Calwarez retweeted
We just opened up a new role on our team. Hit me up if you have questions: job-boards.greenhouse.io/rec…
Calwarez retweeted
In an international law enforcement operation 👮, the US Department of Justice 🇺🇸, in cooperation with private sector partners, have taken down notorious bulletproof hosting provider Virtualine 💥
➡️ justice.gov/usao-edva/pr/bul…
Operating as AS202412 (Omegatech LTD), Virtualine received upstream connectivity from German 🇩🇪 providers aurologic GmbH (AS30823) and Pfcloud UG (AS51396), as well as French 🇫🇷 PEERXY NETWORKS SAS (AS213382), as bgp .tools shows. This network connectivity is now gone, currently making it impossible for Omegatech to operate 🛑
Omegatech announced 24x /24 IPv4 CIDRs, totaling 6,144 IPs. Out of these, hundreds were seen daily participating in spamming, internet-wide scanning, and botnet C2 hosting ⤵️
🌐 URLhaus tracked over 10,000 malware distribution sites at Omegatech: urlhaus.abuse.ch/asn/202412
📡 ThreatFox logged 2,000+ community-shared IOCs tied directly to Omegatech: threatfox.abuse.ch/asn/20241…
The hoster primarily served malicious infrastructure associated with RATs 🖥️ (e.g., PureRAT and OverlordRAT), rogue ScreenConnect servers 🔌, and social engineering malware campaigns like ClickFix and ErrTraffic 🖱️. While internet abuse for sure can happen, Virtualine was not reacting on abuse reports at all and advertised their "bulletproof hosting services" on the darkweb, as investigation shows 🕵️♀️
The takedown of Omegatech is welcome news. However, its long-term impact remains uncertain. Bulletproof hosters commonly re-brand and resume operations under new ASNs quickly 🔃
Furthermore, Omegatech is just the tip of the iceberg. Other active bulletproof hosters include:
➡️ AS219502 (STORMCLOUD)
➡️ AS207043 (DEDIK-IO)
➡️ AS214351 (FEMOIT)
What do they all have in common? According to bgp .tools, they all receive upstream connectivity from German provider aurologic GmbH (AS30823) as well 🔍👀
If you don't want to worry about the threats posed by bulletproof hosters, just block any CIDRs and ASNs listed on @spamhaus 's Don't Router Or Peer List (DROP):
🛑 spamhaus.org/blocklists/do-n…
ALT bgp.tools showing historic BGP upstream connectivity of Omegatech LTD provided by AS213382 PEERYX, AS30823 aurologic GmbH and AS51396 Pfcloud UG
Calwarez retweeted
1/8 Today, @JulianVoeg from @RecordedFuture and I are publishing “Break the Silence: Tracking Silent Lynx Through Exposed Infrastructure,” a report on cyber espionage across Central Asia and the wider CIS that we presented today at @virusbtn
blog.talosintelligence.com/b…
Calwarez retweeted
Wow, Julian is such a legend. Always showing us how good threat research is done.
Our long time friend and research partner, Julian Ferdinand Vögele (@JulianVoeg), brings us a deep analysis of Middle Eastern threat actors.
He is taking us on a nice stroll, revealing a fragmented yet deeply interconnected cyber ecosystem shaped by hidden relationships, shared operational structures, and an increasingly industrialized approach to cyber power.
Calwarez retweeted
New GRU update is live. #bluedelta #APT28 #fancybear this builds on some excellent reporting by lab52 recordedfuture.com/research/…
Calwarez retweeted
First blog out today via @RecordedFuture: Reviewing CopyCop’s recent targeting of Western AI investments in Armenia and potential areas where the influence operation may target next.
Read: recordedfuture.com/blog/copy…
Calwarez retweeted
Come read TWO new @threatinsight blogs on Russia state-aligned threat actors doing some funky exploitation over email 🔥 with accompanying NSA/FBI reporting 👾
Calwarez retweeted
1/ We just published new research on TAG-195 (“Golden Chickens”/“Venom Spider”), documenting a major evolution of one of cybercrime’s longest-running Malware-as-a-Service ecosystems.
recordedfuture.com/research/…
Calwarez retweeted
New blog is out! Digging into TAG-150’s evolving tradecraft across #DinDoor, #DenoRAT, and #NightshadeC2.
