Malware Researcher, Internet Protector, Cyber researcher
Toronto, Canada
Joined August 2013
- Tweets2.3K
- Following293
- Followers472
- Likes4K
Part 2 with some hashes, domains and IoCs for good measure and an ask to help identify these raw shellcode
sec0wn.blogspot.com/2026/01/…
@James_inthe_box @tlansec @malwrhunterteam
Happy New Year everyone. I wrote something
sec0wn.blogspot.com/2026/01/…
Do I get an honorary #OSEP for analyzing their payloads? Lol. Maybe Gemini should though. H/T to GeminiPro for the assist
I highly recommend watching Kris's talk from 2022. I specifically love the methodology used for their analysis and it is just a work of art.
In September 2022, attendees at the inaugural @labscon_io heard about an actor I described then as "one of the most prolific, most deeply connected, and most technically advanced actors around". Events this week were a reminder that the video never went out, so here it is 👇
- Legacy could indicate lack of MFA
- Spray and pray attacks continue to show valuable outcomes for attackers and you don't always need 0days
- IAM and account logging and monitoring is essential
- more firms were probably targeted
- finally, Kudos to MS for the transparency
APT29/Cozy Bear/Midnight Blizzard is the Russian SVR crew that pulled off SolarWinds. msrc.microsoft.com/blog/2024…
More like the chollima in the room, am I right? 🥁🥁🤣
Just stumbled upon the results of this year's Flare challenge, and I can't ignore the elephant in the room. 😏🐘
mandiant.com/resources/blog/…
MoBustami retweeted
💜Adversary Simulation and Purple friends💜
I'm happy to share this simulation plan which regroups a TOP 35 @MITREattack TTPs from 22-23.
Based on open source intel, it's meant to ease the onboarding of more into Purple!
Have a look at the readme #CTI #TTP
github.com/Sam0x90/CTI/tree/…
MoBustami retweeted
Today we are highlighting an actor we are tracking as Volt Typhoon. This activity is targeting US and Guam critical infrastructure. Volt Typhoon has been observed mostly living off the land during our investigations.
Volt Typhoon, a Chinese state-sponsored actor, uses living-off-the-land (LotL) and hands-on-keyboard TTPs to evade detection and persist in an espionage campaign targeting critical infrastructure organizations in Guam and the rest of the United States. msft.it/6019gj8eH
Lo key one of the best blogs I have read in a while... Hot daaaamn!!! Well done
I'm very excited to share our latest research which uncovers a malicious firmware implant for TP-Link routers, linked to Chinese state-sponsored APT group #CamaroDragon.
Read our blog @ research.checkpoint.com/2023… >>
Waiting for @TomHegel translation of the screenshots 👀👀
We hope you used yesterday's day off wisely to digest our findings so far. We are back with article 4 - suspicious goings on at Wuhan Xiaoruizhi intrusiontruth.wordpress.com…
Thank you @ImposeCost for this... I could not have said it any better
This quoted post is unavailable.
MoBustami retweeted
Today, we've released #APT43 🇰🇵. As part of this release, I wanted to highlight some of the background research that went into this. No blue checkmark, so I have to do a normal thread 😅mandiant.com/resources/blog/…
Well, what do you know, dusted the old keyboard and wrote a quick blog @James_inthe_box @Arkbird_SOLG @tylabs @juanandres_gs @h2jazi
🥚🥚🥚
sec0wn.blogspot.com/2023/03/…
MoBustami retweeted
My 2c on the #BlackLotus UEFI bootkit (thanks, @ESETresearch):
- "Exploitation Less Likely" is proven wrong, hope for a new DBX revocation list.
- not trusting UEFI CA saves the day yet again.
- having a single NV+BS variable as a gateway to booting whatever is a bad idea.
I highly recommend folks to go and read the latest blog from LastPass on their recent incident. Thank you for the transparency so far. I think one question I have would be who/what is the ultimate target/s of this
support.lastpass.com/help/in…
MoBustami retweeted
- Malvertising: notepadplusplus[.]site
- #Vidar stealer:
download-notepad-plus-plus.duckdns[.]org
- Gets C2 location from Telegram and Steam
- C2s:
95.217.16[.]127
157.90.148[.]112
116.203.6[.]107
More indicators in this blog post I wrote: darktrace.com/blog/vidar-inf…
MoBustami retweeted
SickKids is responding to a cybersecurity incident affecting several network systems and has called a Code Grey – system failure. The code is ongoing. Patient care is unaffected at this time. Read more: bit.ly/3VaeUDm
Anybody got a good place/website for Ugly Christmas sweater APT style? Think of crowdstrike APT logos but on a Christmas sweater, any idea @tylabs @ChicagoCyber @juanandres_gs @likethecoins
