BarryV
@BarryV
Followers
981
Following
7K
Media
197
Statuses
3K
Show me, don't tell me -- Opinions are my own and do not represent those of my employer
New York, NY
Joined November 2008
Don’t forget you @virustotal collection with #APT45 iocs is available here
0
4
14
Member Turla signing Javascript malware? Serial Number: cd:fb:13:a3:e6:49:ec:c5:df:95:db:88:ca:c1:3f:fb
0
2
14
One really cool thing we've implemented in this iteration of our graduation process is leveraging @virustotal's Collections to provide IOCS to the community for #APT44 - check those out here: https://t.co/dGyXd8QWh0
1
8
23
Today, Mandiant is sharing research on the GRU’s Disruptive Playbook, drawn from insights into GRU’s full-spectrum cyber operations in Ukraine over the past year. https://t.co/ym9Oeb4tmj
cloud.google.com
We have tracked GRU disruptive operations against Ukraine adhering to a standard five-phase playbook.
3
102
245
Head of Rubrik Zero Labs @stonepwn3000 recently talked to @joetidy of @BBCNews about why it is so rare to hear about Western #CyberAttacks and hacking teams and how the narrative of who the good guys and bad guys are in cyber-space is changing 👇
bbc.com
Could a cyber-attack on a Russian technology company provide a rare insight into a Western hack?
2
18
76
Really excited to see the culmination of some amazing work from some amazing people get released today. A report from @Google TAG, with contributions from friends at @Mandiant, on cyber activity related to the war in Ukraine. @t_gidwani @ShaneHuntley
https://t.co/hsY2xUg9CX
blog.google
One year after the Russian invasion of Ukraine, we’re sharing insights into changes in the cyber threat landscape triggered by the war.
2
26
92
capa v5.0.0 is out: major improvements for .NET binary analysis, 150 new/updated rules, caching to improve performance standalone and in the IDA Pro plugin, better ELF OS detection, and a lot more. https://t.co/lzWP1SEZcB VirusTotal integration updates are next!
github.com
This capa version comes with major improvements and additions to better handle .NET binaries. To showcase this we've updated and added over 30 .NET rules. Additionally, capa now caches its rule...
1
59
169
If you have any intel analysis or threat hunting roles, please reach out to @PhreakingGeek. You'd be hard-pressed to find anyone more passionate about chasing adversaries than he is. I am broken-hearted to have lost him, but I know he'll make a great impact on a new team.
3
8
34
We welcome @Mandiant's CAPA and GoReSym to our malware analysis suite. CAPA provides valuable TTPs, and GoReSym produces all kind of metadata to analyse GO samples: https://t.co/3jYUfIf1Zv
1
76
245
#100DaysofYARA tons of tasty info can be pulled from Macho headers, especially Load commands! Lets get a generic count of LOAD_DYLIB commands to quantify the amount of external libraries are used - no idea if any # is suspicious https://t.co/7L9dGfAjxb
0
5
20
Member Turla signing Javascript malware? Serial Number: cd:fb:13:a3:e6:49:ec:c5:df:95:db:88:ca:c1:3f:fb
0
2
14
Mandiant Blog - Turla: A Galaxy of Opportunity https://t.co/Alh37xmdmv This is Mandiant’s first observation of suspected Turla targeting Ukrainian entities since the onset of the invasion.
cloud.google.com
A suspected Turla Team operation distributing a reconnaissance utility and backdoor to malware victims in Ukraine.
In September 2022 Mandiant Managed Defense detected data staging and exfiltration at a Ukrainian organization. Digging into this incident, we discovered QUIETCANARY (aka Tunnus), a suspected Turla Team backdoor, was the source.
0
24
34
What's the technical term for when you've absorbed so much technical debt you're spending all your time addressing support issues rather building?
396
80
1K
If we’re gonna haggle/argue over terminology can it please be thrunt.
11
2
33
the elites don’t want you to know this, but this is actually sandworm
5
5
54
Likely Russian actor distributed trojaned copies of Windows OS:
4
12
45
Mandiant observed a POORTRY sample signed with a Microsoft Windows Hardware Compatibility Authenticode signature. Further analysis led to a larger investigation into malicious drivers signed via the Windows Hardware Compatibility Program. 😱🌶️🔥 https://t.co/XFhESLLWxV
2
38
71
New from @SentinelOne and @Mandiant: Targeted Attacks Leverage Signed Malicious Microsoft Drivers: 🟣 https://t.co/qGL5uN9Kdy 🟣
0
34
90
10th anniversary of Mandiant APT1 report Cyber-truther to Qanon evolution begins
0
1
1