Ben @polygonben

@ctrlaltintel @L_Lgde This was known since the day he was arrested. Also, Yutek-NN & IAC MChS is basically a cover for Rostech-affiliated threat actors which I believe is Void Blizzard.

Artem Tamoian @artemtam

8 months ago

Ладно, раз уже написали про это, рассказываю: Арестованный в Таиланде российский хакер Денис Обрезко работал в ЮТЕК-НН и Информационно-Аналитическом Центре МЧС. Знаете, кто ещё работал в ЮТЕК-НН и ИАЦ МЧС и занимался «хакерством» в пользу РФ? Антон Листаров – человек, который

7 81 526 58K 44

When will the cybercriminals ever learn…

Full analysis & writeup here: ctrlaltintel.com/research/VoidB…

9 McNuggets & a McChicken burger helped us link a Russian hacker to 🇷🇺 government😅 Denis Obrezko was put on the international wanted listed by Russia, following an FBI arrest in Phuket last November. Our independent investigation shows Obrezko has closes ties to the Moscow👇

keyboard_arrow_left Previous keyboard_arrow_right Next

ctrlaltintel.com/research/VoidB…

kb.cert.org/vuls/id/213560 I can confirm this also exists in an another Tenda router. This one is more of an enterprise offering, the G300. Firmware download: tendacn.com/us/material/sh… Thanks Tenda for not stripping your binaries :) @ctrlaltintel @rootsecdev

Attribution Matters. Impose Cost: Angelo Martino, 41, of Land O’Lakes, Florida, formerly employed as a ransomware negotiator, was sentenced today to 70 months for his role in conspiring with Blackcat/ALPHV (BlackCat) actors to extort multiple victims, as well as conspiring with other former cybersecurity professionals to attack additional victims in 2023. justice.gov/opa/pr/florida…

Hunting for C2 #OPSEC failures w. @Huntio: VShell edition 🧵 Context: - VShell is a Chinese-developed CS alternative - VShell is developed on the NPS codebase - Often used by Chinese APT groups, but also seen in the wider cybercrime ecosystem (1/8)

If you have spare change, I mean literal spare change, money you can genuinely afford to part with, I'd appreciate a donation. If not, like and follow and boost my work. That helps just as much. This post is very much a last resort and I appreciate any support given. Thank you for reading this far. Genuinely. linkedin.com/in/foilman gofundme.com/f/jason-needs-…

Squats, Backdoors, ClickFix and Blockchain. As part of a Have I Been Squatted & @ctrlaltintel researcher traced a typosquatted domain through a ClickFix lure, persistent macOS backdoor, and blockchain-based command-and-control infrastructure. haveibeensquatted.com/blog/from-typo…

One of our researchers has published a blog for @beensquatted exposing an ongoing macOS stealer & backdoor campaign 🔥 Originating from typosquatted domains, a threat actor is using ClickFix lures to deliver a persistent macOS loader hat hosts C2 using Polygon smart contracts👇

There are so many people who deserve their roses but rarely get them. It would literally be impossible to name them all. But here are just some of the many, many people who stood by me. If your name isn't here, don't think I don't appreciate you. Here's just one of each of their many attributes: @khanjicyber: a guide and a beacon of hope @notbrvnd0n: always there with steady support @loop0420: never fails to check in on me @rickcsong: a big business guy who still makes time to call and check in @NetAskari: always sending me cool cyber stuff @nattyfried: like an older brother to me @Crimeonadime: selfless to the core @AidanOsint: someone I owe a genuine thank you @abdo_mhanni: genuine through and through @IntCyberDigest: forgiving and empathetic Now rapid fire: @Alph4betSoup, @IntelOpsV3, @0x686967, @polygonben, @urharmless, @kimmydotzip, @dutch_osintguy, @BashBunny, @NotNordgaren, @Harrris0n, @maybeitsjayy And to Kirwin, thank you. And to the rest, I simply don't have enough chars to type. And last but certainly not least, the most important of all, my Mum. Who has handled all the messy paperwork. Who has sleepless nights from the trauma of the crash. Who came in even when I was stinky, smelly, and vomiting. Who spent as much as she could afford trying to make me eat when my stomach wasn't working. Who fights for me when I am too weak to fight for myself. And to the rest of my friends and family, thank you.

