Threat Researcher at @Huntio eCTHP | CTIA | CRTO | CRTA DM me for Collaboration on Threat Intel & Hunting 🤝 All Views are my Own⚠️
Joined November 2024
- Tweets944
- Following60
- Followers1.6K
- Likes339
Demon retweeted
Noticed a fully FUD on VT Cobalt archive that was seen from Singapore. It's a strange one:
C2 domain base: PNAlumni.dgitd.anchorbolnorth[.]com - the registrant is supposedly from Pakistan
IP: 119.160.105[.]93 - belongs to a Pakistani telecom company, and in 2024, the "official website of the Pakistan Navy War College (PNWC)" was seen resolving to this IP...
🤔
🤷♂️
Demon retweeted
🔥 New blog drop! My research introduces UAT-11587, a China-nexus group targeting government and policy organizations in 8 countries with the Antino backdoor. After a preview at @labscon_io, full technical analysis, campaign details & IoCs are now live:
blog.talosintelligence.com/c…
Demon retweeted
'PDF20260923_2244 zip' seen from India @abuse_ch
43ab0e61da5313fa1892b203e591342df2b9686cce3d55a42cfc38a1beb1b743
bazaar.abuse.ch/sample/43ab0…
URL: hxxps://gdnkdl.eu(.)cc/files/zjouad.eu.cc.bin
Demon retweeted
Found another Microsoft given cert signed sample that uses Microsoft Azure for C2 communication and fakes traffic as CrowdStrike's "CsAgent/7.04.18110.0". The name is now "Brittany Ann Martin".
asiioasdjasiojasodijasa.eastus.cloudapp\.azure.com
🤷♂️
Demon retweeted
There is a SideWinder APT detected malware sample that is signed using a cert given by Microsoft ("Alysen Mendez"), uses Microsoft Azure for storage & C2 communication, and fakes traffic as CrowdStrike's "CsAgent/7.04.18110.0".
fgjdikfhngkdfngf.eastus.cloudapp\.azure.com
🤷♂️
Demon retweeted
Quick notes on a likely #Pakistan nexus #backdoor targeting #Afghanistan 🇦🇫
#APT #Backdoor
🐞 dxgi.dll (a6ceacda670b88e8a8ec9ff5da6a77d9f1c896d6479b2dadb700474a8c408f80)
📡 C2: 185.235.137[.]35:9000
dmpdump.github.io/posts/Back…
Demon retweeted
#APT #Sidewinder
452-Revised_FAT-PSI_Committee.docx
c4fc5454fd963b667a582dda2daeca32
gfd.incised[.]live
incised[.]live
155.117.183[.]68
Demon retweeted
🚩 𝗧𝗵𝗮𝗶 𝗯𝗿𝗼𝗮𝗱𝗯𝗮𝗻𝗱 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝗿 𝘁𝗮𝗿𝗴𝗲𝘁𝗲𝗱 𝘃𝗶𝗮 𝗙𝗼𝗿𝘁𝗶𝗚𝗮𝘁𝗲 𝗦𝗦𝗟-𝗩𝗣𝗡 𝗮𝗻𝗱 𝗠𝗲𝘀𝗵𝗖𝗲𝗻𝘁𝗿𝗮𝗹
An operator left their staging server open on Thai infrastructure. AttackCapture caught it while the intrusion was still live. Inside was the full picture of an attack against one of Thailand's largest fixed-line broadband providers.
298 files, 30 subdirectories, 19 MB. Recon scripts, exploits, brute-force tooling, a live MeshCentral config, and an inventory of machines the operator already controlled.
What the toolkit shows:
- CVE-2024-21762 used against a FortiGate 60F SSL-VPN, from fingerprinting to full RCE
- MeshCentral set up as a backdoor, agents pointed at the operator's own management server under a dedicated device group
- devices.json confirms multiple hosts were enrolled and connected at capture time, agents running as root
- The provider's RADIUS databases targeted to pull subscriber credentials
- A valid OpenVPN certificate from the provider's own PKI, giving persistent access to the network
- A cleanup script staged to wipe logs and exploit files while leaving the MeshCentral agent in place
Active session cookies for a second, linked provider point to a parallel operation, so this was not a single-org hit.
