🔎Our CERT is releasing a new technical report on 🇰🇵Operation #DreamJob, focusing on recent evolution in its tooling. Following an IR engagement at a large manufacturing client based in 🇪🇺, we investigated artefacts we attribute to #UNC2970. ➡️Full blog: https://t.co/o8px0jZmfc

So, @tmechen_ looked at the above and wrote a lot of details about it: https://t.co/O9FPmtz6Zf Maybe @certbund too could be interested in checking this... 🤷‍♂️

🚨 ALERT: Cybercriminals are sending out fake Telekom invoices via phishing emails to deliver multiple malicious RAT payloads. The activity originates from an attack cluster tracked by Telekom Security under the name "Rodent Weed". 🧵1/6

this part is brutal.

Some folks took my post as “detection > TI” or assumed I believe TI is just IOCs. Let’s clarify. I wrote that post after being called a threat intel company four times this month. We’re not. We do detection engineering - and yes, that often integrates TI, but it produces a

Reading Microsoft’s new Void Blizzard report, one thing stands out (again): Everything is about credential theft, phishing, and tokens. Initial access comes from buying or stealing creds - often through low-effort phishing. All the real action happens in the cloud, not on

Fraudsters have now started using EPC QR codes in fake invoices that can be opened by many banking apps. These codes already contain all the necessary transfer information for the app to start a simple transfer action for the victim. (1/3)

This is a great summary. We (and by we I mean mostly @willoram) have been using variants of this diagram to describe the inversion of attack paths to identity-based intrusions - a major trend in our incident response cases over the past year.

Microsoft Threat Intelligence observed a new and notable method used by the threat actor Storm-0249 for distributing the Latrodectus trojan, a malware loader designed to facilitate multi-stage attacks by downloading and installing additional payloads onto compromised devices.

🚨 Telekom Security detected a major #vishing campaign against multiple targets in #Germany, likely related to a ransomware group. We are still analyzing, but here is what we know so far 🧵1/x

I interviewed 57 security leaders to answer one question: What sucks in security right now? The answers were fascinating, frustrating, and occasionally funny 🧵

At this year's #DEATHCon I was fortunate enough to present my workshop on #Kusto graph semantics. Now I release it for free to everybody. #KQL #Security #Kraph https://t.co/vGiUvF4d57

We have also detected this campaign. It starts with an email 📧 containing an SVG file which, when opened, drops an HTML file. The HTML file displays a spoofed PDF file and tricks the victim into clicking the "Open" button 🧵1/4

Had fun presenting #WARMCOOKIE research at #VB2024. The malware was recently updated with new handlers. Our team wrote some tooling to simulate the C2 server to help organizations build better detections. Tooling:

🚨🔥 LOLRMM IS LIVE! 🔥🚨 The wait is over, folks! 🥳🎉 We’re thrilled to announce the official release of LOLRMM — your new go-to tool to detect and counter RMM abuse! 🕵️‍♂️💻 👉 Check it out NOW at https://t.co/hYZrJW3l9V 👈 This couldn’t have been possible without our amazing

What's new in IDA 9.0? https://t.co/FfafKARWXP - No more IDA 32 - IDA as a library (for C++ and Python headless development) - New and updated signatures (for FLIRT) - Legacy 'structs' and 'enums' windows and APIs are gone - Plugin binaries not compatible with 9.0; need to

Bellingcat’s Online Open Source Investigation Toolkit bellingcat.gitbook[.]io/toolkit

#Latrodectus Infection lead to #BruteRatel🕷️🦫 #MalwareAnalysis & #TTPs Several unpacking routine (VirtualAlloc & VirtualProtect) lead to 2 DLLs [+] Rundll32.exe T1218.011 Internal name: badger_x64_stealth_rtl.bin.packed.dll Export Func: DllMain StartW https://t.co/JaJGlnuwtz

#Latrodectus - #BruteRatel - .pdf > url > .js > .msi > .dll 18.09.2024 👇 wscript.exe Document-21-29-08.js msiexec.exe /V MSI152A.tmp /DontWait rundll32.exe C:\Users\Admin\AppData\Roaming\x64_stealth.dll, clBuildProgram (1/3) 👇 IOC's https://t.co/n6EQNtxxiB

The people who claimed the ‘EU version of iOS is the most fun version of iOS’ are awful quiet today