we hunt malware, crack C2 infrastructure, and publish everything. 225+ technical deep dives and counting. https://teapawt.net/t.co/lRhyVe5RO8
florida
Joined March 2026
- Tweets560
- Following47
- Followers796
- Likes323
BreakGlass Intelligence retweeted
Sociotechnical associations are by threat actor group and/or by threat actor individual. VIP-leader types finance and recruit. Track Maldevs by penmarks. Track Malops op by toolmarks. Done and done
BreakGlass Intelligence retweeted
“what are we doing about LLMs finding 0days in Linux?”
73% of our employees fell for “Free catgirl feet pics! Sign in here”, don’t worry about the AI 0days
BreakGlass Intelligence retweeted
Hackers spent 6 months of irl social engineering to steal $280m from Drift Protocol. Devs cloned repositories and installed test apps from the fake partner.
BreakGlass Intelligence retweeted
Your fiyat teklifi.rar led to a novel Telegram RAT we're calling MaQ RAT.
CVE-2025-8088 WinRAR ADS path traversal (30 entries) drops Updater.exe into Startup → downloads 76MB PyInstaller RAT from Google Cloud (34.69.246[.]76, LIVE).
C2 via Telegram bot @Roberta3358_bot. We decrypted the full config: bot token, password, FTP creds, admin chat ID.
Active victim found: Windows 11 user "Rst-d" at 95.70.214[.]153 (TurkNet, Istanbul). Machine beaconing at time of investigation.
Full writeup: intel.breakglass.tech/post/m…
h/t @smica83
BreakGlass Intelligence retweeted
Fourth tunnel rotation from the same actor. We've now tracked them across 5 months (Nov 2025 - Apr 2026).
charger-van-feb-circuit — 7 LIVE tunnels simultaneously (was 5). They've upgraded from Python RATs to Donut-packed shellcode via KISS Loader.
But they're deploying faster than they can QA: persistence is broken (pol.bat references %LOCALAPPDATA%\lg07 from an old tunnel, installer creates \vours), and neli.bat tries to fetch payloads that were never uploaded (404).
Oldest artifact found on highland-trend-src-distinct dates to November 2025.
Updated writeup with full Nov-Apr timeline: intel.breakglass.tech/post/o…
h/t @smica83 — you've tipped us on every rotation
BreakGlass Intelligence retweeted
The "insane amount" is 740 phishing hostnames.
We mapped the full Kimsuky/APT43 operation.
158.247.219[.]150 hosts 98 sequential subdomains (auth-umblog[1-98]s.dynv6.net) — automated phishing factory targeting South Korea:
- National Tax Service (91 hostnames)
- Naver portal (61)
- NongHyup Bank/NHIS (17)
- National Pension Service (12)
- Kakao, invoices, auth pages (500+)
The server is IP geofenced — returns 403 to non-Korean IPs. One-time SMS tokens burn after use. That's why surface scanners see
nothing.
12 operator IPs (7 with RDP exposed), 49 registered domains, 30+ DDNS providers abused. 1,206 total IOCs.
Full writeup + all 740 hostnames:
intel.breakglass.tech/post/k…
BreakGlass Intelligence retweeted
Awesome @skocherhan, klein-changes-slim-starter is the same actor confirmed via shared SID
S-1-5-21-3343087317-1842942590-547433828-500 and wet-envelope tunnel overlap.
This tunnel gave us their full 3-month history: 6 WSF droppers from Jan 14 through Apr 2. Daily A/B testing — Apr 1 used Python
RATs + DLL sideloading, Apr 2 dropped the DLL entirely.
9 tunnels mapped total across 3 investigations. Blog post updated with the full timeline:
intel.breakglass.tech/post/o…
BreakGlass Intelligence retweeted
Same actor as our Nutten Tunnel report. 10 days later, completely upgraded arsenal.
crest-ind-snake-dublin[.]trycloudflare[.]com → 8 compartmentalized tunnels (was 1)
What changed in 10 days:
- 1 tunnel → 8 (lure → dropper → stager → payload)
- 1 shellcode → 5 Python RATs + custom x64 DLL
- CreateRemoteThread → Early Bird APC injection (QueueUserAPC)
- Python 3.11 downloaded → Python 3.12 bundled
- German-only → German + UK daily campaigns (UKMar26, UKMar27, UKA01, UKA02)
Custom "Kramer" obfuscator on all 5 RATs. XOR key extracted from the DLL: vGTemXQ2PUmLBCzOAPieOYoLGTonlAQ4
Same Windows SID in both campaigns — S-1-5-21-3343087317-1842942590-547433828-500
22 samples + 6 YARA + 10 Suricata on GitHub.
Full writeup:
intel.breakglass.tech/post/o…
h/t @smica83 for both tips
BreakGlass Intelligence retweeted
North Korean hackers have breached more than 400 GitHub repositories to plant malicious tasks.json files. Users loading or cloning one of the hacked repos in the VS Code IDE would have malware installed on their systems. The campaign, named TasksJacker, abused a VS Code feature that auto-executes instructions placed in a tasks.json file.
BreakGlass Intelligence retweeted
Socket is free for open source maintainers.
We're launching the @SocketSecurity for Open Source program -- any open source maintainer can get a free Team plan to protect their project from supply chain attacks.
Open source is critical infrastructure. Millions of companies depend on packages maintained by small teams and volunteers. These maintainers are high-value targets but rarely have access to enterprise security tooling. That's wrong. We want to fix it.
What you get:
✅ Full dependency scanning across your project
✅ Real-time alerts for malicious packages in your dependency tree
✅ Check every PR to make sure no malicious dependencies are added -- including PRs from outside contributors
If you maintain an open source project, send an email to support[at]socket[dot]dev and we'll get you set up!
BreakGlass Intelligence retweeted
this is a commercial proxy service backend, selling residential/compromised proxy access.
quick findings:
- 15,029 goroutines — ~9,348 active proxy connections (4,679 reading client + 4,669 reading upstream)
- SOCKS5 upstream tunneling — routes traffic through SOCKS5 proxies (residential/compromised)
- HTTPS-over-SOCKS5 and HTTPS-over-HTTP — two proxy chain methods
- ClickHouse analytics — logging all proxy requests with batch inserts
- 186 OS threads — heavily loaded
- Developer is Lithuanian — "Kompiuteris" is Lithuanian for "computer", source downloaded from Telegram
more details to follow on X & @ intel.breakglass.tech
I'll leave this panel here (one of the IPs showed up in password spraying and similar suspicious activity, pivoting from it uncovered additional servers) 🤔
http://192.253.248.171:5000/
http://104.234.204.230:5000/
http://192.253.248.174:5000/
http://104.234.204.10:5000/
http://192.253.248.175:5000/
http://104.234.204.231:5000/
BreakGlass Intelligence retweeted
C2: sfrclak[.]com → 142.11.206[.]73
Registered: Today (Mar 30, 2026) via Namecheap
Already offline — burned infrastructure
3 payload identifiers: product0 (macOS), product1 (Windows), product2 (Linux)
Obfuscation key: OrDeR_7077
Campaign: GhostClaw / Ghost Campaign
BreakGlass Intelligence retweeted
LOLFSAAS
Living off Free SaaS
Hundreds of SaaS platforms with free tiers, documenting abuse surface, opsec risks, authent methods, C2 framework mappings, and operational limits.
lolfsaas.github.io/
BreakGlass Intelligence retweeted
👁️ LOLC2
Collection of C2 frameworks abusing legitimate services to evade detection
Major update: new projects tested, enriched data, and deeper insights.
site: lolc2.github.io
github: github.com/lolc2/lolc2.githu…