Full breakdown, IOCs, and MITRE mapping here 👇hunt.io/blog/thai-broadband-…
Demon retweeted
360 researchers analyse recent attack activities by APT-C-56 (Transparent Tribe). The payload leads to LNK files combined with script execution links that ultimately load CrimsonRAT backdoor or a self-developed Golang remote control program. mp.weixin.qq.com/s?__biz=MzU…
Demon retweeted
India-nexus threat actor SloppyLemming leverages the Turkish Aerospace Industries (TUSAŞ) theme to deploy the Havoc C2 agent.
MD5 hash of the ZIP: c343a25370b2cebd481976bbba808091
Filename: Vault[.]zip
MD5 hash of the DLL: 05ae5da8e05755e3b508edff66c5945b
Filename: mscorsvc.dll
C2 domains abuse Cloudflare workers
turkey.research-department-tusas.workers[.]dev
supprot.new-turkey-tr.workers[.]dev
#threatintel
@WhichbufferArda @skocherhan @Cloudforce_One
Demon retweeted
Happy to announce a new collaboration module with @volrant136 a Threat Researcher specializing in tracking South Asian APTs.
The first lesson is now live and focuses on tracking APT SideWinder infrastructure, including practical techniques for discovering and pivoting across related infrastructure.
Demon retweeted
Pakistan arrests 258 Vietnamese & Chinese scammers in Islamabad for running transnational scam operations ministryofcyberaffairs.com/n…
Demon retweeted
Our detection rule for malicious ".accdr" documents uncovered additional samples associated with a #BitterAPT campaign.
The samples use document-themed filenames targeting government, defense, maritime, and other organizations.
Rule: valhalla.nextron-systems.com…
IOCs:
cb50ef00f2f61f976ce80e301beccf5f96e5d474ee7cd358d93c3ffc30d0c50a
7d0a481d7a13f2efdfed3e855ca1dabea17e4425c603a38bb0e9c682c63eed5c
7b44ae5e12c9a3f34002ed08d56ce00a85afcdebc430b9bff8119f9a86a6f3cb
41ae52b8e0097e03dd68f15b44bbe60ca5d0e18ef968347333b7677fbeaadd1c
1cfac820966d4bbd0537ba9007d2e1051806855c31254a92105ccc6b96c4eb68
95079f32b29e0a3d3d3a060072c1472383f249fea2c0bed4cbda175e2437f5b3
a8bcd1ad41589b00fcff8b682f2d05567f1608ba660d92ed46a669c9a1612835
We found a #BitterAPT campaign targeting maritime & government officials weaponizing a .accdr file disguised as a PDF. No macro prompt, no UAC, no unsigned binary ever runs directly.
The lure: Schedule Technical Dialogue 2026 on Maritime Security and Blue Economy Cooperation.pdf.accdr - victim sees a PDF icon, Windows hides the .accdr extension. An embedded decoy PDF opens on screen while the payload chain runs silently in the background.
How it works: AutoExec VBA fires on open. Uses MSXML2 + bin.base64 to decode all commands in memory with zero plaintext IOCs on disk. Downloads a 42KB x64 DLL (bluetooth.txt) disguised as a text file, side-loads it via the legitimate signed binary fsquirt.exe by planting a fake bthprops.cpl in C:\ProgramData.
Three base64-encoded payloads are decoded at runtime. The first fetches the DLL and triggers the side-load. The second plants a scheduled task every 17 minutes disguised as a Chrome update that beacons to the C2 and pipes the live response directly into cmd.exe, fully fileless. The last executable (winocb.txt) is likely serving as an alternate or follow-on stage delivered through the same infrastructure.
The DLL is built to survive analysis: TLS callback fires before DllMain and before sandbox hooks attach. Checks BIOS via WMI for VMware/VirtualBox/QEMU, detects debuggers, checks disk size, runs long sleeps to outlast sandbox timeouts. It only reaches out for stage 2 after all checks pass via bitsadmin, injected into a legit Windows process and never touching disk.
