@PaduckLee

Ransomware Researcher | CTF Player

 South Korea
Joined May 2024
  • Tweets539
  • Following158
  • Followers1.5K
64Media
Hyuna Lee retweeted
Hyuna Lee
@PaduckLeeFeb 11
BlackField #Ransomware md5: 88da420dd5d82f1ca7c247f1305e37c4 ext: .BlackFL note: BlackField-ReadMe.txt DLS: xcou7t6a4qlecsr7ipmxlwsseghxbebqltnxwaurxx3bbsbts7ljacqd[.]onion mail: [email protected], [email protected]
2
4
28
2,998
Hyuna Lee retweeted
Hyuna Lee
@PaduckLeeFeb 10
🚨 New #Ransomware Group: Reynolds DLS: bs2tlg32pfjwmclm22cyngqmoo24cdlhfxzbruwrdaxumisfeory32qd[.]onion
1
6
1
31
6,657
Hyuna Lee retweeted
JAMESWT@JAMESWT_WT13 Nov 2024
#Ymir #ransomware Some Related Samples 💮bazaar.abuse.ch/browse/tag/Y… Ip Related Samples ✅bazaar.abuse.ch/browse/tag/8… ✅bazaar.abuse.ch/browse/tag/9… ✅bazaar.abuse.ch/browse/tag/7… Reference 🧾securelist.com/new-ymir-rans… 🧾xitter.cf/malwrhunterteam/status…
Pierluigi Paganini - Security Affairs@securityaffairs12 Nov 2024
#Ymir #ransomware, a new stealthy ransomware grow in the wild securityaffairs.com/170814/m… #securityaffairs #hacking #malware @kaspersky @KasperskyLabIT @e_kaspersky @Kaspersky_ru

Ymir ransomware, a new stealthy ransomware grow in the wild

New Ymir ransomware was deployed in attacks shortly after systems were breached by RustyStealer malware, Kaspersky warns.

securityaffairs.com
11
1
29
8,875
Hyuna Lee retweeted
S!Ri@siri_urz13 Nov 2024
Killnet #Ransomware 003A07EDAA89B9EEA34AF223B4F41B49
7
25
3,495
4.251.123[.]83 - in Microsoft's network... 🤷‍♂️
5
6
26
5,708
🇰🇵 Lazarus Group cluster (BeaverTail) 165.140.86.227:1244/pdown (1/94 VT) 66.235.168.232:1244/pdown (1/94 VT) 45.43.11.201:1244/pdown (1/94 VT) 38.92.47.151:1244/pdown (1/94 VT) 38.92.47.91:1244/pdown (3/94 VT) 38.92.47.85:1244/pdown (1/94 VT) 147.124.197.138:1244/pdown (1/94 VT) 147.124.197.149:1244/pdown (1/94 VT) hunting query on @urlscanio: page.url:\:1244\/pdown #IOC #Threat #APT #CTI #ThreatHunting
Michael Koczwara
@MichalKoczwara10 Oct 2024
🇰🇵Lazarus Group cluster (BeaverTail) /23.106.70.154:1244/pdown (0/94 VT) /23.106.253.194:1244/pdown (8/94 VT) /23.106.253.215:1244/pdown (1/94 VT) /23.106.253.221:1244/pdown (1/94 VT) /23.106.253.242:1244/pdown (0/94 VT) How it works. 🦫BeaverTail downloads a Python executable (`p[.]zip`) to the compromised machine from `<C2server>:1224/pdown`. p[.]zip hash 6a104f07ab6c5711b6bc8bf6ff956ab8cd597a388002a966e980c5ec9678b5b0 Downloading Python is necessary to execute the InvisibleFerret backdoor payload, as it is written in Python. This enables InvisibleFerret to operate across multiple operating systems (Windows, Mac, and Linux). Ref: group-ib.com/blog/apt-lazaru…
4
21
2
108
12,008
Seraphin Ransomware panel. This claim was never confirmed or denied. @amazon I can confirm that Seraphin changed their name during the final building stage. Seraphin —> Embargo Ransomware.
2
10
29
3,276
#delshad #ransomware IOC; notmalicious[.]services hello.exe Malware url: virustotal.com/gui/file/c367…
3
6
26
3,442
After #OperationMagnus, the takedown of #RedLine Stealer and #META Stealer, #ESETresearch is publicly releasing our and Flare’s @flaresystems 2023 research into RedLine's backend, along with recent discoveries made based on data shared with us by the Dutch National Police: welivesecurity.com/en/eset-r… 1/6

Life on a crooked RedLine: Analyzing the infamous infostealer’s backend

Following the takedown of RedLine Stealer by international authorities, ESET researchers are publicly releasing their research into the infostealer’s backend modules.

