threat research • threat Intelligence • cloud security• supplychain security & random | Director of security research @Loginsoft_Inc
-
Opinions are my own 127.0.0.1Joined July 2015
🚨 A Russian nation-state actor, Turla, strikes again with the powerful DeliveryCheck backdoor. Learn how it breaches #Microsoft Exchange servers and exfiltrates sensitive messages from Signal app.
Read more 👉 thehackernews.com/2023/07/turlas…#cybersecurity
Microsoft has identified highly targeted social engineering attacks by the threat actor Midnight Blizzard (previously NOBELIUM) using credential theft phishing lures sent as Microsoft Teams chats. Get detailed analysis, IOCs, and recommendations: msft.it/60199EEkv
In May, we observed a threat actor (TA) exploit PaperCut NG (CVE-2023-27350) to download/execute a Havoc C2 binary.
➡️The TA then reviewed tasklist before dumping credentials using Mimikatz.
➡️Next, the TA downloaded numerous RMM tools.
thedfirreport.com/services/#AllIntel
1/X
Under investigation: During a hunt for DLL sideloading abuse of vmnat.exe, Sophos X-Ops uncovered a campaign targeting an organization in Southeast Asia. Aligning with TTPs previously attributed to the Mustang Panda threat group, we unraveled a complex, sustained intrusion. 1/10
North Korean state actors linked to the RGB have been identified in the JumpCloud hack! An #OPSEC mistake exposed their IP address.
Find details here: thehackernews.com/2023/07/north-…
The new report also uncovers the use of malicious Ruby scripts and payloads like FULLHOUSE.DOORED,…
Citrix Gateway VPN compromised via CVE-2023-3519 (a critical unauthenticated RCE) shows evidence of exploitation on 7th July, 11 days before the official patch.
The attackers exfiltrated the system configuration file to then probably use the Metasploit module called…
New blog post based on a recent intrusion I observed with #Ursnif as the initial infection!
Topics include:
✅ Detection opportunities
✅ TAs clipboard data
✅ Post-exploitation
and more!
The artifacts for this case: buff.ly/3NYx49v
The blog: buff.ly/44QCSJ0
Cybercriminals are leveraging exploits for CVE-2021-40444 and CVE-2022-30190 to execute code through malicious Word files. Once opened, LokiBot #malware is downloaded, logging keystrokes, capturing screenshots, and stealing data.
Read: thehackernews.com/2023/07/cyberc…#cyberattack
Microsoft Incident Response's investigation of a BlackByte 2.0 ransomware attack that progressed in less than five days highlights the importance of disrupting common attack patterns, stopping attacker activities that precede ransomware deployment: msft.it/6010gxvlQ
#SmugX campaign targeting European governmental organizations 🇪🇺 :
✉️ Utilizes HTML Smuggling to deliver PlugX payloads
🤖 Abuses RoboForm DLL search order hijacking
🏮 Ties to previously reported RedDelta\ MustangPanda campaigns
Read More :
research.checkpoint.com/2023/chinese-t…
350 Followers 4K Following🌐 I made this account to warn others and share my experience with a potential Trojan that auto-downloaded from the TikTok Seller website. 🆘
38 Followers 491 FollowingPALMS™ Smart Warehouse Management System provides configurable Supply Chain processes required by companies to provide better customer service
669 Followers 3K FollowingDFIR, Malware & CTI. Head of a CSIRT. Ex @ANSSI_FR. PhD in intl law. Mostly working on Chinese #APT but also on russian and cybercrime actors #CTI #Malware
8K Followers 6K Following#InfoSec professional, husband & father of two (in random order). #BlueTeam #DFIR #APT #CTI #RedTeaming #BSidesZH (RT/Likes ≠ endorsement) 👀➡️#MalwareChallenge
11K Followers 6K FollowingAppSec Village @DEFCON & @RSAConference
A volunteer-run, non-profit focused on education, awareness, and community. Founded by @erezyalon and @tzionit411.
18K Followers 801 FollowingThreat Intelligence Analyst |
See my Linktree for other socials |
In case I post false intel, contact me!
Support me: https://t.co/5WgDqr0K8p
🇪🇺🇩🇪🇺🇦🌈
21K Followers 0 FollowingOur mission is to make the Internet more secure by bringing to light vulnerabilities, malicious activity and emerging threats. Join our Alliance!
19K Followers 293 Following#OSINT treasure hunter, investigator, #CyberThreatIntel analyst. Opinions are my own. Follow me on Telegram https://t.co/i6VBbeUXgd for cyber news.
224 Followers 45 FollowingMonitoring and detection of leaks that occur through the main channels used by actors linked to cyber crime.
Contact: [email protected]
15K Followers 66 Following@CISAgov’s Industrial Control Systems Cyber Emergency Response Team provides operational capabilities to defend control systems against cyber threats.
8K Followers 530 FollowingThreat Intel researcher! Technical tweets only; not reflective of employer's views. No endorsement of political groups/entities.
6K Followers 1 FollowingFOR RESEARCH ONLY! | I do not host breach data. I am just here to warn users about leaks on public paste sites! | my human: @rnd_infosec_guy