Reverse Threat Intel | Malware /Threat Hunter | Exploit Research \\ #IoT #Malware #Research, Reverse Engineering, #Botnet C2 #Hijacking
localhost
Joined June 2010
- Tweets5K
- Following1.4K
- Followers5.9K
- Likes3.5K
Pinned Tweet
here is the list of more than 4k sub-domain infrastructure including #DGA domain used by #UNC2452 #SolarWinds #backdoor
Link: pastebin.com/6EDgCKxd
cc: @iblametom @TheHackersNews @threatpost
R. retweeted
Internet Scanning in VirusTotal: hunting infrastructure by what it exposes
blog.virustotal.com/2026/10/…
R. retweeted
Just a reminder: If you have anything interesting to tell us, a hint, a leak you want to share or some other form of tip, use our Deaddrop : deaddrop.netaskari.online
R. retweeted
Just as Trump and Xi might be shaking hands today we are delivering deep dive into more data from the company 'ZRON'.
A digital Espionage-as-a-service shop, that hacked US embassy emails, runs big-data analysis operations on national and foreign targets for China's security services. There is a lot of ground to cover, so stay with us and let's go. 1/13
R. retweeted
🚩 Coruna iOS exploit kit
An overview of the C2 web panel 👁️
iPhone → Web/Safari → WebKit RCE → PAC bypass → Sandbox Escape / Kernel Privilege Escalation → Payload.
Interesting campaign highlighted in the tweet below.
MyCERT issued an advisory about a fake website that silently infects #iPhone simply by opening the page in Safari.
mycert.org.my/portal/details…
Here is a CTI report on the fake site and the multi-stage #Coruna & #DarkSword iOS exploitation chain.
github.com/douglasmun/Dougla…
R. retweeted
We discovered a Rootkit version of CoolClient by Mustang Panda in Pakistan, Mongolia, Myanmar, and Russia.
The kernel-mode driver of CoolClient called "Ftool" reveals a very interesting embedded PDB path of keyword “Nanjing Laboratory” (南京实验室)👀
securelist.com/honeymyte-coo…
R. retweeted
INTEL DROP
Tracking China-aligned LAPDOGS Operational Relay Box (ORB) infrastructure in our detection pipeline which powers our Total Insights Feed.
- Family: LAPDOGS
- Total hosts: 196
- Attribution: China-aligned
- Top countries: HK, JP, SG
- Distinct ASNs: 19
1.9.117.13
100.58.181.19
103.117.100.117
103.24.13.72
103.57.248.202
103.57.248.242
103.57.248.42
103.57.248.81
#TotalInsights #ThreatIntel #lapdogs #orb
team-cymru.com/total-insight…
🤖 Made with AI
R. retweeted
🤓 Let me introduce you to MoltThreats: The first AI Threat Intel Feed for Ai Agents!
In one week, OpenClaw became a widely used general AI agent. People started to run their own agents all over the world and connect them directly to the internet.
A few days later, Moltbook launched, a Reddit style forum designed for AI agents. Moltbook is a place where AI agents connect and exchange information through agent skills.
But this also introduced serious security concerns!
When an agent connects to the internet without continuous human oversight, it can be compromised through prompt injection, skill poisoning, malicious packages, and more.
This is why I created MoltThreats.
MoltThreats is the first threat intelligence feed for AI agents. Similar to Moltbook in how agents connect, an agent uses MoltThreats to report threats and alert other agents.
When an agent connects to MoltThreats, it also receives the latest security signals from the feed and updates its local security. md file with recommended protections.
This is MoltThreats.
The first threat intelligence feed for AI agents, curated and reviewed by humans.
🦞 promptintel.novahunting.ai/m…
R. retweeted
OpenClaw, an open-source personal AI assistant, jumped from ~1,000 to 21,000+ deployments in under a week.
Censys found thousands of instances exposed on the public Internet 👇
hubs.ly/Q0417QZV0
#AI #Cybersecurity #OpenClaw
R. retweeted
I've been trying to reach @moltbook for the last few hours. They are exposing their entire database to the public with no protection including secret api_key's that would allow anyone to post on behalf of any agents. Including yours @karpathy
Karpathy has 1.9 million followers on @X and is one of the most influential voices in AI.
Imagine fake AI safety hot takes, crypto scam promotions, or inflammatory political statements appearing to come from him.
And it's not just Karpathy. Every agent on the platform from what I can see is currently exposed.
Please someone help get the founders attention as this is currently exposed.
R. retweeted
CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) are critical unauthenticated RCE vulnerabilities in the React Server Components (RSC) "Flight" protocol.
Default configurations are vulnerable – a standard Next.js app created with create-next-app and built for production can be exploited with no code changes by the developer.
Exploitation requires only a crafted HTTP request and has shown near-100% reliability in testing. The flaw stems from insecure deserialization in the RSC payload handling logic, allowing attacker-controlled data to influence server-side execution.
wiz.io/blog/critical-vulnera…
R. retweeted
Awesome new threat report from Google Threat Intel Group documenting how threat actors are leveraging Gemini. A lot of information and actionable avalable in the report! Great work 👌
services.google.com/fh/files…
R. retweeted
Proofpoint threat researchers have designed an open-source tool—named PDF Object Hashing—to track and detect the unique characteristics of PDFs used by threat actors... similar to a digital fingerprint.
We use this tool internally to help track multiple threat actors with high confidence, improving attribution in many cases.
The tool has been released in the @Proofpoint Emerging Threats public #GitHub for other defenders to leverage.
Learn more about it here: brnw.ch/21wWSH0
@ET_Labs #PDF #threatdetection #cyberthreat
ALT Example PDF lures used by threat actors impersonating various brands.
R. retweeted
💥 Wiz Research has uncovered a critical Redis vulnerability that's been hiding for 13 years
We found RediShell (CVE-2025-49844): an RCE bug in Redis that affects every version of Redis out there. It's rated CVSS 10 - the highest severity possible.
The vulnerability lets attackers send a malicious Lua script, escape the sandbox, and execute code on the host.
About 330,000 Redis instances are exposed to the internet right now. 60,000 have no authentication. Over 75% of cloud environments are running Redis.
Redis released a patch this weekend and we responsibly disclosed everything upon discovery. Huge thanks to the Redis team for their fast response and collaboration ❤️
If you're running Redis: update immediately.
Our blog has the full technical breakdown and security recommendations >> wiz.io/blog/wiz-research-red…
