Hacker | Enterprise Security & Threat Hunting Director | Passionate about #Leadership #Offensivesecurity & #JiuJitsu | @BrownUniversity Alum. Views are my own.
Linux Terminal
Joined July 2017
- Tweets330
- Following305
- Followers369
- Likes190
Christian Galvan retweeted
Dear Threat Actor(s) targeting POS systems,
After @malwrhunterteam saw your malware payloads being distributed online, presumably trying to infect restaurants like Buffalo Wild Wings, I can see you've switched up your tactics a little.
Your latest payload, which is delivered from a different web domain, is absolutely cooked.
You forgot to strip the metadata out of your payload. I was able to immediately recover everything and quite literally get your payload back to damn near the original source code.
I can see how you're:
- Keylogging
- Managing these computers remotely with Hidden VNC
- Registering infected machines with your C2
- Attempting to evade security products
- Pulling credit-card numbers out of POS systems when customers swipe their credit card
- Attempting to move laterally over the network by exploiting SMB
- etc
It would be unethical of me to give you advice on how to write malware, but I really want to emphasize that I know you're using AI to write this malware and that you're making really goofy mistakes. Your domain "test(.)qovexira(.)xyz" is in plain text and is directly under the function "register_with_c2".
Code metadata you left in place:
- auto_ops_thread
- beacon_loop
- check_for_update
- dbglog
- delayed_persistence_thread
- detect_pos_role
- exec_command
- format_card_tracks
- generate_agent_id
- get_system_info
- http_get
- http_post
- hvnc_input_thread
- hvnc_spawn_app
- hvnc_stream_thread
- hvnc_task
- implant_upload_file
- install_persistence
- is_btc_address
- is_eth_address
- kb_buf_read (Keyboard)
- kb_hook_routine (Keyboard)
- kb_hook_start (Keyboard)
- lan_collect_neighbors
- lanmon_capture
- lanspread_smb_push
- peak_hours_thread
- pos_aloha_info_run
- pos_db_dump_run
- pos_ensure_drop_dir
- pos_lsa_dump_run
- pos_mod_op_7
- pos_module_run
- pos_port_sweep_run
- pos_ram_scrape_run
- pos_terminal_run
- pos_upload_file
- process_task
- read_file
- register_with_c2
- run_ch
- run_pivot_scan
- scanner_watch_thread
- self_heal_persistence
- send_result
- steal_browser_creds
- take_screenshot
- update_loop
- upq_worker
- watchdog_thread
- write_file
Colombia has been one of the funnest teams to watch this World Cup. Much superior than Portugal in technical strategy. #worldcup ⚽️
Christian Galvan retweeted
The pattern keeps repeating - stolen credentials, direct package publish, no code review involved. Most supply chain security models assume the attack flows through a PR. The ones that hurt skip that path entirely. xitter.cf/GalvanHacking/status/2…
It has been a busy time for security folks the past two weeks with the software supply chain attack investigations.
There has never been a better time to work with engineering, legal, and business stakeholders to prepare for the inevitable.
The XZ-Utils compromise in March 2024 led to a personal mind shift to monitor software packages as it was becoming something threat actors could use to bypass traditional controls
#securityresearch #llmsecurity #opensource
It has been a busy time for security folks the past two weeks with the software supply chain attack investigations.
There has never been a better time to work with engineering, legal, and business stakeholders to prepare for the inevitable.
The XZ-Utils compromise in March 2024 led to a personal mind shift to monitor software packages as it was becoming something threat actors could use to bypass traditional controls
#securityresearch #llmsecurity #opensource
Completed the Pelican Linux VM lab in about an hour, my service enumeration process has improved but I do like to read what I’m hacking first which took about 20 mins 🤓
#applicationsecurity #linuxhacking #privesc #provinggrounds
Christian Galvan retweeted
malware found in the top downloaded skill on clawhub
and so it begins
Another late night hacking session before this winterstorm hits 💻☃️
#appsec #privilegeescalation #linuxsecurity
Another one bites the dust #dvr4, this windows machine was tricky on the initial access and privilege escalation. Small details matter, got some new tips added to my documentation.
#webapp #pentesting #provinggrounds
Busy day with the fam today yet had to get some reps in for Windows Hacking before bed to keep the skills sharp #algernon #provinggrounds #offsec
Today was a good day! Co-presented to a large audience of 800+ virtual participants on guard rails for Agentic AI. Started off with a brief walkthrough of history on the first steam powered robot prototype from Ancient Greece then discussed Alan Turing in the 50s prior to arriving to the recent breakthroughs enabled by big data, compute, and examples of automation for complex tasks with agents.
Key takeaways on using coding agents:
🧠 Don't outsource your critical thinking
🤝 Partner with your security experts
🔍 Check that LLM’s are giving you the output you requested without hallucinations
Feel free to reach out to discuss these topics further.
#AgenticAI #DevSecOps #Archytas
Christian Galvan retweeted
I reverse engineered an executable and discovered it was a covert SSH beacon connecting to a remote Russian server. Static analysis using strings revealed an embedded C2 domain, while behavioral analysis showed the malware silently exfiltrating desktop screenshots and saved data.
Christian Galvan retweeted
We are saddened to inform friends that our dear brother, Voddie Baucham, Jr., has left the land of the dying and entered the land of the living. Earlier today, after suffering an emergency medical incident, he entered into his rest and the immediate presence of the Savior whom he loved, trusted, and served since he was converted as a college student. Please pray for Bridget, their children, and grandchildren.
Precious in the sight of the Lord is the death of his saints. – Psalm 116:15
founders.org/articles/the-de…
Christian Galvan retweeted
🔍 Cloud forensics tip: Azure Storage logs are gold during breach investigations.
Threat actors love blob storage. Without logging, you’re flying blind.
✅ Enable StorageBlob logs
🕵️♂️ Trace SAS token misuse, key rotations, RBAC abuse
📊 Analyze UserAgentHeader for tool access
🔐 Catch OAuth vs SAS patterns
Full breakdown + KQL queries 👇
Microsoft Security Experts blog
techcommunity.microsoft.com/…
I love going to libraries anytime I visit a new city. Yesterday I was reading the writings and works of Benjamin Franklin, George Washington, and Supreme Court Reports from the 1900s. ⚖️📖
#foundingfathers #history #seattle
Christian Galvan retweeted
Our hearts are heavy, yet rejoicing, as we share the news that our beloved pastor and teacher John MacArthur has entered into the presence of the Savior. This evening, his faith became sight. He faithfully endured until his race was run.
2 Timothy 4:1-8
John Macarthur's legacy is that of a faithful warrior who encourages us to stand firm for the truth. His ministry has blessed my family and millions of people across the globe since 1969 through his expository teaching of Christ and explaining the hard truths of the Bible. He's now with the Lord and I pray that his family and friends are able to find comfort. Truly grateful to have witnessed his preaching during our lifetime. 🙏🏼
Christian Galvan retweeted
We've released Procmon for Linux, Sysmon for Linux, and SysinternalsEBPF with Azure Linux 3.0 support!
Get the tools at sysinternals.com.
See what's new on the Sysinternals Blog: techcommunity.microsoft.com/…
