In 2010 when Chris Bosh announced he would sign with the Miami Heat, I speculated that this meant Lebron would ultimately also sign with Miami so I called the ticket office the same day and bought a pair of season tickets.

As part of our commitment to keeping our customers/community protected & informed, we are releasing a blog that shines light on transition between Stage 1 and 2 of #Solorigate/#SUNBURST campaign, custom Cobalt Strike loaders, post-exploit. artifacts, IOCs: https://t.co/b0ReHMa63u

Here are some highlights:
The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).

Once the registry value is created, the attackers wait for the occasional execution of dllhost.exe, which might happen naturally on a system. This execution triggers a process launch of wscript.exe configured to run the VBScript file dropped by the SolarWinds backdoor (Stage 1).

The VBScript in turn runs rundll32.exe, activating the Cobalt Strike loader DLL using a clean parent/child process tree completely disconnected from the SolarWinds process. Finally, the VBScript removes the previously created IFEO value to clean up any traces of execution.

On the custom Cobalt Strike Loaders: we identified several second-stage malware, including TEARDROP, Raindrop, and other custom loaders for the Cobalt Strike beacon. During the lateral movement phase, the custom loader DLLs are dropped mostly in existing Windows sub-directories.

#PolicybazaarIPO Long thread: There is monetary printing by RBI, there is lending by banks & finally there is the Indian IPO. “Foreign owned” company with ~1 Bn investment is selling “Indian” unicorn to “savvy” Indians for $ 6.2 Bn. Want to know how this printing works? Let’s go-

The basics: Rs 6017 Cr being raised by new shares (Rs 3750) & re-selling (Rs 2267). Face value Rs 2 offered at Rs ~1000 per share is one of a kind. Who decides the price? Examine the valuation ladder below.
With ~$ 150 Mn invested till 2017, we see $ 525 Mn rushes in after 2018

So, a company valued $1 Bn in 2018 & $ 1.5 Bn in 2019 by key investors like Tencent, suddenly “needs money” in March 2021. Falcon Edge “invests” all of $ 75 Mn in March at valuation of $ 2.65 Bn.
Enter IPO bankers a couple of months later & they value the company at $ 6.2 Bn

Why does PolicyBazaar need $ 75 Mn just 6 months before IPO & give away 2.5 times in returns? And it doesn’t even use that money as the B/S reflects appx Rs 1000 Cr in cash lying around.
What kind of a favor is that? Why do they need US investment bank for this just before IPO?

Notice 50% rise in shareholding of promotors here & a 1: 500 bonus share issue. After all, how do you print money & still keep share price at “reasonable” Rs 1000?
Without bonus issue in June 2021, each share would have costed Rs 50,000. Heard of circular valuation?

"Small deals rely on promises and contracts. Big deals rely on alignment and trust."

@naval