Olindal3o2 @OIindal3o2

I’m here to read your tweets about DFIR. Joined February 2018

Tweets

756
Followers

17
Following

827
Likes

875

Who said what? @g0njxa

4 months ago

Seems like some #Lumma Stealer panels have started to display a banner of seizure /tsoi-zhiv.com /anna-akhmatova.com

2 17 56 48K 12

Download Image

Thomas Roccia 🤘 @fr0gger_

11 months ago

Mandiant released CAPA Explorer, a UI to explore CAPA results! This is pretty cool, well done @williballenthin and all! 👏 👉 mandiant.github.io/capa/explorer#… #malware #infosec #malware

2 98 278 35K 132

Download Image

Julien Mongenet -- @tuxpanik.bsky.social @tuxpanik

a year ago

Hey @GoDaddy, is it normal for @afternic to register certificates for thalesgroupe[.]com, an obviously typo-squatted subdomains, for which several takedown requests were sent to you yet?

1 1 2 131 0

Hash Miser @H_Miser

a year ago

L’association @InterCERTFrance a publié des fiches réflexes sur différentes thématiques (ransomware, DDOS, compromission, défacement), ça pourrait servir :) 👇 github.com/intercert-fran…

5 46 101 7K 60

Dark Web Informer @DarkWebInformer

a year ago

TLDR LockBit summary. 1. LockBit bluffed 2. First link leads to Federal Reserve press link from mid June. 3. All the rest of the links all lead to Evolve Bank & Trust's data.

7 36 143 45K 19

Download Image

Yesterday Lockbit ransomware group claimed to have ransomed the United States Federal Reserve. 1. Doubt 2. If Lockbit ransomware group actually ransomed the United States Federal Reserve it would be DEFCON 2 and the administrators would need to worry about a drone strike

58 176 2K 213K 226

Download Image

Will @BushidoToken

a year ago

⚠️ Dropbox “became aware of unauthorized access to the Dropbox Sign (formerly HelloSign) production environment” A threat actor has accessed: — emails, usernames, phone numbers and hashed passwords — As well as API keys and d OAuth tokens sign.dropbox.com/blog/a-recent-… 1/2

1 42 76 15K 22

Kali Linux @kalilinux

a year ago

The xz package, starting from version 5.6.0 to 5.6.1, was found to contain a backdoor. The impact of this vulnerability affected Kali between March 26th to March 29th. If you updated your Kali installation on or after March 26th, it is crucial to apply the latest updates today.

44 1K 3K 612K 441

Hash Miser @H_Miser

2 years ago

Kind reminder: DDoS is not a cyberattack.

8 11 19 5K 1

Download Gif

vx-underground @vxunderground

2 years ago

Lockbit ransomware group administrative staff has confirmed with us their websites have been seized.

17 132 2K 163K 117

Download Image

watchTowr @watchtowrcyber

2 years ago

0 14 55 8K 4

Download Image

ARCHIVED: Jen Easterly @CISAJen

2 years ago

🚨NEW: Urging all organizations to review this guidance & take steps to reduce your risk to this widespread vulnerability.🙏Huge Thanks to @Boeing for providing key info for this advisory--a terrific example of operational collaboration in action: go.dhs.gov/oHd.

4 82 160 82K 42

Download Image

Florian Roth ⚡️ @cyb3rops

2 years ago

Dear DFIR colleagues, Always be wary of 404 error codes in web server log files. Some webshells intentionally send this error code to deceive you into thinking the request failed. shadowserver.org/news/technical…

16 236 710 102K 210

Download Image

Will @BushidoToken

2 years ago

⚠️ Use Microsoft Teams? Watch out for TeamsPhisher! While it is not usually possible to send files to MS Teams users outside your org, by security researchers found a bypass by manipulating Teams web requests 🔥 github.com/Octoberfest7/T… Examples of MS Teams phish lures ⬇️ 1/3

2 146 411 82K 180

Download Image

Arnaud@Thurudev @arnaud_thurudev

2 years ago

En Angleterre, Lidl rappelle des biscuits « Pat’Patrouille » affichant un lien vers un site pornographique lemonde.fr/pixels/article…

0 3 2 8K 2

Stephan Berger @malmoeb

2 years ago

1/ We recently had an interesting #Azure case where the TA, instead of creating a new Inbox Rule, added email addresses of interest to the list of blocked senders and domains. The incoming emails will get flagged as spam and moved to the Junk email folder. 📂 🧵

9 85 370 144K 191

John Hammond @_JohnHammond

2 years ago

The MOVEit Transfer exploitation is not just SQL injection(👀) We uncovered the very last stage of the attack chain to drop human2.aspx ultimately ends up gaining remote code execution ‼ We fully recreated the attack chain with a demo achieving a reverse shell & ransomware!

31 476 2K 236K 293

Download Video

Louis Dion-Marcil @ldionmarcil

2 years ago

Outlook for Windows can be tricked into displaying a fake domain, but open another one. Add a <base> tag with a fake domain + left-to-right mark (U+200E) Links in <a> tags will show the fake domain, but open the real domain. No need to buy .zip! :) Convincing #phishing #redteam

13 242 824 117K 376

Download Image

Hussein Nasser @hnasr

2 years ago

What is the difference between the two urls? one has an @ and one doesn't. But also the first downloads version 15 of postgres from GitHub and the second one resolves to v15 dot zip domain which can also downloads a zip file that sure doesn't have postgres in it. You see,…

40 752 3K 540K 738

Download Image

Michael Koczwara @MichalKoczwara

2 years ago

Cobalt Strike redirector technique used recently by Russian APT29/Nobellium ⚡️ This is a Red Team technique (T1090.002 External Proxy) attack.mitre.org/techniques/T10… to hide C2 behind a legit website. This could be very useful for Threat Hunters/Intel to set up a hypothesis/monitor…