THOR / Valhalla YARA hits:
- MAL_Access_Accdr_Dropper_Feb26 1/60 (dropper)
valhalla.nextron-systems.com…
- APT_MAL_DLL_Launcher_May26 3/71 (DLL)
valhalla.nextron-systems.com…
- Generic_Strings_Hacktools 8/70 (dropper)
valhalla.nextron-systems.com…
IOCs:
04688dc699b886a661c98e78922c6e2e637ccfaf7ded10a4b244464930f74ed8 .accdr dropper
d0ee008d3c480d5f9f75332851ae94373158c13541f3c88be63465b975334e0a bluetooth.txt (DLL)
c9d040a4f29b91945f3218f0e37149c8292d415f0ba53a0712e977af4d0df994 winocb.txt (EXE)
ultraflavors[.]com DLL host
carlminiclub[.]com C2 beacon /pdqaz.php?d=%username%_%computername%
#Bitter #APTC08 #DLLSideloading #ThreatIntel #Maritime #LotL #SandboxEvasion
Demon retweeted
We identified a #SideCopy campaign using #CrimsonRAT, delivered through an Outlook email with an individual case-themed lure.
The email is an .msg file named "Fw_ individual Case - Aug 2026.msg". It contains an archive named "Indl Case List 2026.rar", which leads to a file named "Indl Case List 2026.pdf.lnk".
The .lnk is made to look like a PDF, but instead starts the next stage of the infection chain. It is followed by "powerpoint.bat" and an executable named "powerpoint".
The powerpoint executable is a malicious Crimson RAT sample written in C# that provides remote access and data collection capabilities and has been used by #SideCopy in previous campaigns.
The chain we observed is:
Outlook MSG → RAR → PDF-disguised LNK → BAT → powerpoint → Crimson RAT
The use of a case-related lure together with a PDF-looking shortcut and an Office-themed executable name is a simple but effective way to hide the actual execution chain from the victim.
THOR YARA matches:
MAL_Crimson_RAT_Jun26
valhalla.nextron-systems.com…
SUSP_LNK_Apr22_2
valhalla.nextron-systems.com…
LNK_Malicious_Nov1
github.com/Neo23x0/signature…
SUSP_OLE_Embedded_EXE_Oct23
valhalla.nextron-systems.com…
IOCs:
0a0e7b54890b822bd3910220b20f1a52b09e24603b8fcfd4ea551b964d6033b9 (Fw_ individual Case - Aug 2026.msg)
5e08012967a184f456400168c3382a8b6ab3efdf21c520667c3cf9c5d57b01f2 (powerpoint)
a5a9b99066d1d27899506a2bf138da3289f9c33fc4dc5b8fd76be9c32c2bf90a (powerpoint.bat)
9ec2fcf125890ad69155a3343399f7e704ae0edb9873dcd38448415398ed81c5 (Indl Case List 2026.rar)
4379a9572d31ea98e5cb1d55f052ab150508a85dd02a004a3570f2fca8f51609 (Indl Case List 2026.pdf.lnk)
a6f27d0a4844c725a9d3bf916b59df24c3f440a63c567329fda87c99f80529fb (Indl Case List 2026.pdf.lnk)
Demon retweeted
New research with @spontiroli & @riv3r_styx at @Acronis TRU. We discovered three previously undocumented & novel malware families which we track under the alias #PATCHCORD, #SHEETCORD and a vibe-coded implant in Golang known as #HACKERAIC2AGENT. targeting Afghan telecom and South Asian critical infrastructure such as military and government
Confirmed victim includes Afghan (🇦🇫) national telecom. The operator left their staging server wide open exposing their entire toolkit, exfiltrated iOS call logs and POCs related to CVE-2024-6387 with tons of OPSEC blunders leading to an operator based out Pakistan 🇵🇰
Report & IOCs :
acronis.com/en/tru/posts/pat…
cc : @malwrhunterteam @hasherezade @smica83
Demon retweeted
🚨 Potential SideWinder initial access document identified by Joe Sandbox & Joe Reverser...
A document consistent with SideWinder APT tradecraft uses a convincing DHA (Defence Housing Authority) Gandhara Phase-9 housing notification as a decoy to initiate compromise.
📄 The lure appears as a legitimate, read-only Word document, but opening it causes Microsoft Word to retrieve a remote template from defense-housing-authority[.]vagued[.]live via an external relationship defined in word/_rels/settings.xml.rels.
🔬 Analysis revealed:
• 🎭 Remote Template Injection
• 🔐 Obfuscated .NET BinaryFormatter payload
• 📦 Embedded .NET DLL loader
• 🖥️ Host fingerprinting & AV discovery
• 🌐 Multi-stage C2 communication
• 💾 Fileless in-memory .NET assembly loading
A reminder that macro-less Office documents continue to be an effective initial access vector.
