Ramin Nafisi
@MalwareRE
Followers
5K
Following
683
Media
104
Statuses
493
Director of MSTIC Malware Intelligence, Research, and Analysis (MSTIC-MIRAGE) team.
Joined April 2014
Today we are releasing an in-depth analysis of a #NOBELIUM post-exploitation backdoor that Microsoft Threat Intelligence Center (MSTIC) refers to as #FoggyWeb, a passive & highly targeted backdoor capable of remotely exfiltrating sensitive info from a compromised AD FS server.
New blog: In-depth analysis of newly detected NOBELIUM malware: a post-exploitation backdoor that Microsoft refers to as FoggyWeb. NOBELIUM uses FoggyWeb to remotely exfiltrate data from compromised AD FS servers. Get IOCs, protection info, and guidance:
9
137
272
#PipeMagic is a highly modular backdoor used by the financially motivated threat actor Storm-2460. It masquerades as a legitimate open-source ChatGPT Desktop Application. Microsoft Threat Intelligence encountered PipeMagic as part of research on an attack chain involving the
0
17
55
Microsoft Threat Intelligence has uncovered a cyberespionage campaign by the Russian state actor we track as Secret Blizzard that has been targeting embassies located in Moscow using an adversary-in-the-middle (AiTM) position to deploy their custom #ApolloShadow malware.
0
16
50
RT @hackingump1: 🚨 RIFT Update:.We’ve boosted our compiler detection! 🛠️.Now with sharper insights into binaries built using GNU, MinGW, an….
github.com
Rust Library Recognition Project for Rust Malware by the MSTIC-MIRAGE Team - microsoft/RIFT
0
16
0
Today, Microsoft Threat Intelligence Center (#MSTIC) is excited to announce the release of #RIFT, a tool designed to assist software/malware analysts automate the identification of attacker-written code within Rust binaries. Blog: Tool:.
microsoft.com
As threat actors are adopting Rust for malware development, RIFT, an open-source tool, helps reverse engineers analyze Rust malware, solving challenges in the security industry.
Do you find analyzing Rust binaries/malware tedious and unpleasant? You’re not alone! If you’re attending #REcon this year, our own @hackingump1 will be unveiling #RIFT today at 2PM EST (not at REcon? We got you covered, stay tuned). We have been using RIFT internally for some.
0
58
165
Do you find analyzing Rust binaries/malware tedious and unpleasant? You’re not alone! If you’re attending #REcon this year, our own @hackingump1 will be unveiling #RIFT today at 2PM EST (not at REcon? We got you covered, stay tuned). We have been using RIFT internally for some.
Presenting "Unveiling RIFT: Advanced Pattern Matching for Rust Libraries" at RECON Montreal 2025!.Sharing research on discovering Rust dependencies in compiled binaries. See you there! 🚀.#RECON2025 #RustLang #ReverseEngineering.
0
14
37
In collaboration with Microsoft Threat Intelligence (MSTIC), @SonicWall has identified a deceptive campaign to distribute a modified/patched version of SonicWall’s SSL VPN NetExtender application (dubbed #SilentRoute by MSTIC) that closely resembles the official SonicWall.
0
13
43
RT @MsftSecIntel: Microsoft and CrowdStrike are publishing the first version of our joint threat actor mapping, which includes a list of co….
learn.microsoft.com
Learn how Microsoft names threat actors and how to use the naming convention to identify associated intelligence.
0
15
0
RT @MsftSecIntel: Microsoft and CrowdStrike are teaming up to create alignment across our threat actor taxonomies, mapping where knowledge….
0
90
0
RT @MsftSecIntel: Microsoft has discovered worldwide cloud abuse activity by new Russia-affiliated threat actor Void Blizzard (LAUNDRY BEAR….
microsoft.com
Microsoft Threat Intelligence has discovered a cluster of worldwide cloud abuse activity conducted by a threat actor we track as Void Blizzard, who we assess with high confidence is Russia-affiliated...
0
140
0
RT @MsftSecIntel: The threat actor that Microsoft Threat Intelligence tracks as Marbled Dust has been observed exploiting a zero-day vulner….
microsoft.com
Since April 2024, the threat actor that Microsoft Threat Intelligence tracks as Marbled Dust has been observed exploiting user accounts that have not applied fixes to a zero-day vulnerability...
0
70
0
RT @JohnLaTwC: Come help me create mechanical advantage in defense. If you love threat hunting, learning from incidents, building new way….
0
27
0
RT @MsftSecIntel: Exchange Server and SharePoint Server now integrate with the Windows Antimalware Scan Interface (AMSI), providing an esse….
microsoft.com
Exchange Server and SharePoint Server are business-critical assets and considered crown-jewels for many organizations, making them attractive targets for attacks. To help customers protect their...
0
28
0
RT @MsftSecIntel: Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) that demonstrates sophisticated tech….
microsoft.com
Microsoft Incident Response uncovered a novel remote access trojan (RAT) named StilachiRAT, which demonstrates sophisticated techniques to evade detection, persist in the target environment, and...
0
146
0
RT @MsftSecIntel: Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that infects X….
microsoft.com
Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that infects Xcode projects, in the wild. Its first known variant since 2022, this latest...
0
48
0
RT @MsftSecIntel: Silk Typhoon is an espionage-focused Chinese state actor whose activities indicate that they are a well-resourced and tec….
microsoft.com
Silk Typhoon is a Chinese state actor focused on espionage campaigns targeting a wide range of industries in the US and throughout the world. In recent months, Silk Typhoon has shifted to performing...
0
113
0