'Sharpil RAT/SL RAT' (but really #echelon )

app.any.run/tasks/52ceb9e9…

Regarding change control, does a reboot of a device constitute a change?

Have Elastic and security experience? Why not work with me in protecting Thought Machine against threats! Apply below, DMs open - thoughtmachine.avature.net/careers/JobDet…

Hello everyone! If you remember - 3 weeks ago I twitted twitter.com/naumovax/statu… about the interesting infection chain 🧐
Today I and my teammate posted great research about the #SteganoAmor campaign of #TA558 mass-attacking all around the world 🌐⬇️
ptsecurity.com/ww-en/analytic…

Crazy world we live in..

Microsoft: Free updates for the life of the OS!

Ubuntu: Pay us or you don't get an update for ntp (widely used on the perimeter).

🤷

(yes, I'm aware about the 5 free)

A Snap tale in four parts 🙃🤷‍♂️

Useful blog post for beginners approaching ghidra for the first time by Omar

byte.how/posts/what-are…

#ghidra #cybersecurity

Some fresh #rustystealer :

app.any.run/tasks/12ebfc62…

Dear Reddit

The new interface change is ghastly. That is all.

Linux forensic cheatsheet

fareedfauzi.github.io/2024/03/29/Lin…

Protip: Probably time to drop cloudflare-ipfs . com at the perimeter/proxy level.

A (late again :( ) csv formatted list of #malspam campaigns that crossed my path in March to include subjects, malware, hashes, c2's, and email exfil addresses. Side note; #phorpiex campaign at 35K+ is the largest I've seen and ongoing:

gist.github.com/silence-is-bes…

#retrohunt

More #hagga via booking . com #malspam pdf -> js -> #originlogger

app.any.run/tasks/6e0e4947…

🚨New research reveals a cyber espionage campaign targeting Indian government, including agencies responsible for electronic communications, IT governance, and national defense. Full details on the tactics and implications are here: blog.eclecticiq.com/operation-flig… #CyberSecurity #Malware

Some fresh #hagga -> #originlogger via booking . com:

app.any.run/tasks/d7fe276d…

Excellent beginners introduction to Windows kernel exploitation

Part 1: mdanilor.github.io/posts/hevd-0/
Part 2: mdanilor.github.io/posts/hevd-1/
Part 3: mdanilor.github.io/posts/hevd-2/
Part 4: mdanilor.github.io/posts/hevd-3/
Part 5: mdanilor.github.io/posts/hevd-4/

#windows #infosec

A curious #loader ...🤔

app.any.run/tasks/083173c1…

What's your expectation from event time to email/call time from your SoC?

Time to add #GlorySprout stealer to the list of shame. Check out my analysis on GlorySprout Stealer, or should I say Taurus Stealer? 🤔

russianpanda.com/2024/03/16/The…