📑 Reports:
• Joe Reverser: joesandbox.com/joereverser/a…
• Joe Sandbox: joesandbox.com/analysis/1953…
#ThreatIntel #SideWinder #APT #MalwareAnalysis #CyberSecurity #DFIR #ReverseEngineering
Demon retweeted
While reviewing the recent 360 Advanced Threat Research Institute report on APT-C-24 (Rattlesnake), we identified additional malicious Excel documents that were not explicitly covered in the original analysis.
By pivoting from the published IOCs, we discovered multiple .xls samples exhibiting an almost identical VBA execution chain. The documents abuse the Workbook_Open() event to automatically execute malicious macros that:
1) Download a DLL payload (served with a .ico extension) and save it to C:\ProgramData under a variant-specific filename.
2) Download an executable payload (often served with a .pdf extension) and save it to C:\ProgramData.
3) Execute the downloaded executable via the Shell.Application COM object (ShellExecute).
4) Use MSXML2.ServerXMLHTTP.6.0 and ADODB.Stream to retrieve and write payloads to disk.
5) Suppress runtime errors using On Error Resume Next.
The workbook also contains legitimate-looking Excel functionality (data formatting, duplicate removal, report generation, etc.), likely included as decoy content to conceal the malicious downloader.
Related Samples:
1946315d645d9a8c5114759b350ec4f85dba5f9ee4a63d74437d7a068bff7752
83b3a6605171440d7d9582b35cbe8dca839ffe234ec8cca0fb92e32b91501d9c
d1e6d67b48b7832f57601f81ac8cd38fe5b2e817c118dc3fc8e713cf21f90fc6
fd2d6f0dc2a61a8f4f09ad103dfb2cdd4b8965ed36dfa645b9d1396849bd250e
96a9a7b014a3a9925b4969b837501f88ae60345cb438dd2eddc721cc3d8c0ff6
6d8312056fda39a69783b99b8a9413074d1171bbb8e408ff65e722334c5f3478
78bf27a03eab7685b36a7a949468978ba2b119343b81ee2be1e9499f83773b7f
cf5436d33a4b9658ebb488522de84c52ce7d5de900fcb7abc6274997887289f6
SUSP_MalDoc_Nov18_1
valhalla.nextron-systems.com…
SUSP_FilePath_ProgramData_Oct21_1
valhalla.nextron-systems.com…
SUSP_Dir_Ref_in_File_ProgramData
valhalla.nextron-systems.com…
Demon retweeted
We recently identified malicious Excel documents related to #DoNot APT activity.
The samples include shipping- and invitation-themed lures such as "DHL_Orijinal_Sevkiyat_Belgeleri.xlsm", "6883.xltm", and "INVITATION FOR THE EID-UL-ADHA IFTAAR RECEPTION.xltm". Some of these documents were observed dropping "dn110mploc.dll", a downloader detected by our YARA rule APT_MAL_Donot_Downloader_Dec25:
valhalla.nextron-systems.com…
Office Documents
fad4ceb5da3ca2a3457285823bc990a2e13e883bbf0471dda5e6c953a17291e0
902d1dee3000361a49b22d81c52a410a3521e06dcfd5b1422f46a5c2c3f80191
27a49a71dfa781e18d8c85b8bdbb89c5feac5bf85a5236ea5f99211665c7780f
c3db655f8db53640c013455f14e3fcf92a2e0a57df600726777cfb47073972cc
Downloader
eb14daab2c93da84c0daad05d3eaa50c6d4f4d4055f7d6000665a19c5fce3915
2a1510fc4a82d44cc82d481f3d46105f30c9243312b3e98227c97d125b2370be
#ThreatResearch #YARA #MalwareAnalysis #DoNotAPT
Demon retweeted
#SideWinder has deployed a new multi-stage attack chain abusing ClickOnce .application files delivered via phishing PDF documents.
The attack leverages white-binary side-loading to execute Rust-developed backdoors encrypted with RC4 and XOR algorithms.
Implants establish persistence via registry modification, collect host intelligence, and accept an extensive set of remote commands over C2 servers hosted on free serverless platforms such as Cloudflare Workers.
Correlated campaigns employ malicious Office macros as alternative initial access vectors.
mp.weixin.qq.com/s/PALBLusD4…
