Kurt Baumgartner retweeted
Everyone considering a professional career in security research, RE, and Malware Analysis needs to know YARA Rules.
YARA Rules are used throughout the industry next to STIX 2.1 Standard to classify and identify malware.
It's in essence, pattern matching utilizing static signatures from strings, IOC's and other unique identifiers close to functionality as possible. You can't use the digest/hash on a family that mutates with new variants and forks every week so YARA fixes that problem.
I encourage you to get familiar and read the docs which I will link below. I write YARA rules for every analysis I conduct and I post on openbin.ai
yara.readthedocs.io/en/stabl…
#cybersecurity
#malware
#reverseengineering
#malwareanalysis
Kurt Baumgartner retweeted
This is the best visualisation of just how massive and expansive the Epstein network of people and organisations is.
epsteinsecrets.com/network?n…
Kurt Baumgartner retweeted
Two U.S. Nationals Sentenced for Facilitating Fraudulent Remote Information Technology Worker Scheme that Generated $5M in Revenue for the Democratic People’s Republic of Korea
“For years, the defendants enriched themselves by assisting North Korean actors in a fraudulent scheme to gain employment with U.S. companies,” said Assistant Attorney General for National Security John A. Eisenberg. “The ruse placed North Korean IT workers on the payrolls of unwitting U.S. companies and in U.S. computer systems, thereby harming our national security. NSD will hold accountable those who facilitate North Korea’s illicit revenue generation efforts.”
🔗: justice.gov/opa/pr/two-us-na…
Kurt Baumgartner retweeted
BREAKING: You checked the weather this morning.
And you just told a surveillance company where you sleep.
Meet #Webloc, used by ICE, cops & foreign govs to track 500m+ phones.
No warrant required.
Our latest @citizenlab investigation + how to protect yourself 🧵/1
Kurt Baumgartner retweeted
The @FBI has identified cyber actors associated with Russian Intelligence Services targeting users of commercial messaging applications, including Signal.
The campaign targets individuals of high intelligence value, including current and former U.S. government officials, military personnel, political figures, and journalists.
Globally, this effort has resulted in unauthorized access to thousands of individual accounts. After gaining access, the actors can view messages and contact lists, send messages as the victim, and conduct additional phishing from a trusted identity.
It's important for you to be aware and take action - this vulnerability is not with the application - but you as the end user.
The FBI and CISA have released a joint PSA to help you identify this activity and protect your accounts: ic3.gov/PSA/2026/PSA260320
Kurt Baumgartner retweeted
Today the Danish Defence Intelligence Service attributed two cyberattacks to Russia. We strongly condemn these attacks against a Danish water utility and Danish websites during elections in DK. We call on Russia to cease these malicious cyber activities
fe-ddis.dk/globalassets/fe/d…
Kurt Baumgartner retweeted
It’s been a while since I read a good blog post about WiFi hacking tricks. The hack does not necessarily have to be complex to work.
Really great blogpost about bypassing client isolation on wifi networks (WPA till 2 and public) from Ben Knight pulsesecurity.co.nz/articles…
Kurt Baumgartner retweeted
Well, that was nuts!
Thank you to all of our speakers, staff, sponsors, and guests who made the inaugural 🆘 a smashing success and deepened the vibe. We hope you had as much fun as we did.
Au revoir?
Kurt Baumgartner retweeted
On the pod, Dave Aitel reacts to a L3Harris Trenchant exec pleading guilty to selling exploits to Russian brokers @daveaitel
Kurt Baumgartner retweeted
We’re excited to announce that The Vertex Project (@vtxproject) is a sponsor of State of Statecraft 2025. Their generous support helps make our event possible.
The Vertex Project creates technology for analytical teams to provide intelligence-driven insights to decision makers.
Check out their website vertex.link to learn more and join us in thanking them for their support! 🙌
#what_is_sos #VertexProject #VertexSynapse
Kurt Baumgartner retweeted
State of Statecraft (SOS) is a new security and intelligence conference purposed to bring together observers of espionage, sabotage, influence, and other unique forms of covert statecraft to share their work with a community hyper-focused on tackling state-sponsored ops.
