Malware Hunter, Reverser and Club Mate addict
7c2jg8AgyMkzKMhe3NsopKfS52Gk2
Joined February 2011
- Tweets1.3K
- Following261
- Followers1.3K
- Likes1.3K
coldshell retweeted
Interested in old video game vulnerabilities? 🎮
Checkout our latest blogpost on Titan Quest : Anniversary Edition by @tomtombinary ⬇️
synacktiv.com/en/publication…
coldshell retweeted
Success! Synacktiv was able to execute a heap-based buffer overflow in the kernel triggered via WiFi and leading to RCE against the Wyze Cam v3. They earn $15,000 and 3 Master of Pwn points. #Pwn2Own
coldshell retweeted
Our team published a post about the #3cx supply chain attack. We describe the Windows & the MacOS backdoors. The timeline: the GitHub repo on December 7 & the infrastructure in November... Few months later a malicious update was sent to the customers : volexity.com/blog/2023/03/30…
coldshell retweeted
Watchout! CVE-2023-22809 on Sudo was patched today to prevent a privilege escalation on sudoedit. Read the security advisory by @aevy__ and @v1csec: synacktiv.com/sites/default/…
coldshell retweeted
Let the bees out! Escaping from the bhyve hypervisor by @abu_y0ussef 🐝
synacktiv.com/publications/e…
coldshell retweeted
I published a new article about an ESXi encryptor we found during a case. Let me know if you found a similar sample and are willing to share!
#dfir #Ransomware
During an incident response, our CSIRT discovered an ESXi ransomware called PrideLocker, based on Babuk ESX encryptor whose source code leaked in 2021, with new additions and obfuscation.
Our latest blog post provides an in-depth analysis of PrideLocker.
synacktiv.com/publications/p…
coldshell retweeted
🔊 For #BlackAlps day 2, @_p0ly_ tells us about his journey into pwning the Sonos One Speaker!
coldshell retweeted
#BlackAlps is starting! @netsecurity1, @cleptho and @abu_y0ussef are on stage to present their work on the Canon printer pwning during last year #Pwn2Own.
coldshell retweeted
Hey :)
New blog post detailing Raccoon V1 management infrastructure (victim storage location, Telegram update server, etc), MaaS infrastructure location + link to CC2BTC marketplace.
Once again, feedback warmly-welcomed 😄
BLOG POST: In this blog post we examine the upstream management infrastructure of Raccoon V1, including insight into the operators' wider business model - with connections to the #CC2BTC marketplace identified.
#RaccoonStealer
team-cymru.com/post/inside-t…
coldshell retweeted
Remote Admin tools are being more and more abused by threat actors. In our latest blogpost, @ektoplasma_ wondered what traces could be leveraged during investigations regarding some usual suspects: TeamViewer, AnyDesk, Atera, and SplashTop.
synacktiv.com/publications/l…
coldshell retweeted
Ever wanted to exploit a PHP file inclusion without having a file upload? Follow @_remsio_'s journey to discover PHP filter chains, ensuring they work properly, and transforming them into a tool. You can now convert almost any file inclusion to RCE! synacktiv.com/publications/p…
coldshell retweeted
New blog post about an UEFI firmware bootkit!
securelist.com/cosmicstrand-…
Research was led by our dearly missed @_marklech_
coldshell retweeted
Our paper on Earth Berberoka is finally out ! It contains analysis of multiple Windows, Linux and Mac malware families (PuppetLoader, oRAT, PlugX, gh0st, Xnote, Hellobot, Pupy, Reptile...), 3 different infection vectors, links to multiple known #APT groups documents.trendmicro.com/ass…
coldshell retweeted
Our ninjas are ready for their talk about hacking the Canon printer at @Cansecwest. 😄
coldshell retweeted
Amazing demonstration by @_p0ly_ and @vdehors! 0-click RCE on the @Tesla infotainment in less than a minute!
Success! To kick things off for #Pwn2Own 2022 Day 2 in style, David BERARD and Vincent DEHORS from @Synacktiv demonstrated code execution on the @Tesla infotainment system resulting in a arbitrary file write and a switch unlock. #P2O15
coldshell retweeted
Tomorrow during #CanSecWest, our ninjas @abu_y0ussef, @netsecurity1 and @cleptho will tell you how they compromised the Canon printer during the previous #Pwn2Own!
cansecwest2022.sched.com/eve…
coldshell retweeted
The slides of our Botconf talk are now online. They contain infection vectors, a focus on a complex malware family sharing a flawed RC4 implementation with TigerPlug malware, victimology and attribution hints. Let me to know if you track this #APT group botconf.eu/wp-content/upload…
