@BarryV

Show me, don't tell me -- Opinions are my own and do not represent those of my employer

 New York, NY
Joined November 2008
  • Tweets2.5K
  • Following647
  • Followers963
197Media
Don’t forget you @virustotal collection with #APT45 iocs is available here virustotal.com/gui/collectio…
4
13
803
BarryV retweeted
BarryV@BarryV6 Jan 2023
Member Turla signing Javascript malware? Serial Number: cd:fb:13:a3:e6:49:ec:c5:df:95:db:88:ca:c1:3f:fb
2
14
1,182
One really cool thing we've implemented in this iteration of our graduation process is leveraging @virustotal's Collections to provide IOCS to the community for #APT44 - check those out here: virustotal.com/gui/collectio…
1
8
1
23
2,356
First blog post in the books! mandiant.com/resources/blog/…

Mandiant Cybersecurity Consulting

Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.

cloud.google.com
2
28
4
107
16,610
Today, Mandiant is sharing research on the GRU’s Disruptive Playbook, drawn from insights into GRU’s full-spectrum cyber operations in Ukraine over the past year. mandiant.com/resources/blog/…

Mandiant Cybersecurity Consulting

Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.

cloud.google.com
3
97
8
239
53,890
Head of Rubrik Zero Labs @stonepwn3000 recently talked to @joetidy of @BBCNews about why it is so rare to hear about Western #CyberAttacks and hacking teams and how the narrative of who the good guys and bad guys are in cyber-space is changing 👇 rbrk.co/43WGGsd

Why is it so rare to hear about Western cyber-attacks?

Could a cyber-attack on a Russian technology company provide a rare insight into a Western hack?

bbc.com
2
15
2
74
261,768
Really excited to see the culmination of some amazing work from some amazing people get released today. A report from @Google TAG, with contributions from friends at @Mandiant, on cyber activity related to the war in Ukraine. @t_gidwani @ShaneHuntley blog.google/threat-analysis-…
2
25
91
15,992
BarryV retweeted
Moritz@m_r_tz8 Feb 2023
capa v5.0.0 is out: major improvements for .NET binary analysis, 150 new/updated rules, caching to improve performance standalone and in the IDA Pro plugin, better ELF OS detection, and a lot more. github.com/mandiant/capa/rel… VirusTotal integration updates are next!

Release v5.0.0 · mandiant/capa

This capa version comes with major improvements and additions to better handle .NET binaries. To showcase this we've updated and added over 30 .NET rules. Additionally, capa now caches its rule...

github.com
1
57
4
165
28,611
If you have any intel analysis or threat hunting roles, please reach out to @PhreakingGeek. You'd be hard-pressed to find anyone more passionate about chasing adversaries than he is. I am broken-hearted to have lost him, but I know he'll make a great impact on a new team.
This Post is from an account that no longer exists. Learn more
2
8
32
7,843
We welcome @Mandiant's CAPA and GoReSym to our malware analysis suite. CAPA provides valuable TTPs, and GoReSym produces all kind of metadata to analyse GO samples: blog.virustotal.com/2023/01/…
1
74
7
242
52,538
#100DaysofYARA tons of tasty info can be pulled from Macho headers, especially Load commands! Lets get a generic count of LOAD_DYLIB commands to quantify the amount of external libraries are used - no idea if any # is suspicious github.com/100DaysofYARA/202…
5
1
19
2,932
Member Turla signing Javascript malware? Serial Number: cd:fb:13:a3:e6:49:ec:c5:df:95:db:88:ca:c1:3f:fb
2
14
1,182
Mandiant Blog - Turla: A Galaxy of Opportunity mandiant.com/resources/blog/… This is Mandiant’s first observation of suspected Turla targeting Ukrainian entities since the onset of the invasion.

Mandiant Cybersecurity Consulting

Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.

cloud.google.com
Tyler McLellan@tylabs5 Jan 2023
In September 2022 Mandiant Managed Defense detected data staging and exfiltration at a Ukrainian organization. Digging into this incident, we discovered QUIETCANARY (aka Tunnus), a suspected Turla Team backdoor, was the source.
24
2
33
10,272
What's the technical term for when you've absorbed so much technical debt you're spending all your time addressing support issues rather building?
392
75
54
1,006
249,236
If we’re gonna haggle/argue over terminology can it please be thrunt.
11
1
3
31
9,566
the elites don’t want you to know this, but this is actually sandworm
3
5
2
53
Likely Russian actor distributed trojaned copies of Windows OS: mandiant.com/resources/blog/…
4
11
5
43
Mandiant observed a POORTRY sample signed with a Microsoft Windows Hardware Compatibility Authenticode signature. Further analysis led to a larger investigation into malicious drivers signed via the Windows Hardware Compatibility Program. 😱🌶️🔥 mandiant.com/resources/blog/…
2
38
7
69
New from @SentinelOne and @Mandiant: Targeted Attacks Leverage Signed Malicious Microsoft Drivers: 🟣 s1.ai/signed-ms 🟣 mandiant.com/resources/blog/…
32
2
87
2013 - "Has anyone checked Mandiant's attribution?" 2015 - "Russians hacked DNC?! Crowdstrike is running a false flag!" 2016 - "Butter e-mails! They're drinking baby adrenaline!" 2018 - " The Ukrainians hacked the DNC! Wheres the server?!" 2020 - "ORANGE CHEETO IS MY GOD"
2
6
10th anniversary of Mandiant APT1 report Cyber-truther to Qanon evolution begins
1
1
Load more