Threat Researcher and Threat Hunter
Joined July 2024
- Tweets32
- Following96
- Followers395
- Likes286
To hunt them on Shodan :
- shodan.io/search?query=title…
Alopsis retweeted
This is the future of malware. 👀
VOLTA doesn’t just steal your passwords and crypto wallets.
It packages everything and sends it to Claude Opus 4.6 with this prompt: “You are a forensic intelligence analyst. Rank what this victim is worth.”
If Claude refuses → Kimi K2 → Gemini.
We caught the full chain in the sandbox (including the exact request it sent to the AI)
Stealers are now outsourcing target prioritization to commercial LLMs. 🚨
app.threat.zone/submission/c…
New C2 domain used for EtherHidding :
- codes.browse-cdn.beer
All the concerned domains can be found on the Polygon address at :
- polygonscan.com/address/0xB6…
Domains can be found with urlscan :
- urlscan.io/search/#domain%3A…
24 domains can be identified by this query
A lot of people are talking about the ARTEX backdoor that allows RCE on the server. Here's some info:
- Present only in the binary of the Docker image tomicdd/artex — not in the GitHub source.
- Its sha256 → d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573
Alopsis retweeted
Another day, another bad OPSEC. 🥔
A Microsoft 365 phishing kit, a preventable mistake, and another reminder that even attackers can leave breadcrumbs.
The weakest link isn't always the user. Sometimes, it's the operator.
potato.id/en/posts/microsoft…
Alopsis retweeted
🚨🇫🇷 Plus de 905 000 enregistrements liés à des plaques d’immatriculation françaises seraient en vente sur le dark web, avec les noms et adresses des automobilistes.
Un hacker connu sous le pseudonyme « ChimeraZ » affirme détenir une base de 175 Mo contenant 905 097 enregistrements, dont 847 064 plaques d’immatriculation uniques, 506 003 adresses e-mail et 474 906 numéros de téléphone. Le tout serait proposé à la vente sur un forum de hackers.
Le pirate annonce déjà posséder un deuxième fichier contenant près de 2 millions de plaques supplémentaires.
Alopsis retweeted
DORK: intext:@"yahoo|gmail|outlook|hotmail".com (filetype:xls OR filetype:csv OR ext:xlsx OR ext:txt OR ext:sql) site:*.gov
----------------------------------------------------------
Not gonna lie, this single google dork I made has given me SO much exposed PII from self-hosted programs and some .gov, .edu, .int and .mil domains.
Use it for BBP targets. If it helps you find something interesting, come back here on X and thank me.
Also, make sure you run this on Bing. Google has fixed/changed some search operators so it will not work.
Alopsis retweeted
🔴 1.4Billion Credential Records Exposed Online
A misconfigured Elasticsearch instance exposed 360+GB of data, including ~1.4Billion credential records and 1.3M+ US consumer PII records containing names, emails, phone numbers and addresses.
The infrastructure appears to aggregate and categorize data from multiple sources, including Telegram channels, potentially making credentials searchable by targets such as banking and crypto services.
Its operator and intended purpose remain unknown - it could potentially support anything from data/intelligence services to malicious operations.
Risks:
Account takeover
Credential stuffing
Targeted phishing
PII abuse
#ThreatIntel #CyberSecurity #DataBreach
Alopsis retweeted
#APT #Sidewinder targeting National Telecom Corporation #NTC 🇵🇰
+1
Tracked by @Huntio
https://zimbramail-nyatel-com[.]up[.]railway[.]app/login.html?gfjdliotrgojnghgherbegrehureert0e0ee=
Ref: teapawt.net/volrant136/status/2048…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
#APT #Sidewinder targeting #Pakistan🇵🇰
+1
Tracked by @Huntio
https://zimbra-nyatel-production[.]up[.]railway[.]app/login.html?gfjdliotrgojnghgherbegrehureert0e0ee=1
Ref: teapawt.net/volrant136/status/2032…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
Alopsis retweeted
🚨 @MistralAI, l'IA « souveraine » française, vient de confirmer une cyberattaque. 450 dépôts de code source interne sont en vente à 25 000 $ sur un forum cybercriminel. ⬇️
Comment ? Via une attaque dite « supply chain » : les hackers n'ont pas visé Mistral directement. Ils ont compromis TanStack, un outil utilisé par les développeurs de Mistral. Une fois l'outil infecté, des packages npm et PyPI de Mistral ont été contaminés et publiés entre le 11 mai 22h45 et le 12 mai 01h53 UTC.
Résultat : ~5 Go de code volé. Entraînement des modèles, fine-tuning, agents finance, KYC, dashboard, projets futurs....
Mistral le confirme (advisory MAI-2026-002) : un appareil développeur infecté est impliqué. « Aucune indication que l'infrastructure a été compromise », lit-on. Peut-être. Mais le code source est dehors, prix affiché, délai d'une semaine avant mise en ligne gratuite sur le forum.
‼️🇫🇷 Mistral AI has confirmed they were impacted by the recent TanStack supply chain attack.
docs.mistral.ai/resources/se…
Alopsis retweeted
Short write-up on a small investigation conducted with
@Alopsis into a phishing kit impersonating FedEx.
blog.aksnk.com/posts/colisre…
#phishing #cti #osint #infosec #threatintel #ninepercent
![Fake portals everywhere [1] — Autopsy of a FedEx phishing kit · aksnk / notes](https://pbs.twimg.com/card_img/2117221249680056321/L3jyFo4m?format=jpg&name=800x419)
