Kurt Baumgartner (@k_sec) header
Kurt Baumgartner (@k_sec) profile picture

TLPBLACK

Boulder, CO
Joined August 2010
Photo by Kurt Baumgartner (@k_sec)Photo by Kurt Baumgartner (@k_sec)Photo by Kurt Baumgartner (@k_sec)Photo by Kurt Baumgartner (@k_sec)Photo by Kurt Baumgartner (@k_sec)Photo by Kurt Baumgartner (@k_sec)Photo by Kurt Baumgartner (@k_sec)Photo by Kurt Baumgartner (@k_sec)Photo by Kurt Baumgartner (@k_sec)Photo by Kurt Baumgartner (@k_sec)
Kurt Baumgartner retweeted
Everyone considering a professional career in security research, RE, and Malware Analysis needs to know YARA Rules. YARA Rules are used throughout the industry next to STIX 2.1 Standard to classify and identify malware. It's in essence, pattern matching utilizing static signatures from strings, IOC's and other unique identifiers close to functionality as possible. You can't use the digest/hash on a family that mutates with new variants and forks every week so YARA fixes that problem. I encourage you to get familiar and read the docs which I will link below. I write YARA rules for every analysis I conduct and I post on openbin.ai yara.readthedocs.io/en/stabl… #cybersecurity #malware #reverseengineering #malwareanalysis
1
30
163
7,030
Two U.S. Nationals Sentenced for Facilitating Fraudulent Remote Information Technology Worker Scheme that Generated $5M in Revenue for the Democratic People’s Republic of Korea “For years, the defendants enriched themselves by assisting North Korean actors in a fraudulent scheme to gain employment with U.S. companies,” said Assistant Attorney General for National Security John A. Eisenberg. “The ruse placed North Korean IT workers on the payrolls of unwitting U.S. companies and in U.S. computer systems, thereby harming our national security. NSD will hold accountable those who facilitate North Korea’s illicit revenue generation efforts.” 🔗: justice.gov/opa/pr/two-us-na…
53
564
34
1,747
80,801
Kurt Baumgartner retweeted
BREAKING: You checked the weather this morning. And you just told a surveillance company where you sleep. Meet #Webloc, used by ICE, cops & foreign govs to track 500m+ phones. No warrant required. Our latest @citizenlab investigation + how to protect yourself 🧵/1
56
1,990
98
5,798
477,418
The @FBI has identified cyber actors associated with Russian Intelligence Services targeting users of commercial messaging applications, including Signal. The campaign targets individuals of high intelligence value, including current and former U.S. government officials, military personnel, political figures, and journalists.   Globally, this effort has resulted in unauthorized access to thousands of individual accounts. After gaining access, the actors can view messages and contact lists, send messages as the victim, and conduct additional phishing from a trusted identity. It's important for you to be aware and take action - this vulnerability is not with the application - but you as the end user.   The FBI and CISA have released a joint PSA to help you identify this activity and protect your accounts: ic3.gov/PSA/2026/PSA260320
2,513
3,912
666
13,807
1,941,673
Today the Danish Defence Intelligence Service attributed two cyberattacks to Russia. We strongly condemn these attacks against a Danish water utility and Danish websites during elections in DK. We call on Russia to cease these malicious cyber activities fe-ddis.dk/globalassets/fe/d…
191
973
79
3,718
421,122
Kurt Baumgartner retweeted
It’s been a while since I read a good blog post about WiFi hacking tricks. The hack does not necessarily have to be complex to work.
1
15
2,033
Well, that was nuts! Thank you to all of our speakers, staff, sponsors, and guests who made the inaugural 🆘 a smashing success and deepened the vibe. We hope you had as much fun as we did. Au revoir?
