my tweets are severely limited by my lack of understanding of what I am doing.
For those who have been at DefCon, Emotet and Trickbot are testing lateral movement - I think this one may grow into a problem.
-
Today they have added passworded Office docs to mix. They do endpoint delivery -> credential and email harvesting -> lateral movement.
With Emotet they're continuing to regenerate and auto update the payload every few hours as AV evasion. Quite successfully too.