Kurt Baumgartner retweeted
A Chinese cyberespionage actor was arrested in Italy over the holiday and faces extradition to the US. The crew he's connected to is pretty serious. reuters.com/world/china/ital…
Kurt Baumgartner retweeted
🚨 GreyNoise has detected active exploitation of Silk Typhoon-linked CVEs in the past 24 hours. 90 threat IPs actively targeting. Full analysis: greynoise.io/blog/active-exp… #GreyNoise #Cybersecurity #SilkTyphoon
Kurt Baumgartner retweeted
Since late February 2025, Microsoft has observed Moonstone Sleet, a North Korean state actor, deploying Qilin ransomware at a limited number of orgs. Qilin is a ransomware as a service (RaaS) payload used by multiple threat actors, both state-sponsored and cybercriminal groups.
Kurt Baumgartner retweeted
Justice Department Charges 12 Chinese Contract Hackers and Law Enforcement Officers in Global Computer Intrusion Campaigns
🔗: justice.gov/opa/pr/justice-d…
Kurt Baumgartner retweeted
🚨 Suspicious French-themed domains spotted in the Prospero OOO (RU) range! 🚨
A cluster of domains mimicking BNP Paribas, Ameli, La Poste, Netflix, and more—likely set up for fraud. Stay vigilant!
🕵️♂️ Examples:
15-bnpparibas[.]com
5-bnpparibas[.]com
8-bnpparibas[.]com
accueil-cle[.]com
accueil-compte[.]com
accueil-macle[.]com
accueil-monespace[.]com
activation-compte[.]com
activation-moncompte[.]com
aide-agricole[.]com
compte-info[.]com
comptenei-fiix[.]net
compteneifiix[.]net
comptepalment[.]net
consigne-laposte[.]info
consignes-solutions[.]com
consigneservices[.]com
contact-moncompte[.]com
contestation-operation[.]com
contestation-paiements[.]com
contester-une-operation[.]com
dossier-amandes[.]com
dossier-declaration[.]com
dossier-remboursementfiscal[.]com
e-carte-vitale-dossier[.]com
espace-moncompte[.]com
espaceclientservices[.]com
fraude-dossier[.]com
information-bnpparibas[.]com
louvrebanqueprivee-moncompte[.]com
moncompte-ameli[.]com
moncompte-sante[.]net
moncompte-securise[.]com
moncomptesnetflix[.]com
neifiixcompte[.]com
neifiixcompte[.]net
remboursement-dossier-impot[.]com
remboursement-dossier[.]com
sms-compte[.]com
snapchat-moncompte[.]com
solutionsconsignes[.]com
votre-dossier-fiscal[.]com
votre-dossierremboursement[.]com
votre-remboursement-dossier[.]com
votredossier-remboursement[.]com
#CyberSecurity #Phishing #FraudAlert
Kurt Baumgartner retweeted
Bybit Hack Forensics Report
As promised, here are the preliminary reports of the hack conducted by @sygnia_labs and @Verichains
Screenshotted the conclusion and here is the link to the full report: docsend.com/view/s/rmdi832mp…
Kurt Baumgartner retweeted
Seashell Blizzard's specialized operations have ranged from espionage to information operations and cyber-enabled disruptions. Seashell Blizzard overlaps with activity tracked by other security vendors as BE2, UAC-0113, Blue Echidna, Sandworm, PHANTOM, BlackEnergy Lite, APT44.
Kurt Baumgartner retweeted
Microsoft is publishing research into a subgroup within the Russian state actor Seashell Blizzard and its multiyear initial access operation, tracked by Microsoft Threat Intelligence as the "BadPilot campaign". msft.it/6016UWWo2
Kurt Baumgartner retweeted
Interesting new Sandworm campaign shared by MTI
Systems exploited by Sandworm were notable:
• ConnectWise ScreenConnect (CVE-2024-1709)
• Fortinet FortiClient EMS (CVE-2023-48788)
Their change of targeting to the 🇺🇸 & 🇬🇧 is interesting too 👀
Microsoft is publishing research into a subgroup within the Russian state actor Seashell Blizzard and its multiyear initial access operation, tracked by Microsoft Threat Intelligence as the "BadPilot campaign". msft.it/6016UWWo2



























