@thehellu

Threat researcher @trendai_RSRCH mostly focused on #APT

Joined February 2011
  • Tweets247
  • Following605
  • Followers2.2K
71Media
Ever wonder how attackers use advanced tools to evade detection? Mandiant analyzes #ScatterBrain, an obfuscator in the POISONPLUG.SHADOW backdoor, which is used by China-nexus actors. Learn how we’re unmasking these sophisticated threats. Read more: bit.ly/42xfceL
34
2
74
7,331
Daniel Lunghi retweeted
Jl_N_@Jl_N_17 Jul 2024
Nous recrutons dans notre équipe. Si vous avez des compétences en RE, souhaitez travailler au profit de la Gendarmerie en tant qu'expert judiciaire et manager une équipe de passionnés : ministereinterieur-career.ta… (rt apprécié)
10
5
1,409
Daniel Lunghi retweeted
Mark Kelly@markkelly0x20 Mar 2024
It’s been a minute since the last i-SOON blog 🇨🇳@RecordedFuture is releasing further research exploring infrastructure, tooling, victimology, and personnel overlap between I-SOON & multiple Chinese state-sponsored groups: RedAlpha, RedHotel, & POISON CARP recordedfuture.com/attributi…
1
30
1
79
9,332
Daniel Lunghi retweeted
Paul Rascagnères@r00tbsd12 Jul 2023
If you missed it yesterday, Microsoft released an advisory concerning the CVE-2023-36884: msrc.microsoft.com/update-gu…. This RCE is currently used by a TA and there is no patch. You should apply the mitigation described in the advisory. 1/4
4
168
3
364
81,359
#désinformation #Ukraine La Ministre @MinColonna et le SGDSN ont rendu public aujourd’hui le versant français d’une campagne de désinformation massive que nous pouvons avec certitude attribuer à des acteurs russes : sgdsn.gouv.fr/files/files/13…
2
27
1
45
13,599
the second part of the blogpost about rust/discord... info stealer, co-authored with @_niteshsurana Info Stealer Abusing Codespaces Puts Discord Users at Risk trendmicro.com/en_us/researc…

Info Stealer Abusing Codespaces Puts Discord Users at Risk

trendmicro.com
1
3
683
Daniel Lunghi retweeted
ExaTrack@ExaTrack28 Mar 2023
An unknown 🐼APT discovered by ExaTrack🔥Our team identified an implant and a rootkit targeting Linux systems 🔎We traced the infrastructure used by the attackers and analyzed their backdoors to share a blog post and 70 indicators (including 3 Yara rules)! blog.exatrack.com/melofee/
2
54
2
96
22,145
Daniel Lunghi retweeted
fMz@0xfmz14 Mar 2023
Our research on Tick APT group is out! 👇
ESET Research
@ESETresearch14 Mar 2023
#ESETResearch discovered an attack by APT group Tick against a data-loss prevention (DLP) company in East Asia and found a previously unreported tool used by the group. welivesecurity.com/2023/03/1… @0xfmz 1/6

The slow Tick-ing time bomb: Tick APT group compromise of a DLP software developer in East Asia

ESET Research uncovered a campaign by APT group Tick against a data-loss prevention company in East Asia and found a previously unreported tool used by the group

welivesecurity.com
2
7
1,096
💻Last week I presented at @ComfyConAU about code graphology and how it can be used for exploit hunting! Here is a thread on what was discussed and how you can apply code graphology in your research! #infosec #threatintel #exploit #yara🧵👇
2
13
28
Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning speakerdeck.com/takahiro_har… the latest discovered Winnti 4.0 and ShadowPad C2 IoCs github.com/carbonblack/activ…

Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning

Oct 2022, Virus Bulletin (short) and CODE BLUE (full) https://www.virusbulletin.com/conference/vb2022/abstracts/tracking-entire-iceberg-long-term-apt-m…

speakerdeck.com
2
49
1
89
Daniel Lunghi retweeted
Gael@GGtld24 Oct 2022
C'est très bête, mais un reverse MX sur <smtp.yopmail .com> permet de lister tous les NDD permettant de faire l'alias via yopmail, sans avoir à se contenter de la liste publique des NDD alternatifs de #yopmail...
1
5
Daniel Lunghi retweeted
Arkbird@Arkbird_SOLG20 Oct 2022
I share the available samples and Yara rule of Korplug, Tifa and Yuma downloader version used by Earth Berberoka/DiceyF group. Samples: bazaar.abuse.ch/browse/tag/E… Yara: github.com/StrangerealIntel/…
1
6
2
19
👾 Grab an oRAT sample from @objective_see's malware collection: objective-see.com/downloads/… (pw: infect3d) And mahalo to @TrendMicro for their initial oRat triage 🙏🏽🙏🏽 "New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware" trendmicro.com/en_us/researc…
1
5
14
While we came across chat app #Mimi when we were investigating #APT group Earth Berberoka, we noticed Iron Tiger controlling the servers hosting the app’s installer. Find more details of the attack here: research.trendmicro.com/3QC4…

Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users

https://www.trendmicro.com/en_no/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html

trendmicro.com
4
2
Daniel Lunghi retweeted
Digital_Monet@aRtAGGI30 Aug 2022
I am beyond excited to drop new research today with my coauthor @cyberoverdrive on TA423/RedLadon (aka Leviathan). It’s rare for @threatinsight to partner with others but Sveva and @PwC Global Threat Intelligence Team are among the rarest talents. 1/3🧵 proofpoint.com/us/blog/threa…

Cyber Espionage in the South China Sea | Proofpoint US

Proofpoint's Threat Research Team has released details on recent cyber espionage activity in the South China Sea. Learn more about the recent campaigns.

proofpoint.com
7
73
3
174
WATCH 🎬 In our report, we provide an overview of the #APT group Earth Berberoka’s targets and infection vectors. Learn more as we uncover the group’s tools and techniques for delivering malware to its victims: research.trendmicro.com/3MMQ…

Exposing Earth Berberoka

3
5
Daniel Lunghi retweeted
Digital_Monet@aRtAGGI1 Mar 2022
#Phishing #Ukraine #EuropeanGovernment @Proofpoint identified compromised private military email account delivering #SunSeed Lua malware to NATO govs. XLS Macros, #Yara Sigs, & @ET_Labs sigs will be made public for the community to defend themselves! 1/3 proofpoint.com/us/blog/threa…
3
21
1
40
#TheCaseOfEarthLusca: #EarthLusca is an elusive threat actor that targets organizations globally through #cyberespionage. WATCH: research.trendmicro.com/Eart…

The Case of Earth Lusca

4
7
Daniel Lunghi retweeted
nitrogenc@nitrogenc10 Feb 2022
Now performing tile decompression. #RDP #BitmapCache #BMC #DFIR #Forensics github.com/ANSSI-FR/bmc-tool…

GitHub - ANSSI-FR/bmc-tools: RDP Bitmap Cache parser

RDP Bitmap Cache parser. Contribute to ANSSI-FR/bmc-tools development by creating an account on GitHub.

github.com
14
19
Daniel Lunghi retweeted
ekt0@ektoplasma_28 Dec 2021
Today we are very proud to release IRIS: github.com/dfir-iris/iris-we…. It is a collaborative platform designed for and by IR analysts. Developed and used by the @AirbusCyber CSIRT (special mention to the main dev, @White_Kernel). 1/4

GitHub - dfir-iris/iris-web: Collaborative Incident Response platform

Collaborative Incident Response platform. Contribute to dfir-iris/iris-web development by creating an account on GitHub.

github.com
4
131
7
305
Load more