principal threat researcher and professional pleb
🗿
Joined January 2016
- Tweets762
- Following513
- Followers790
- Likes875
🐣 retweeted
Sad that I got beat to posting about this publicly after looking at it on and off since October, but there are a lot of great details in here about a previously unknown botnet written in Go! Here are some screenshots (including the operator's desktop) I had as well!
Following up on @Intel471Inc recentl report on PrivateLoader we also found another loader being leveraged - Calls itself "Anubis" Loader and is written in GoLang medium.com/walmartglobaltech…
🐣 retweeted
If this ever happens to you or anybody you know, there’s an option in that alert to view more details which tells you to bring the AirTag close or to bring it to the police
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
🐣 retweeted
I promised I would write a report covering my phishing research in 2021.
That report is now live:
steved3.io/data/Phishing-202…
Shout out to @AmandaFGoedde for helping me edit, as well as @ninoseki for making Miteru, and @urlscanio for creating an awesome tool to help defenders.
🐣 retweeted
#log4j thread
Detection Ideas + Yara by @cyb3rops - gist.github.com/Neo23x0/e4c8…
Hashes for vulnerable LOG4J versions by @mubix - github.com/mubix/CVE-2021-44…
SIGMA by @SOC_Prime - tdm.socprime.com/tdm/info/XY…
tdm.socprime.com/tdm/info/4S…
Payloads list by @GreyNoiseIO - gist.github.com/nathanqthai/…
🐣 retweeted
How can you identify the plane, location, and mission commander in this image?
With the intelligence cycle and a little automation!
This @quiztime challenge from @fiete_stegers is the hardest one I've tried so far.
New #geolocation blog post: nixintel.info/osint/planes-a…
🐣 retweeted
Sci-Fi Author: In my book I invented the Torment Nexus as a cautionary tale
Tech Company: At long last, we have created the Torment Nexus from classic sci-fi novel Don't Create The Torment Nexus
🐣 retweeted
I cannot describe the joy I feel when I think of people that write a new PoC for a new vulnerability, then notice YARA matches on their brand new exploit code & get frustrated b/c they can’t figure out how that happened
(well, it’s rather clear in this case but I got much more)
🐣 retweeted
Wow! Very poorly designed protocol here for autodiscover to fail back/back off to autodiscover.tld alone. However, this is more of a problem of the clients & the design/implementation of the autodiscover protocol itself rather than an Exchange flaw. This makes matters worse! 1/x
Excited to share the first part of my blog about how Exchange's Autodiscover causes a massive leak of domain credentials. In 4 months I gathered hundreds of thousands of domain credentials without sending a single packet.
Read about all about it here guardicore.com/labs/autodisc…
🐣 retweeted
#Avaddon victim (who didn't pay) asked the attackers to leak their data in full because they were having trouble restoring some files from backup. Threat actor clearly didn't understand, as they responded by saying if the victim didn't cooperate they would leak their data 😂
Introducing #mwcfg, a feature full #MalDuck #malware configuration extractor CLI utility.
Feel free to contribute your own modules/extractors.
Works with #mwdb #karton #framework.
Special thanks to @CERT_Polska!
github.com/c3rb3ru5d3d53c/mw…
github.com/c3rb3ru5d3d53c/mw…
🐣 retweeted
Quick blog post on the recent Android malware #FluBot that recently started targeting the UK. Will update as and when more details become available.
#malware #fraud #smishing
@nullcookies @malwrhunterteam @sysgoblin @JCyberSec_ @n0p1shing @SteveD3
infosecpaulm.com/fraud/flubo…
🐣 retweeted
As an...
– article reader
I want to...
– have news articles split across multiple pages
So that...
– I have more opportunities to see ads that I may be interested in