1
8
1,040
Kurt Baumgartner retweeted
On the pod, Dave Aitel reacts to a L3Harris Trenchant exec pleading guilty to selling exploits to Russian brokers @daveaitel
5
8
1
50
10,041
We’re excited to announce that The Vertex Project (@vtxproject) is a sponsor of State of Statecraft 2025. Their generous support helps make our event possible. The Vertex Project creates technology for analytical teams to provide intelligence-driven insights to decision makers. Check out their website vertex.link to learn more and join us in thanking them for their support! 🙌 #what_is_sos #VertexProject #VertexSynapse
6
18
2,409
State of Statecraft (SOS) is a new security and intelligence conference purposed to bring together observers of espionage, sabotage, influence, and other unique forms of covert statecraft to share their work with a community hyper-focused on tackling state-sponsored ops.
2
26
4
45
12,234
Since late February 2025, Microsoft has observed Moonstone Sleet, a North Korean state actor, deploying Qilin ransomware at a limited number of orgs. Qilin is a ransomware as a service (RaaS) payload used by multiple threat actors, both state-sponsored and cybercriminal groups.
6
111
11
399
49,344
Justice Department Charges 12 Chinese Contract Hackers and Law Enforcement Officers in Global Computer Intrusion Campaigns 🔗: justice.gov/opa/pr/justice-d…
44
128
11
345
27,533
Kurt Baumgartner retweeted
🚨 Suspicious French-themed domains spotted in the Prospero OOO (RU) range! 🚨 A cluster of domains mimicking BNP Paribas, Ameli, La Poste, Netflix, and more—likely set up for fraud. Stay vigilant! 🕵️‍♂️ Examples: 15-bnpparibas[.]com 5-bnpparibas[.]com 8-bnpparibas[.]com accueil-cle[.]com accueil-compte[.]com accueil-macle[.]com accueil-monespace[.]com activation-compte[.]com activation-moncompte[.]com aide-agricole[.]com compte-info[.]com comptenei-fiix[.]net compteneifiix[.]net comptepalment[.]net consigne-laposte[.]info consignes-solutions[.]com consigneservices[.]com contact-moncompte[.]com contestation-operation[.]com contestation-paiements[.]com contester-une-operation[.]com dossier-amandes[.]com dossier-declaration[.]com dossier-remboursementfiscal[.]com e-carte-vitale-dossier[.]com espace-moncompte[.]com espaceclientservices[.]com fraude-dossier[.]com information-bnpparibas[.]com louvrebanqueprivee-moncompte[.]com moncompte-ameli[.]com moncompte-sante[.]net moncompte-securise[.]com moncomptesnetflix[.]com neifiixcompte[.]com neifiixcompte[.]net remboursement-dossier-impot[.]com remboursement-dossier[.]com sms-compte[.]com snapchat-moncompte[.]com solutionsconsignes[.]com votre-dossier-fiscal[.]com votre-dossierremboursement[.]com votre-remboursement-dossier[.]com votredossier-remboursement[.]com #CyberSecurity #Phishing #FraudAlert
4
32
1
60
8,614
Kurt Baumgartner retweeted
Bybit Hack Forensics Report As promised, here are the preliminary reports of the hack conducted by @sygnia_labs and @Verichains Screenshotted the conclusion and here is the link to the full report: docsend.com/view/s/rmdi832mp…
939
1,036
734
5,744
2,782,134
Seashell Blizzard's specialized operations have ranged from espionage to information operations and cyber-enabled disruptions. Seashell Blizzard overlaps with activity tracked by other security vendors as BE2, UAC-0113, Blue Echidna, Sandworm, PHANTOM, BlackEnergy Lite, APT44.
3
9
4,285
Microsoft is publishing research into a subgroup within the Russian state actor Seashell Blizzard and its multiyear initial access operation, tracked by Microsoft Threat Intelligence as the "BadPilot campaign". msft.it/6016UWWo2
2
77
7
171
43,804
Kurt Baumgartner retweeted
Interesting new Sandworm campaign shared by MTI Systems exploited by Sandworm were notable: • ConnectWise ScreenConnect (CVE-2024-1709) • Fortinet FortiClient EMS (CVE-2023-48788) Their change of targeting to the 🇺🇸 & 🇬🇧 is interesting too 👀
Microsoft is publishing research into a subgroup within the Russian state actor Seashell Blizzard and its multiyear initial access operation, tracked by Microsoft Threat Intelligence as the "BadPilot campaign". msft.it/6016UWWo2
4
25
80
10,990