@DamRay

All tweets and opinions are my own | cloud/security

 paris
Joined April 2009
  • Tweets2.1K
  • Following389
  • Followers389
124Media
Your apps evolved. So did your protection. As AI and containerized apps become the norm, securing traffic inside the cluster has been the missing link. Support for Red Hat OpenShift brings visibility and control to where modern apps actually run, no blind spots, no bolt-ons. bit.ly/433BYek
1
3
6
1,352
Damien Raynal retweeted
ANSSI
@ANSSI_FR18 Feb 2025
#Recrutement | 🇫🇷 Rejoindre l’ANSSI, c'est contribuer à la sécurité de la Nation. C'est aussi incarner l’excellence française en matière de #cyberdéfense. Bref, l'ANSSI recrute : 🔗 talents.ssi.gouv.fr/offresde…
Ingénieur logiciel fullstack python F/H

ALT Ingénieur logiciel fullstack python F/H

Coordinateur sectoriel - Services Numériques et Audiovisuel F/H

ALT Coordinateur sectoriel - Services Numériques et Audiovisuel F/H

Ingénieur - Système de Détection F/H

ALT Ingénieur - Système de Détection F/H

Bref, l’ANSSI recrute.

ALT Bref, l’ANSSI recrute.

2
45
2
98
10,128
Damien Raynal retweeted
Earth
@earthcurated6 Jul 2024
New photo from Space shows the rising Sun casting long shadows across Earth.
Photography via: science update

ALT Photography via: science update

113
2,267
83
15,718
791,138
🤯 The level of sophistication of the XZ attack is very impressive! I tried to make sense of the analysis in a single page (which was quite complicated)! I hope it helps to make sense of the information out there. Please treat the information "as is" while the analysis progresses! 🧐 #infosec #xz
95
3,046
246
12,217
1,107,403
Damien Raynal retweeted
Baptiste Robert
@fs0c131y7 Oct 2023
❗️Ne partager pas des atrocités. Vous ne savez pas qui va voir ces vidéos / photos. Ces images sont traumatisantes, particulièrement pour les + jeunes présents ici. Courir après la dernière vidéo sanglante d’un conflit ne fait pas de vous un expert, ni un « pro de l’#osint » #Hamas #Israel
7
80
4
347
93,802
Damien Raynal retweeted
Unit 42@Unit42_Intel18 Sep 2023
How can an organization actively manage their attack surface? Highlights from Unit 42’s 2023 Attack Surface Threat Report are detailed in our latest post. bit.ly/3PCsm3f
Cortex logo. Palo Alto Networks and Unit 42 logo lockup. 2023. Unit 42 Attack Surface Threat Report. EXPOSURE in a stylized format on a black background.

ALT Cortex logo. Palo Alto Networks and Unit 42 logo lockup. 2023. Unit 42 Attack Surface Threat Report. EXPOSURE in a stylized format on a black background.

4
3
2,875
Des fois on est mieux en l’air que sur terre .. la joie de voler de cette petite fille fait plaisir à voir ☺️ . . . #avgeeks #aviationdaily #aviation #aviationphotography #aviationlovers #pilot #pilotife #aviationgeek #aviation4u ©️UNILAD Adventure
30
120
9
478
36,704
You could say we have a thing for orange. 🧡 Palo Alto Networks, @orangebusiness, & @orangecyberdef unite their forces to launch a cutting-edge #cloud-native, and fully managed #SASE service to support hybrid workers from any location. More on @sdxcentral. bit.ly/3PsAdB3
4
13
2,745
Damien Raynal retweeted
Gerome Billois@gbillois18 Apr 2023
#MustRead Remarquable travail de @ANSSI_FR qui vient de publier ses guides d’aide à la gestion des attaques cyber👏 Tout est couvert: 📍Stratégie 📍Opération 📍Technique On sent l’expérience accumulée, la valeur est énorme, et on peut même contribuer👏 ssi.gouv.fr/actualite/lanssi…
65
1
117
12,858
Damien Raynal retweeted
Unit 42@Unit42_Intel25 Mar 2023
In an article highlighting telecom data breaches, @axios quotes Unit 42 CTO @mikesiko. "We're definitely seeing a huge uptick in telecom attacks now, not necessarily directly against them," he says. Read the rest of his comments now: bit.ly/3ZZXZGS
1
9
21
6,773
Damien Raynal retweeted
Unit 42@Unit42_Intel13 Feb 2023
2023-02-13 (Monday) - Fake Microsoft Teams page on microsofteamsus[.]top pushing #IcedID (#Bokbot). Page established on Thursday, 2023-02-09, likely set up for the same type of #malvertising seen recently using Google Ads. IoCs available at bit.ly/3IiKHPq
Fake Microsoft Teams page, including download notification

ALT Fake Microsoft Teams page, including download notification

Domain registered and server established for fake Microsoft Teams page on Thursday 2023-02-09

ALT Domain registered and server established for fake Microsoft Teams page on Thursday 2023-02-09

Downloaded zip contains inflated exe to install IcedID malware

ALT Downloaded zip contains inflated exe to install IcedID malware

Wireshark pcap showing fake teams page, malware download and IcedID infection traffic

ALT Wireshark pcap showing fake teams page, malware download and IcedID infection traffic

1
50
1
88
22,509
Damien Raynal retweeted
Unit 42@Unit42_Intel30 Jan 2023
A new method for delivering #RedLineStealer via #OneNote attachments was observed (e03d1dc90b981455ff453c996a919848074c6e735719148eeb8e1185935c28b3). Extracted C2 configuration: {"C2 url": ["172.245.45.213:3235"], "Bot Id": "Skijay2"}
Hidden .bat file attachment, covered with a banner

ALT Hidden .bat file attachment, covered with a banner

1. sk2.bat spawning PowerShell command, 2. PowerShell loading assembly into the memory, 3. Extracted .NET code, loading an encrypted payload stored as a resource

ALT 1. sk2.bat spawning PowerShell command, 2. PowerShell loading assembly into the memory, 3. Extracted .NET code, loading an encrypted payload stored as a resource

Malicious OneNote file drops and executes an sk2.bat, which executes a PS Stager, which loads .NET shellcode, which decrypts and executes redline

ALT Malicious OneNote file drops and executes an sk2.bat, which executes a PS Stager, which loads .NET shellcode, which decrypts and executes redline

2
61
4
115
26,368
Damien Raynal retweeted
Unit 42@Unit42_Intel23 Jan 2023
2023-01-23 (Monday) - Google ad led to a fake AnyDesk page. Distributed malicious .msi package first reported to VirusTotal in December 2022. This malware contacts a domain associated with #TA505 infrastructure from 2020. Indicators available at bit.ly/3kxcty9
Google Ad link shown with finger representing the clickable area

ALT Google Ad link shown with finger representing the clickable area

Fake AnyDesk page shown, including the download now button and resulting warning popup

ALT Fake AnyDesk page shown, including the download now button and resulting warning popup

Wireshark pcap showing fake anydesk page, malware and follow-up downloads, and post-infection traffic

ALT Wireshark pcap showing fake anydesk page, malware and follow-up downloads, and post-infection traffic

Red arrows indicate scheduled task and persistent malware

ALT Red arrows indicate scheduled task and persistent malware

4
83
4
211
38,316
Came across an amazing AD pentest cheat sheet from @orangecyberdef Link for full resolution: orange-cyberdefense.github.i…
12
229
4
814
Pourquoi être (cyber)réserviste ? Pour postuler ➡ [email protected]
4
45
2
184
Damien Raynal retweeted
Unit 42@Unit42_Intel29 Aug 2022
2022-08-29 (Monday) - #MonsterLibra (#TA551/#Shathak) pushed #IcedID (#Bokbot) and led to #CobaltStrike from hxxp://fumukav[.]com/web.dll - Cobalt Strike C2 on 45.147.229[.]157:443 used jevomukif[.]com - IOCs available at: bit.ly/3pRuExU
2022-08-29 (Monday) - Monster Libra (TA551/Shathak) IcedID (Bokbot) Activity - thread-hijacked email > password-protected zip archive > attached docx [.rtf file extension] > enable macros > HTTP traffic for installer DLL > installer DLL for IcedID > HTTP traffic for gzip binary > license.dat & persistent IcedID DLL created from gzip binary > HTTPS C2 traffic from IcedID > Follow-up activity : Cobalt Strike

ALT 2022-08-29 (Monday) - Monster Libra (TA551/Shathak) IcedID (Bokbot) Activity - thread-hijacked email > password-protected zip archive > attached docx [.rtf file extension] > enable macros > HTTP traffic for installer DLL > installer DLL for IcedID > HTTP traffic for gzip binary > license.dat & persistent IcedID DLL created from gzip binary > HTTPS C2 traffic from IcedID > Follow-up activity : Cobalt Strike

Screenshot showing the word doc associated with recent IcedID activity

ALT Screenshot showing the word doc associated with recent IcedID activity

Wireshark pcap. Arrows highlight the GZIP binary and the IcedID C2 traffic

ALT Wireshark pcap. Arrows highlight the GZIP binary and the IcedID C2 traffic

Wireshark pcap. Arrows highlight the Cobalt Strike stager and the Cobalt Strike C2 traffic.

ALT Wireshark pcap. Arrows highlight the Cobalt Strike stager and the Cobalt Strike C2 traffic.

55
1
125
Damien Raynal retweeted
CERT-FR
@CERT_FR28 Jun 2022
🆕🛠🛡 For a simpler and faster integration, CERT-FR announces the availability of its public MISP feed for already shared IOC and more to come 👉 misp.cert.ssi.gouv.fr/feed-m… @MISPProject
4
86
1
181
Damien Raynal retweeted
svbl@svblxyz3 May 2022
Russian military leadership. I might use these photos in my next Cyber Security presentation. 😬
259
933
343
6,501
Damien Raynal retweeted
Unit 42@Unit42_Intel14 Apr 2022
2022-04-14 (Thursday) - Ongoing activity using URL --> zip --> .msi --> #Qakbot --> #CobaltStrike. Researchers started seeing this infection method as early as Monday (2022-04-11). IOCs for today's activity available at: bit.ly/3KME8TV
3
53
119
Damien Raynal retweeted
Unit 42@Unit42_Intel19 Mar 2022
Read our analysis of CVE-2022-0492, a new privilege escalation vulnerability in Linux, and learn how you can protect against it. bit.ly/36Trh3c
1
14
1
23
Load more