#malware hunter & analyst. Opinions are my own.
Cold country
Joined June 2016
- Tweets17.6K
- Following159
- Followers27.1K
- Likes77.3K
ExecuteMalware retweeted
⚠️ RAT families showed contrasting activity trends last week. #Romulus climbed 32% while #AsyncRAT dropped 35%, with #Remcos and #XWorm also declining. Meanwhile, #FormBook gained nearly 40%.
📌 Trend to watch: declining activity among leading RATs doesn't mean every family is slowing down. SOC teams should assess detection gaps at the family level rather than assume lower volumes mean reduced exposure.
Monitor the malware driving today’s attacks: any.run/malware-trends/?utm_…
#Top10Malware
ExecuteMalware retweeted
🚨 #Formbook is Back with Regional Lures. A localized business-order lure targets European users and manufacturing orgs, delivering Formbook through an in-memory chain and persisting as SystemUpdate_*.
👨💻 See the full attack chain and collect #IOCs in #ANYRUN Sandbox: app.any.run/tasks/29a05eb9-a…
🚀 With #ANYRUN's new Related Threat Context, analysts can explore activity beyond the original sample in one connected workflow. In this case, another document themed malicious archive used similar JS lure — a useful lead for identifying related threats.
#ExploreWithANYRUN 1/3 🧵
ExecuteMalware retweeted
Hungry? This ClickFix campaign relies on some mouth-watering domain names: grillmasterspro, EmbersAndBites, and more.
Read more about an attack that starts with a Google search for Amazon business and ends with a serving of “finger-licking” malware: huntress.com/blog/amazon-cli…
ExecuteMalware retweeted
Four months after Operation Endgame, StealC's seller is back.
Dubbed Stadia, this new product is a full RAT with hidden desktop control, a command shell, a file explorer, and a loader. Varonis Threat Labs got the build the day it was listed, reversed it, and ran its panel against a host of our own, discovering that the code inside matches StealC's.
Operation Endgame forced StealC's seller to start from scratch with new servers, names, and panels, but it's clear they're not done yet.
Read more about our findings here: varonis.com/blog/stealc-retu…
ExecuteMalware retweeted
I'll deliver a new in-person workshop at SANS #AISummit, November 2-3, near DC. See you there? go.sans.org/ai-summit-fall
ExecuteMalware retweeted
REMnux now includes CILantro by @jgajek for deobfuscating and unpacking .NET malware variants. docs.remnux.org/discover-the…
ExecuteMalware retweeted
REMnux is used by many malware analysts, but till now it has only run natively on Intel/AMD systems. Now, you can run it on Apple Silicon. And now can get a prebuilt REMnux VM for several hypervisors, as well as an EC2 AMI.
REMnux now supports Apple Silicon and other arm64 systems natively, along with Intel and AMD. This includes containers and VMs. Also, you can now download prebuilt VMs for VMware, VirtualBox, Proxmox, and UTM. An EC2 AMI is available, too. docs.remnux.org
ExecuteMalware retweeted
ANYONE HAS STADIA RAT I POKE AT? 👀
Asking for a friend.
🔎 The author of StealC is advertising a new RAT built around a familiar problem for cybercriminals: losing access to the victim.
Plymouth TA introduced Stadia today, pitching a modular toolkit for persistent access and browser-based control of compromised hosts.
The advertised modules include:
▪️ HVNC with shared and hidden desktop modes, controlled directly from the browser
▪️ A stealer based on StealC v3.5
▪️ A loader supporting execution from disk and memory
▪️ Remote CMD/PowerShell access
▪️ File browsing, uploads and downloads
▪️ Process management and termination
The sales pitch is explicit. It addresses operators who get logged out of email accounts or lose contact with a “cardholder.” Stadia is presented as a way to retain access to the victim’s environment and continue operating inside it.
The advertisement also reuses the Telegram, Tox and Jabber contact details associated with StealC, linking the new offering to plymouth’s existing presence.
#ThreatIntelligence #StealC #Stadia
ExecuteMalware retweeted
Phishing activity in the past 7 days 🐟
Track latest #phishing threats in TI Lookup: intelligence.any.run/analysi…
#TopPhishingThreats
ExecuteMalware retweeted
⚠️ Last week's malware activity showed a clear contrast: #AsyncRAT dropped nearly 30%, while #DonutLoader jumped 48% and #Grandoreiro continued its upward trend. #Romulus also entered the picture as one of the week's most active threats.
📌 Trend to watch: familiar threats continue to dominate, but new entries can quickly become significant. SOC teams need to validate detection coverage for newly observed families without losing focus on persistent threats.
Monitor the malware driving today’s attacks: any.run/malware-trends/?utm_…
#Top10Malware
ExecuteMalware retweeted
Next version of PortexAnalyzerGUI will be able to zoom in and out of the PE visualization, and allow you to interactively browse structures.
Will publish this weekend or so.
(unlisted 1 min video without audio)
youtube.com/watch?v=2UHSFVXJ…
ExecuteMalware retweeted
🚨 We identified #Skyw4lker, a Device Code #phishing campaign mostly active against US orgs in manufacturing, technology, and healthcare. Victims receive a password-protected decoy doc framed as a contract or service proposal, then move from a lure on sites[.]google[.]com into MS authentication, exposing M365 token access without direct password theft.
❗️ The phishing page uses obfuscated JavaScript and a PHP backend to create a victim session, collect IP/geolocation, and keep polling until the flow completes. See the full attack chain and collect #IOCs in #ANYRUN Sandbox: app.any.run/tasks/371eeef8-8…
⚡️ Strengthen phishing detection in your SOC with #ANYRUN: any.run/use-case/phishing/?u…
#ExploreWithANYRUN
ExecuteMalware retweeted
New episode of Behind the Binary is live!
🎙️Joined by @L0Psec to break down macOS security, ClickFix social engineering, InfoStealers (AMOS/MacSync), DPRK developer targeting, and the evolution of obfuscation.
Plus, we talk about how AI is shifting reverse engineering and the inevitable future state...
🎧 podcasts.apple.com/us/podcas…
ExecuteMalware retweeted
Look who it is! That @_JohnHammond guy from @HuntressLabs, talking to us about ClickFix attacks, AI-assisted attacks, and a future hacker movie episode!
youtu.be/Umc7KZp8TRc?si=I6ob…
ExecuteMalware retweeted
Phishing activity in the past 7 days 🐟
Track latest #phishing threats in TI Lookup: intelligence.any.run/analysi…
#TopPhishingThreats
ExecuteMalware retweeted
New #AtlasRAT loader checks in with "BFuck" and the C2 protocol switched to using TLS
📡 23.226.57.50:443
📡 38.76.177.46:443
📡 43.99.101.175:443
📡 45.142.152.180:443
📡 116.204.169.70:443
📡 150.158.50.175:443
📡 156.234.7.48:443
📡 192.252.180.45:443
netresec.com/?b=26A6cc8
ExecuteMalware retweeted
New PortEx release:
➡️ performance improvements for .NET files
➡️ support for interrupting analysis
github.com/struppigel/PortEx…
ExecuteMalware retweeted
⚠️ RATs remained dominant last week, while #Grandoreiro surged more than 2.5x. #Remcos and #XWorm gained ground as #SilentNet and #ReverseLoader declined.
📌 Trend to watch: fast-growing threats can shift SOC priorities even when leading families remain stable. Tracking relative growth helps teams adjust detection coverage early.
Monitor the malware driving today’s attacks: any.run/malware-trends/?utm_…
#Top10Malware
