Joshua Penny
@josh_penny
Followers
2K
Following
2K
Media
101
Statuses
557
Senior Threat Intelligence Analyst @Bridewellsec
England, United Kingdom
Joined January 2012
🚨New Analysis🚨: #LockBit 3.0 Exploit CVE 2023–4966 #CitrixBleed
@MichalKoczwara and I deep dive into the recent #CISA LockBit advisory, looking at IOCs provided by @Boeing to uncover additional #infrastructure. Hope you find it an interesting read! Link & Findings👇
9
125
331
The European Council 🇪🇺 has issued sanctions against Stark Industries, a hosting company registered in the UK 🇬🇧, as "they have been acting as enablers of various Russian state-sponsored and affiliated actors to conduct destabilising activities including, information manipulation
2
34
71
🚨 Keepass Campaign 🔥Domain: kee-password[.]com (0/94 VT) 🔥Redirects to: keepass-download[.]com (0/94 VT) 🔥Links to malicious Github repo: hxxps://github[.]com/keeppasss/keepass/raw/refs/heads/main/KeePass-2.56-Setup[.]exe 🔥Drops:
2
24
77
Social Engineering analysis inspired by Sanne Maasakkers talk on "Unraveling the Mind Behind the APT - Analyzing the Role of Pretexting in CTI and Attribution" where she talks about Principles of Influence:
0
1
5
Within our telemetry we observed: - complaints about airport facilities, - stolen laptops at hotels, and, - attempts to be recruited for vacant positions. The blog covers first stage, intermediate, payload staging infrastructure and dropped payloads. Use of Yahoo & Rebrandly
1
0
4
Myself and @RustyNoob619 have released a new blog - "Operation Deceptive Prospect" #RomCom campaign targeting #UK #Retail & #Aviation via Customer Feedback Portals. All Feedback welcome. https://t.co/EMpcSG8XmB
1
2
21
🎯 Ransomware-driven data #exfiltration: techniques and implications Our new #TDR report focuses on the exfiltration techniques leveraged by #ransomware and #extortion groups. https://t.co/fta7HsMUbG
#ThreatIntelligence #Detection
1
63
178
🇰🇵APT43/Kimsuky targets and impersonates hotel industry including Marriott, Faraway, NH Hotel Group, and others. 158.247.201.165 https://t.co/mPDteOfAxF
6
31
126
The #Lazarus Group shows no signs of easing with their campaign targeting #jobseekers extending to the present day. Group-IB researchers found new updates to their tools and tactic - new suite of Python scripts - #CivetQ, a #Windows and #Python version of #BeaverTail
1
76
203
New #APT #Actor240524 #ABCloader #ABCsync #Threat #malware 📍🏴 💥🇦🇿🇮🇱 ⛓️ #Phishing > Doc Macro (VBA) > #ABCloader (MicrosoftWordUpdater.log) > Load Dll (#ABCsync) > #C2 > Commands to Steal & modify files/data 🔗NSFOCUS report: https://t.co/PY8AgHS892
2
37
76
🤓Check out new research into the ongoing Tycoon 2FA phishing campaign in Twitter article form📝 🤔Some IndiaTimes subdomains are extracted from the X509 Subject Alternative Name server certificate extension https://t.co/GzTR9cYLS7 🫣This redirect was previously described
1
5
19
Ever want to search @CISAgov KEV by actors provided in OSINT? Us too. We made a feature to search KEVs by actor while enjoying this miso soup 🍜. #ThreatIntel #infosec Just enter /kev?actor=lazarus Live example: https://t.co/IaiP8n7iio
1
8
14
🚨 Our new report from the #TDR team details our investigation into the #Quad7 (7777) #botnet, describing its exploitation of compromised TP-Link routers to perform long-term password-spraying attacks against #Microsoft365 accounts. https://t.co/1oSKIZn6aW
6
26
51
Well, after the @FBI and partners seized a propaganda network by #RussiaToday just 2 days ago, the swedish NGO @Qur1um just released a several pages report on the shady hosting infra behind #DoppelGaenger. Some good old Bulletproof Hosters included: https://t.co/PExNpX17su
6
35
92
🚨New Report🚨 #Akira: The Old-New Style Crime by @josh_penny & me Research based on methodology, versions of public #malware, all #CTI and detection opportunities of #TA 🔗Full report: https://t.co/38WL7WDTtt
#RE #intel #ransomware #TA
1
1
16
Our Cyber Threat Intelligence (CTI) team have been using their cutting-edge C2 infrastructure tracking capability to identify, analyse and monitor the top malicious infrastructure of the last year. This annual report shares their findings, including: 🔵 36,000+ unique IP
0
3
12
I messed with https://t.co/fkSC4eKD5R API and produced queries for @microsoftsentinel KQL queries https://t.co/cWjIrDgeM5
@rodtrent @msftsecurity @MsftSecIntel @msftsecurity
#sentinel #kql #ransomware
github.com
Cyber Defence related kusto queries for use in Azure Sentinel and Defender advanced hunting - m4nbat/KustQueryLanguage_kql
2
10
19
SOC Client Lead role going here at @bridewellsec. Please apply if you're interested in joining our awesome SOC. https://t.co/3c2Px6w7WA
linkedin.com
I'm hiring! Due to growth, I'm looking for a new member to the Client Lead team at Bridewell. We're looking for people who combine deeply technical knowledge with a client-focused vision. https://l...
0
0
0
Today we delivered a session on Adversary Infrastructure Tracking that we conducted in 2023, here are some of key stats🐧 => USA and China hosted 50% of total C2 servers => Top 🇺🇸 ASNs: Amazon & Digital Ocean => Top 🇨🇳 ASNs: Tencent, Alibaba & Huawei More on Infostealers ⬇️
2
18
70