Pinned Tweet
Released some research on Emotet with @kripthor
bitsight.com/blog/emotet-botβ¦
An interesting report showing how residential proxies are abused. All res proxy IPs were detected and indexed by @silentpush πͺ
A new device code phishing kit has hit the ground running, dubbed #GhostCode by TRU.
Features include: built-in proxy rotation via residential proxy provider "FlashProxy", bot filtering, automated attacker-device registration and email harvesting.
The victim signed into a legitimate Microsoft sign-in page, completed MFA, entered the threat actors-supplied user code, and in 78 seconds flat, threat actors had registered persistent devices in their tenant and began harvesting emails.
Read more here: esentire.com/blog/ghostcode-β¦
J retweeted
We joined a bandwidth-sharing network to see where your IP address ends up. It landed in a commercial #ResidentialProxy pool within minutes, part of 117,000+ IPs we mapped in 72 hours. full report: hubs.ly/Q04tKCtf0
J retweeted
Slides from my today's talk at #BlackHatUSA2026 : "Breaking the Seal: Static Deobfuscation of Compiled #V8 JavaScript Bytecode #Malware" : speakerdeck.com/hshrzd/break⦠// #BHUSA #BlackHat2026
J retweeted
SystemBC is still alive: 10K-plus hijacked IPs now act as SOCKS5 proxies for intrusions and #ransomware, despite Operation Endgame, @silentpush reported. Monitor IoCs, block bad IPs, hunt persistence. #cybersecurity #infosec #CISO #ITsecurity bit.ly/4c7maMs
Some botnet data from Amadey from the last 30 days :) most active botnet IDs and C2s:
07072f
1b2025
370f7b
84c97c
9a8fe7
a3dacb
b80777
e3db0b
fbf543
178.16.53[.]7
196.251.107[.]4
23.94.252[.]8
62.60.227[.]98
91.92.243[.]129
94.154.35[.]25
europol.europa.eu/media-presβ¦
@Cryptolaemus1 always eating all sorts of mealybugs π
J retweeted
We are excited that we were once again part in the coordinated international operation #OpEndgame π£, taking action against the notorious information and credential stealer #Rhadamanthys π΅οΈ We assisted in the takedown of threat actor infrastructure and share a full list of #Rhadamanthys botnet C2s on ThreatFox π¦
Full list of Rhadamanthys botnet C2s:
π‘threatfox.abuse.ch/browse/taβ¦
Europol press release:
π¨ europol.europa.eu/media-presβ¦
J retweeted
Danabot has resurfaced with version 669 after nearly a 6 month hiatus following the Operation Endgame law enforcement actions in May.
The current C2s are the following:
62.60.226[.]146:443
62.60.226[.]154:443
80.64.19[.]39:443
aqpfkxxtvahlzr6vobt6fhj4riev7wxzoxwltbcysuybirygxzvp23ad[.]onion:443
fejdqikkdwheckrutucbbyeovpdnef4bopz2fx636i67p3qpffpfxxad[.]onion:443
t77e4phezpwqebpbhdagr26ewkfaxytscimhxofws4wcisjo4wundead[.]onion:443
vsjyfpt7vcd6atniefmz36ikxrqk5eyv573a2af4e2ntb437wdch63yd[.]onion:443
Backconnect C2s:
158.94.208[.]102:443
158.94.208[.]102:8080
Danabot is currently using the following wallet addresses to steal cryptocurrency:
BTC: 12eTGpL8EqYowAfw7DdqmeiZ87R922wt5L
ETH: 0xb49a8bad358c0adb639f43c035b8c06777487dd7
LTC: LedxKBWF4MiM3x9F7zmCdaxnnu8A8SUohZ
TRX: TY4iNhGut31cMbE3M6TU5CoCXvFJ5nP59i
Fresh SystemBC at 149.28.243[.]252:443 already with victims :) I love SystemBC as well. Our boy psevdo seems to be doing alright business-wise...
mirror his soundcloud:
yt-dlp -x --audio-format mp3 soundcloud.com/queed-inc
rip to a real one @yunginnanet
