NtAlertThread
@ElementalX2
Followers
2K
Following
28K
Media
69
Statuses
892
Absolute Rookie.
🇮🇳
Joined March 2019
New Research! https://t.co/PLEygl5W3h We have found an interesting campaign targeting an entity of Chinese telecom with VELETRIX implant. The implant uses anti-sandbox, shellcode obfuscation technique via IPV4 and execution via EnumCalendarInfo leading to Vshell implant.
11
72
250
New investigation reveals Intellexa is thriving despite US sanctions, with new ops in Pakistan & Kazakhstan Internal docs obtained by @InsideStoryGR/@haaretzcom & analyzed by @amnesty reveal new tools & access. THREAD https://t.co/MGoTBzoGqK
haaretz.com
***
3
16
25
Read my small, yet latest research on abuse of simple loaders with Adaptix C2 beacon! Cheers!
SEQRITE APT-Team details a spear-phishing campaign against Russian HR, payroll and internal admin departments using bonus and policy-themed decoys. The chain relies on malicious LNK files, a new DUPERUNNER implant, and an AdaptixC2 Beacon for C2. https://t.co/HtwkP6uwuy
1
7
58
People that are yelling “I care about privacy in every sentence they write” but are on a platform like X are just…
0
3
15
Everyone talks about ransomware. Almost nobody talks TO ransomware operators, so I did the job for you. [turn the subtitles on] https://t.co/O8I4pgoEkx
21
48
269
absolutely insane this works "ftp -s:lol.png" That tiny command can be used to to execute hidden code in that image I say image loosely because that is actually a working png/pdf polyglot file its both at the same time might have to go more in-depth with a video on this one
11
36
319
Hey Fam, Just released a small research on threat campaign known as Operation Hanoi Thief targeting Vietnamese IT professionals with Pseudo-Polyglot payload, a DLL implant known as LOTUSHARVEST and much more you can read it here: https://t.co/jHXZYQZgaC
6
45
216
Rare Earth Material Lure Delivering Shellcode Loader Quick notes on a fiber-based shellcode loader delivered using a Rare Earth Material lure #APT #shellcode
https://t.co/WAsCgg2qbR
dmpdump.github.io
On November 21, 2025, Malware Hunter Team shared an interesting sample on X, uploaded to VirusTotal from Singapore. The ZIP file in question is named China’s Governance of Rare Earths and its Global...
1
15
45
Interesting Sample from Belarus dd8890409f8345be6bdfed1fa28fc257e723fe3d1cd608175c0ef376ec06459a [Invitation Tanzania Independence Day Celebrations 2025 (09 December 2025).pdf.rar] @smica83 @malwrhunterteam @PrakkiSathwik @ElementalX2
1
2
13
Few thoughts on this 1. Anthropic sneaks into everyone’s claude chats??? 2. The blog looks exaggerated without any details on what the attack is, its not useful for anyone except for marketing. 3. It’s definitely not fully autonomous hack as it might sound, someone who is already
We disrupted a highly sophisticated AI-led espionage campaign. The attack targeted large tech companies, financial institutions, chemical manufacturing companies, and government agencies. We assess with high confidence that the threat actor was a Chinese state-sponsored group.
7
9
116
#APT36 #TransparentTribe #APT #Phishing Defence_Planning_Committee_Meeting_13_Nov_2025.desktop b551a014af52a03bae2e61863f926592 #SecureFileManager aryterrimerikeri[.space #Backdoor ELF Go 80614756f295e6c17050e5f2ad68010f #C2 echs[.]online 45.155.54.22:8888 #ReverseProxyServer
#APT36 #TransparentTribe #APT #Phishing House Building Allownce Format.desktop 9db73a744e21f19de79828ff8b17466f verification.pdf (Polyglot) be64ffeef1199f11c85546b03dda3b12 /root/.config/systemd/user/telemetry-service 1ee3cc537f897bf44aef3496e80d7b12 #C2 146.19.173.109:17500
1
13
34
Rumors are spreading about a mayor #LawEnforcement operation against #Rhadamanthys #Stealer. @g0njxa and me have been monitoring the situation closely. -Rhada domains under active law enforcement control - Customers are adviced to delete all servers Image via club1337
10
35
106
ENKI identifies a new variant of Comebacker, attributed to the Lazarus Group, that targets the aerospace and defence sector via lure documents. ENKI assesses the campaign has been active since at least March 2025. https://t.co/Eo3Un6b56h
1
11
25
Interesting Note: The TA is probably a fan of an Ethiopian actress Hanan Tarq ( https://t.co/eBNo5bZXlg)
en.wikipedia.org
0
0
2
Thanks @malwrhunterteam for the sample the TA is based out of 🇪🇹 focused on monetizable and influence targets -Ethiopian e-commerce/marketplace sellers, TeleBirr/mobile-money accounts, local IT/repair shops, and media/content creators for phishing, fraud, and narrative operations
"CLASSIFICATION: TOP SECRET // SI/TK // NOFORN" "CLASSIFIED: Ethiopian Military Intelligence Brief" "Operation Red Dawn" Seen some possible interesting sample with this decoy... 🤔
1
3
15
#Philippines Campaign PCG_124th_Anniversary_Event_Documents_Office_of_the_President_23102025-Archive.zip 8e130c2604516ccd4bcba72cc6549649 124th_Anniversary_of_the_Philippine_Coast_Guard_Event_Summary_and_Feedback_Request_Office_of_the_Appointments_Secretary_OP_23102025.pdf.lnk
#APT #Phishing #Malware DS_Store.zip 8313a5281796df3e920ea6558eedc9cb update.vbs 672e1010eb6b8dea7f1680b94fc716f7 DllSafeCheck64.dll 0ed85f4b01e24b186893205002f29e3a (signed, sideloaded by svchost.exe) readme.dat #Shellcode b81ae158a5d2cd7bd6c717f18ab20c41 #C2 150.109.111.36
2
6
19
🚨BREAKING: We uncovered LANDFALL — a commercial-grade Android spyware exploiting a now-patched Samsung zero-day (CVE-2025-21042) through weaponized DNG images sent via WhatsApp, enabling zero-click compromise of Samsung Galaxy devices. 1/ https://t.co/hfTFP1MMX2
unit42.paloaltonetworks.com
Commercial-grade LANDFALL spyware exploits CVE-2025-21042 in Samsung Android’s image processing library. The spyware was embedded in malicious DNG files.
3
63
153
🆕 Checkout the blog between @NVISOsecurity & @TeamCymru all about #VShell, which has been used a lot over the last year (over 1,500 servers!), primarily used for long-term espionage activities 🌍🇨🇳 Including NetFlow Analysis 👀 🔗 https://t.co/A1qvBuy4XZ
2
31
122
New Research! https://t.co/MoiuLVziYm We found Silent Lynx APT, making sluggish changes to their arsenal, adding Silent Loader, SilentSweeper & LAPLAS implant. The campaigns are targeted towards multiple other countries. Contains a lot of pivoting and other necessary details.
4
57
203