@foilmanhacks Thank you man ❤️ Never forget the words from the Lifesaver: “Don’t bend to the mental strain … against all odds we must strive for essential gain” You don’t realize how much you’ve done to keep me sane 🫶

Thrilled to announce our (@spontiroli & me) from @Acronis TRU Team, new & in-depth research, where we saw Mustang Panda targeting India's Hydropower Sector, government sector and many more, using implants which we call as SHARDLOADER v1.0, v1.1, MINIRECON, ZOHOMURK. We worked with Indian Computer Emergency Response Team, @IndianCERT on data-sharing and multiple other purposes leading to disruption of a live campaign, which had been targeting Philippines as well. While, we had been already tracking the first campaign, we saw a second campaign using @Zoho as a C2(exfil mechanism) widely adopted across Indian Government. Another interesting feature, which we found that the threat actor went slightly offensive causing issues inside the analyst's VMs, while leaving a bunch of OPSEC issues inside the implants and using similar launcher binaries. Read our research here: The implant was also seen and reported by @smica83 🐐& thanks to @IndianCERT on working with us to disrupt the ongoing and live campaigns.

keyboard_arrow_left Previous keyboard_arrow_right Next

Possible MINIRECON implant used to target India🇮🇳 FileName: Letter to His Excellency the President[.]zip SHA-256: 6c8784885506b0fa3b0543be3c5caec1a4b3c689331d1012847505c61440b2be

NtAlertThread @ElementalX2

2 weeks ago

Thrilled to announce our (@spontiroli & me) from @Acronis TRU Team, new & in-depth research, where we saw Mustang Panda targeting India's Hydropower Sector, government sector and many more, using implants which we call as SHARDLOADER v1.0, v1.1, MINIRECON, ZOHOMURK. We worked

keyboard_arrow_left Previous keyboard_arrow_right Next

3 23 67 11K 20

This isn't secret, it's not a weapon either... the kid was fucking stupid and used a machine to do crime in config that is insanely stupid (if we consider they probably didn't want to get caught) they used edge in its default config, hey had opted in to telemerty. The takes online and articles like this are fucking ridiclous

Secure Zona @securezona

a week ago

Microsoft's secret weapon exposed. The FBI used a Windows Global Device Identifier (GDID)—a persistent, OS-level hardware fingerprint—to completely unmask a high-profile hacker despite them using a VPN. If you're on Windows, telemetry is always watching.

2 2 9 43K 10

I dumped NetNut's frontend source code for their global and Chinese portals. Anyone can now see how it worked internally. They claim to be ethical and to not route through real people's devices, their schema tells a different story. (Source code link at the end)

keyboard_arrow_left Previous keyboard_arrow_right Next

#Mandarin-speaking threat actor is targeting Vietnam by impersonating the Vietnam Government's Tax Public Service Portal to distribute a malicious Fake eTaxMobile APK vn-dichvucong[.com 398db8ea60f9249bf902bb10e21de621 @malwrhunterteam @skocherhan @smica83 #Vietnam #Malware

keyboard_arrow_left Previous keyboard_arrow_right Next

The OPSWAT Academy Cyber Challenge 2026 @OPSWATAcademy #cyber #ctf #London

OPSWAT Academy @OPSWATAcademy

3 weeks ago

London, you're first. 🎯 The OPSWAT Academy Cyber Challenge 2026 kicks off in the capital on 4 July - and if cybersecurity is your world, or you want it to be, this is the day that changes how you think about it. 🙌 One full day at Queen Mary University of London. A documentary

0 1 3 556 0

Another banger dammmm open.spotify.com/track/6pvd8OBn… @foilmanhacks <3

I never post about music, but I’ve always been a big hip-hop head @foilmanhacks recommend this banger, first time hearing it. It homes hard n helped me reflect ❤️ open.spotify.com/track/1fotoYON…