We break down the infection chain from ClickFix/MSI → AI-generated PowerShell → DinDoor → DenoRAT, which ultimately executes NightshadeC2 in memory via a Python loader that invokes reflective PE injection shellcode.
esentire.com/blog/dindoor-de…
ALT https://www.esentire.com/blog/dindoor-denorat-and-nightshadec2-analyzing-tag-150s-evolving-tradecraft
Calwarez retweeted
Alexander Volosovik (Yalishanda) & his hosting front Media Land LLC are, as of today, finally sanctioned by the EU 🙏 eur-lex.europa.eu/legal-cont…
Calwarez retweeted
Their interests may differ, but their target is the same "Despite different collection priorities, both [China and India state hackers] targeted Balochistan Police in Pakistan, a force sitting at the intersection of internal security, counterinsurgency, and regional geopolitics"
1/ Today @JulianVoeg and I published research on suspected China- and India-nexus espionage actors targeting Pakistani law enforcement. s1.ai/spy2flags
Calwarez retweeted
1/ Today @JulianVoeg and I published research on suspected China- and India-nexus espionage actors targeting Pakistani law enforcement. s1.ai/spy2flags
Calwarez retweeted
Today @milenkowski from @LabsSentinel and I are publishing a project we've been working on for a while. We found suspected China- and India-linked espionage actors independently targeting the same victim, the #Balochistan Police in #Pakistan: s1.ai/spy2flags
Calwarez retweeted
In August 2025, @_whoisnt and I documented how Stark Industries evaded EU sanctions.
This week, Dutch authorities arrested two individuals and seized hundreds of servers linked to WorkTitans BV in an investigation into sanctions evasion. volkskrant.nl/binnenland/how…
Calwarez retweeted
New from @RecordedFuture!
@_whoisnt and I break down Threat Activity Enablers (TAEs), the often overlooked backbone of modern cyber operations.
🔗recordedfuture.com/blog/thre…
Calwarez retweeted
OMEGATECH (AS202412) is the latest installment of Threat Activity Enabler Virtualine Technologies, following their transition away from Railnet LLC.
NEW: Block one ASN, disrupt sixteen malware families.
OMEGATECH (AS202412) — a three-month-old bulletproof hosting network with 18 /24 prefixes (4,608 IPs). One subnet alone hosts 67 C2 servers:
Remcos (6,562 sightings), AsyncRAT (4,379), Amadey, Latrodectus, XWorm, Stealc, DCRat, LOBSHOT, Eye Pyramid, Mirai, Bashlite, Quasar, ClearFake, SectopRAT, SuperShell, SheetRAT.
Seychelles .sc abuse contact. Pfcloud UG transit. Zero legitimate traffic.
We recovered an Amadey credential stealer plugin (cred64.dll) targeting Chrome, Firefox, Outlook, Thunderbird, FileZilla, WinSCP, and Monero wallets.
3 YARA + 10 Suricata on GitHub.
Full writeup: intel.breakglass.tech/post/o…
h/t @Fact_Finder03
Calwarez retweeted
Noticed Microsoft Defender tagging #TheVoidStealer as #WallStealer thanks to some recent @abuse_ch uploads. Here’s the threat actor nikoniko (aka “TheVoidStl”) discussing the removal of multiple detections, including WallStealer.
Void Stealer Tor C2 panel
http[://ddccvyclo5p7qdwkvgithmfd2wensrnuvz6hfpjqupgsyzalvq6h4xid.onion/fakjak3ak/aghgfaasfaa/login
I have a mid confidence that below IOCs belongs to Void Stealer.
intercttp[.xyz
jjjgaasda[.live
151[.243.113.71:8080
83[.217.209.227:8080
185[.107.74.138:8080
193[.233.112.254:8080
@500mk500 !!
Calwarez retweeted
CVE-2026-25253
⚠️ OpenClaw (Moltbot / Clawdbot) – 1-Click RCE via Token Exfiltration
A high-severity vulnerability (CVSS 8.8) has been disclosed in OpenClaw allowing remote code execution with a single click.
The flaw is a logic issue where the Control UI blindly trusts a gatewayUrl supplied via query string and auto-connects over WebSocket, leaking the stored gateway token to attacker-controlled infrastructure.
By abusing cross-site WebSocket hijacking and privileged operator scopes, attackers can disable safety approvals, escape the container, and execute arbitrary commands directly on the host even when the gateway is bound to localhost only.
Modat previously identified exposed Clawdbot/Moltbot control panels, with numbers now even higher. You can read the full blog here modat.io/post/moltbot-unmask…
Fixed in: v2026.1.29
Action: Patch immediately and rotate gateway tokens.
Modat Magnify Query:
web.title~"Clawdbot Control" OR web.title~"OpenClaw Control" OR web.title~"Moltbot Control"
The platform:
magnify.modat.io/
#threatintel #vulnerability #CVE202625253 #OpenClaw #Moltbot #Clawdbot #RCE #AIsecurity #infosec #ModatMagnify
Calwarez retweeted
New Modat Magnify updates are live.
• Time-based filtering
• Unified IP detail view
• Certificate validity filtering (expired, not yet valid, abnormal lifetimes)
• CN wildcard & partial matching
• Issuer Alternative Name (IAN) search
• Empty field search with field=""
• TLS version filtering
• Banner hex search
• New Tags: VPN and PQC over SSH
Built for faster, more precise infrastructure investigations.
Explore the new features inside the platform:
magnify.modat.io/
Calwarez retweeted
Use YARA for threat hunting?
.@theidr0p created a tool for automated YARA rule creation based on the Cert Graveyard.
Automatically checks for updates to the database and generates rules.
The art is theirs. Amazing.
See link in thread for details
