Security Researcher @ Lumen, black coffee connoisseur, dog lover, follower of sea turtles, SHU 13, my thoughts are my own. (he/him)
Baltimore, MD
Joined January 2010
- Tweets2.1K
- Following439
- Followers621
- Likes263
Danny 🌻 retweeted
Pivoting on the JDY C2 proxy cert hash in Hunt.io shows an IP, 45.76.67.43, that was not listed in Lumen's IOC list. Though it looks like it was only active for 2 days and has since been recycled back into Vultr.
Danny 🌻 retweeted
prnewswire.com/news-releases… I am happy to be an advisor, aka Keeper of Secrets to @ThreatHunter_AI and working with @whiskeyhacker. Watch for great things to come.
Danny 🌻 retweeted
#LABScon23 is here!
Sep 20-23, 2023 in Scottsdale, Arizona
Head to labscon.io for all the details!
Danny 🌻 retweeted
github.com/Cybrary/CTIG_Flip… the base for a repo for low power tracker research. Expect more to be added. Great research sponsored by @cybraryIT! #flipperzero #ble #airtag
Danny 🌻 retweeted
New Research -- "Tainted Love" APT Operation
✴️Targeting Middle East telecom.
✴️ Likely connected to a Chinese groups in the nexus of Gallium and APT41.
Full Report: sentinelone.com/labs/operati…
By @milenkowski @juanandres_gs @joeychen @QTrust
New blog dropping at 10am this morning , check it out here blog.lumen.com/black-lotus-l…
Oh and one more thing that caught my eye, when we looked at the embedded config file the malware identified itself as version 1.5. So while this latest campaign goes back to July 2022. This activity cluster almost certainly preceded that date.
To get all the details check out the blog here blog.lumen.com/new-hiatusrat… with IOCs found here github.com/blacklotuslabs/IO…
Setting up an account on the elephant app, hit me up there [email protected]. Don’t worry I’ll continue to provide the same threat intel, salty comments, and spicy memes as before.
Danny 🌻 retweeted
Our latest #podcast is out with an interview with @dadamitis of @BlackLotusLabs about #ZuoRAT #malware targeting SOHO routers and home networks with #APT-style tools. Recorded at #LabsCon22. zcu.io/4ktr #sponsored by @ReversingLabs zcu.io/4ktr
Bold strategy to have your campaign outed and then ramp up operations. Let’s see how this one plays out for them.
The Chaos #DDoS and cryptomining botnet continues to grow… We’ve identified 125 new certificates in the last month:
