AdamTheAnalyst @AdamTheAnalyst

Cyber Threat Intelligence Specialist & STIX Evangelist - Tweets about #ThreatIntelligence #Malware #Ransomware #ThreatHunting #FINCrime ~ pronouns:He/Him London, UK Joined June 2012

Tweets

3K
Followers

2K
Following

581
Likes

1K

Socket @SocketSecurity

2 months ago

🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.io. Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems. TrapDoor targets #crypto, #DeFi, AI, and security developers, stealing wallets, SSH keys, cloud credentials, GitHub tokens, browser data, env vars, and API keys. Socket detected releases with a median detection time of 5 minutes, 27 seconds. The fastest detection occurred 58 seconds after publication.

133 422 2K 778K 722

View Details

Hunter @HunterMapping

5 months ago

🚨Alert🚨 CVE-2026-1731 (CVSS 9.9): Remote code execution in Remote Support (RS) and Privileged Remote Access (PRA) 📊 2.5M+ Services are found on the hunter.how yearly. 🔗Hunter Link:hunter.how/list?searchVal… 👇Query HUNTER : product.name="BeyondTrust Privileged Remote Access"||product.name="BeyondTrust Remote Support" 📰Refer:beyondtrust.com/trust-center/s… #hunterhow #infosec #infosecurity #OSINT #Vulnerability

2 28 104 9K 29

View Details

Cyber Security News @The_Cyber_News

6 months ago

⚠️ Cloudflare Zero-Day Vulnerability Enables Any Host Access Bypassing Protections Source: cybersecuritynews.com/cloudflare-zer… A critical zero-day vulnerability in Cloudflare's Web Application Firewall (WAF) allowed attackers to bypass security controls and directly access protected origin servers through a certificate validation path. The requests targeting the /.well-known/acme-challenge/ directory could reach origins even when customer-configured WAF rules explicitly blocked all other traffic. The vulnerability was detected while reviewing applications where WAF configurations blocked global access and permitted only specific sources. #CybersecurityNews #vulnerabilitynews

13 304 1K 120K 451

View Details

Steven Lim @0x534c

8 months ago

From LNK to PlugX: Tracking UNC6384’s Zero-Day Abuse Chain arcticwolf.com/resources/blog… Chinese threat actor UNC6384 is actively exploiting a newly disclosed Windows LNK zero-day vulnerability (ZDI-CAN-25373) to target European diplomats with PlugX malware via Canon DLL sideloading, as reported by Arctic Wolf Labs. The initial stage involves a malicious LNK file embedded in EU/NATO-themed spearphishing emails—making early detection of shortcut file execution a critical warning signal. I’ve authored a Microsoft Defender XDR detection rule to catch this abuse chain and help teams stay ahead.🤝 #Cybersecurity #ZeroDay #ZDICAN25373

3 31 93 9K 40

View Details

Steven Lim @0x534c

9 months ago

Proactive detection for UNC6040 (aka ShinyHunters) cloud.google.com/blog/topics/th… Google's Threat Intelligence Group outlines security strategies to defend against UNC6040, a financially motivated threat actor using voice phishing (vishing) to compromise Salesforce environments. The attackers trick users into approving malicious connected apps, enabling data theft. The blog provides proactive hardening measures, logging protocols, and detection techniques to protect SaaS platforms, especially Salesforce. Below is a Seninel KQL detection for UNC6040 built based on GTIG report. detections.ai/share/rule/5LA… #Cybersecurity #UNC6040 #ShinyHunters

1 28 147 14K 99

View Details

Steven Lim @0x534c

11 months ago

🚨 SpyVPN Alert FreeVPN.One, a Chrome extension with 100K+ installs & a “Verified” badge, was caught secretly capturing screens & sending data to its servers. koi.security/blog/spyvpn-th… I built a KQL to track screenshot activity via MDE—great for spotting suspicious apps. detections.ai/share/rule/sKj… #CyberSecurity #DataExfiltration #MDE #KQL

0 42 117 11K 56

View Details

ACE Responder @ACEResponder

11 months ago

Windows lateral movement quick reference #ThreatHunting #DFIR

0 118 635 54K 580

View Details

Steven Lim @0x534c

11 months ago

🚨 CVE-2025-8088: WinRAR Zero-Day Used to Deploy RomCom Backdoors ESET has identified spearphishing campaigns leveraging malicious RAR attachments to exploit CVE-2025-8088—a WinRAR zero-day vulnerability. This technique delivers RomCom backdoors, attributed to threat actor Storm-0978 (aka Tropical Scorpius / UNC2596). bleepingcomputer.com/news/security/… To support fellow Defenders, I’ve crafted a KQL detection to surface indicators of this exploitation. It’s designed to help identify Storm-0978 activity until your infrastructure team rolls out the necessary patch. detections.ai/share/rule/MDr… #Cybersecurity #WinRaRZeroDay #Storm0978

7 55 245 28K 182

View Details

BleepingComputer @BleepinComputer

12 months ago

Amazon AI coding agent hacked to inject data wiping commands - @billtoulas bleepingcomputer.com/news/security/… bleepingcomputer.com/news/security/…

3 62 122 30K 34

View Details

Microsoft Threat Intelligence @MsftSecIntel

12 months ago

Customer guidance for SharePoint vulnerability CVE-2025-53770

Microsoft Security Response Center @msftsecresponse

12 months ago

Microsoft is aware of active attacks targeting on-premises SharePoint Server customers, exploiting a variant of CVE-2025-49706. This vulnerability has been assigned CVE-2025-53770. We have outlined mitigations and detections in our blog. Our team is working urgently to release

3 103 228 76K 88

2 43 162 27K 49

View Details

André Baptista @0xacb

a year ago

DMARC can reveal more domains associated with a target. dmarc.live/info/<target-domain> allows you to find domains using the same DMARC record. Check it out 👇 There's also a python tool: github.com/Tedixx/dmarc-s…

10 198 1K 66K 1K

View Details

SANS DFIR @sansforensics

a year ago

🔥 The NEW #CTI Cheat Sheet by @likethecoins & Rebekah Brown is now available! Packed w/ frameworks & methodologies this guide simplifies threat modeling, tackles cognitive biases, & sharpens your analysis. 📥 Download your FREE copy: sans.org/u/1zTr #ThreatIntel #DFIR

1 48 172 14K 121

View Details

tuckner @tuckner

2 years ago

CyberHaven malicious extension (24.10.4) details 🧵 A new content script was added to the extension manifest which runs at the start of every webpage

2 16 65 20K 23

View Details

Christopher Stanley @cstanley

2 years ago

Cyberhaven breach reported. Employee phished and pushed malicious chrome extension. Command and Control: 149.28.124.84 cyberhavenext[.]pro File Hashes: content.js AC5CC8BCC05AC27A8F189134C2E3300863B317FB worker.js 0B871BDEE9D8302A48D6D6511228CAF67A08EC60

13 64 306 115K 101

View Details

Adam Chester 🏴‍☠️ @_xpn_

2 years ago

This hack is brilliant, APT28 hopping into a target environment over wifi by compromising neighbouring companies and finding a dual-homed host within range. volexity.com/blog/2024/11/2… And yet... they got caught doing this!

21 101 623 89K 332

View Details

AdamTheAnalyst @AdamTheAnalyst

2 years ago

Shout out to all the Windows tech's going round deleting C-00000291*.sys on critical systems this morning. #ThoughtsAndPrayers

0 0 4 252 0

View Details

AdamTheAnalyst @AdamTheAnalyst

2 years ago

@RobelCampbell Potential Distro Infra: urlscan.io/search/#page.u… urlscan.io/search/#page.u…

0 0 3 85 1

View Details

Julien Hoez @JulienHoez

2 years ago

A Chinese military training site in China's Inner Mongolia region is an exact replica of the road network near Taiwan's Presidential Palace. Make no mistake: China fully plans to invade Taiwan in a geopolitical play that will unbalance the region.

599 6K 33K 5.6M 6K

View Details

Florian Roth ⚡️ @cyb3rops

2 years ago

I have created a YARA rule to detect binaries that are signed with a potentially compromised AnyDesk signing certificate (if the PE header info isn't AnyDesk -> other binaries signed with the compromised cert) #100DaysOfYARA #AnyDesk github.com/Neo23x0/signat…

Florian Roth ⚡️ @cyb3rops

2 years ago

download.anydesk.com/changelog.txt

4 14 46 86K 3

12 198 573 217K 161

View Details

Germán Fernández @1ZRR4H

3 years ago

🚩 This is worrying and continues to increase, multiple threat actors, including ransomware operators and initial access brokers, are abusing the @GoogleAds service, but at a higher level. Attackers manage to show the original domain (URL) in the malicious ads, which is eventually displayed to thousands of potential victims on Google's main results page. Three recent examples, thanks to Intel from Colin Cowie (Sophos) and Jérôme Segura (Malwarebytes) 👏 1.- #Pikabot (I think this is new 👀) ▪ infosec.exchange/@th3_protoCOL/… ▪ infosec.exchange/@th3_protoCOL/… 2.- #BatLoader ▪ infosec.exchange/@th3_protoCOL/… 3.- #FakeBat + Hunting Panel: ▪ malwarebytes.com/blog/threat-in… 🚨 DON'T TRUST Ads, be cautious, investigate, confirm.