now Tagged on Network Indicator Reports. Livehunt is the real-time detection engine within Google Threat Intelligence, designed to monitor the continuous stream of incoming IoCs. While built on YARA, traditionally used to classify files based on binary patterns, our platform significantly expands this technology. Livehunt has evolved beyond files to support network indicators, enabling YARA rules to match against URL, domain, and IP address patterns within their generated analysis reports as they are scanned and ingested.
Active Livehunt rules that trigger on network indicators are now explicitly identified within their analysis reports. Rule names are tagged directly below the indicator and listed under a dedicated section of the DETECTION tab, providing immediate context. This update allows you to instantly see which specific hunt or threat actor campaign flagged an indicator during its analysis.
🔄 Enhanced Time-Range Precision for Time Search Modifiers. The Intelligence Search tool within Google TI allows security researchers to hunt for IoCs (files, URLs, domains, IP addresses) across a massive historical dataset using advanced modifiers like fs, ls, la (first submission, last submission, last analysis).
Previously, using the fs:YYYY-MM-DD modifier would only return IoCs submitted at exactly 00:00:00 on that date. With this update, entering a date such as fs:2025-02-19 now returns all IoCs submitted during the entire day.
Additionally, to provide better clarity, the Google TI user interface will automatically expand your query to the range format fs:2025-02-19+ fs:2025-02-20-. This visual change confirms that the search covers the full window from the start of the selected day to the start of the next.
Try it: entity:file gti_score:100 fs:2025-02-19!