welivesecurity.com
1
33
1
78
12,791
Hyuna Lee retweeted
Will@BushidoToken7 Nov 2024
ICYMI: Excellent @ReliaQuest threat report on Scattered Spider, which is now running with the RansomHub RaaS 🔎 They used social engineering against the help desk to compromise the CFO’s account and then socially engineered the helpdesk to get DA too 🤦‍♂️ reliaquest.com/blog/scattere…

Scattered Spider x RansomHub: A New Partnership

In this report, we explore Scattered Spider's evolution from low-level cybercrimes to partnering with ransomware groups to target major organizations

reliaquest.com
20
60
5,556
#hellcat #helldown #ransomware #IOC's 0bfe25de8c46834e9a7c216f99057d855e272eafafdfef98a6012cecbbdcfabf Hellenc.exe 3e3fad9888856ce195c9c239ad014074f687ba288c78ef26660be93ddd97289e 7cd7c04c62d2a8b4697ceebbe7dd95c910d687e4a6989c1d839117e55c1cafd7
1
2
18
3,411
Sample is now on VT! 🚩Hash: 561b29a5650ff7fe6e63fa19c29ee240 🎯Actor name: ScarCruft 🔹Comment: ScarCruft, also widely known as APT37 or Reaper APT, is an espionage group associated with North Korean state activities that target high-value individuals. The group has been active since 2012, and while its primary target is South Korea… 🌐URL: socradar.io/threat-actor-pro… 🔎OnVT: virustotal.com/gui/file/561b…

Dark Web Profile: ScarCruft / APT37

[Update] October 17, 2024: “ScarCruft Exploits CVE-2024-38178 to Deploy RokRAT Malware” ScarCruft, also widely known as APT37 or Reaper APT, is an espionage group associated with North Korean state...

socradar.io
1
7
20
3,459
Using @Huntio to hunt for 🇰🇵Lazarus/APT38 clusters is an effective way to understand which crypto-related companies are targeted by this threat actor. For example, we've observed a DPRK threat actor using the host 104.168.165.165 to create fake Hack VC subdomains, such as. /hack-vc.online-meets.xyz /hack-vc.video-meets.pro /xyzhack-vc.video-meets.xyz /video-meets.xyzhack-vc.video-meets.xyz /hack-vc.video-meets.xyzhack-vc.video-meets.xyz /hack-vc.video-meets.xyz /hack-vc.video-meets.site to impersonate/target the company.
2
35
123
11,364
"encrypter-linux-esxi-x86", a sample of Beast ransomware's Linux version: 66f86812a6593cdd760cd2119f8bf1a76f33a1b56ab099edc02de7b0629ea15d It's on VT from months ago, but at the last time it was scanned, a week ago, still had only 2 detections... 🤷‍♂️
2
13
62
10,340
Schneider Electric after being hit by ransomware for the third time Jun 28, 2023 — cl0p ransomware Feb 20, 2024 — Cactus ransomware November 4, 2024 — Hellcat ransomware
22
56
5
479
44,070
UNCOVERING 🇺🇸POLITICAL CAMPAIGN 152.53.38.103 🇦🇹 IP found with Sensitive #US #Data: Voters List, Verifications & #Rhysida #Ransomware Group leaks! More info: justpaste.it/aco20 #FBI #CISA #infosec #Election2024 #databreach #OSINT #threatintel #security #infosec #hack
2
9
41
8,388
VT 0 detections, 🧐. Looks like we’ve got ourselves an #ELF edition of #Helldown #Ransomware at #IOC 78.46.194[.]43/e.dat, zeroing in on VMware virtual platforms. It’s going for .vmdk, .vswp, .log, .vmem, .vmsn, and .vmx files. Stay vigilant!⏰⏰ @Xlab_qax
2
10
2
47
22,183
#ransomware was found on this IP that is possibily #hellcat ransomware virustotal.com/gui/file/6ef9…
Alex. Turing@TuringAlex31 Oct 2024
VT 0 detections, 🧐. Looks like we’ve got ourselves an #ELF edition of #Helldown #Ransomware at #IOC 78.46.194[.]43/e.dat, zeroing in on VMware virtual platforms. It’s going for .vmdk, .vswp, .log, .vmem, .vmsn, and .vmx files. Stay vigilant!⏰⏰ @Xlab_qax
3
23
2
94
20,236
Some low detected x64 Linux ransomware sample: 20e0e61d27762a524f6974fb9f4995062582db351d5576e62a214d6b5e5808e7 "WEAXOR" is the name used on the payment / chat site. 🤔 193.143.1[.]139
4
10
31
6,750
Hyuna Lee retweeted
rivitna@rivitna22 Nov 2024
#WEAXOR #Ransomware What's it? Is this a rebranding of #Mallox ransomware? weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd[.]onion lazylazy@tuta[.]com help.service@anche[.]no virustotal.com/gui/file/e21c…
2
12
22
6,557
Load more