@Cyderes
Account based inUnited States!
About this account
- Account based in
- United States
- Connected via
- Web
X says this location may be affected by a proxy or VPN.
Account-level information from X, not a live location or the device used for a specific post.
Our mission is simple: stop threats and help organizations #BeEverydayReady. We share the latest analysis, threat research, and findings from #HowlerCell.
Joined October 2011
- Tweets7.6K
- Following841
- Followers11.8K
- Likes888
New #HowlerCell Threat Research
Two threat actors, one job-offer lure, same result: full remote access after one click. One ties to a Vietnam-nexus cluster; the other's custom, unattributed tooling.
Full breakdown + IOCs:
cyderes.com/howler-cell/job-…
The patch was released in July.
The bypass is here.
Howler Cell reproduced ShieldBreak, a new Windows zero-day that defeats Microsoft's mitigation for RoguePlanet and highlights why defenders should expect follow-on variants.
See how it works: bit.ly/4wvOz5f
🚨 New Microsoft zero-day tied to #MSNightmare: LegacyHive 🚨
Howler Cell reproduced the technique on Windows 11 and in a controlled environment. #LegacyHive is the ninth tool released by this researcher.
Read more by @reegun21 & @BaskarGreen: bit.ly/4vSLcFz
What looked like a Bangladesh Air Force officer bio was actually a multi-stage implant. Howler Cell tracks an active DoNot intrusion targeting Bangladesh’s military.
Read more by @reegun21, @BaskarGreen, & Rahul R: bit.ly/4fiWvAk
#HowlerCell
Howler Cell uncovered an active campaign targeting users through fake Indian Income Tax Department websites. Victims are shown tax notices and tricked into downloading a ZIP file that launches a six-stage infection chain ending in two RAT implants.
🔗 bit.ly/3SEmzyq
New from #HowlerCell.
See how one of our researchers spent 11 days inside a hardened Active Directory and gained Domain Admin access without novel exploits. The attack chain exposed a blind spot in Zero Trust: certificate authority governance.
🔗bit.ly/44trvsi
New #HowlerCell Threat Research
Hours after @Microsoft shipped June Patch Tuesday fixes, the researcher known as Nightmare-Eclipse resurfaced on GitHub as #MSNightmare, publishing #RougePlanet, the 7th exploit targeting Defender in the cluster.
bit.ly/4vFMxj5
Cyderes retweeted
Return of the Eclipse: #MSNightmare and #RoguePlanet
Analysis from @Cyderes #HowlerCell Threat Research team.
Hours after Microsoft shipped June Patch Tuesday fixes, the researcher resurfaced on GitHub as MSNightmare and published RoguePlanet, the seventh exploit in the cluster.
• New handle: MSNightmare (profile lists affiliation as "Microsoft")
• New exploit: RoguePlanet, a Defender zero-day
• Blog quote: "Microsoft cannot unwrite my code"
• Mirrors live on self-hosted Git: git.projectnightcrawler[.]dev/NightmareEclipse
• Blog: deadeclipse666.blogspot[.]com
The researcher is testing a ban-resistant publication model backed by self-hosted mirrors. Account takedowns no longer end the campaign.
#ThreatIntel #ZeroDay #PatchTuesday #VulnerabilityResearch #ThreatResearch
Read: cyderes.com/howler-cell/rogu…
Howler Cell's recent malware analysis highlighting the fake X-VPN installer deploying STX RAT was featured in @techradar by @monicajwrites.
Read more on TechRadar: bit.ly/4efJ9Eu
@reegun21 #HowlerCell #Cyderes
Cyderes retweeted
From Crypto Wallets to a 100M-User VPN: Inside an Active STX RAT Supply Chain Campaign
cyderes.com/howler-cell/cpui…
Cyderes retweeted
Credit to @xvpnteam for the fast fix and public acknowledgment of the report. Ten days from disclosure to patch is what responsible vendor response looks like.
@Cyderes #HowlerCell will keep publishing research like these so defenders can move faster than active campaigns.
Read the full analysis: cyderes.com/howler-cell/cpui…
X-VPN's official statement: xvpn.io/resources/statement-…
6/7 A per-victim subdomain structure derived from MD5(COMPUTERNAME+USERNAME) makes static IOC sharing ineffective at the URL level.
7/7 Anthropic is not compromised. The brand is being impersonated. The legitimate Claude Code installation path is unaffected.
Read the full breakdown here: cyderes.com/howler-cell/fake…
One credential. No device. Full tenant exposure.
Howler Cell put a production Microsoft Entra ID environment to the test. Conditional Access blocked the login, but it didn’t stop the attack. Mistrust creates real risk.
Read the full analysis: bit.ly/4uxl1nu
Mythos was breached in hours, not months.
No advanced techniques, just a poisoned library, vendor compromise, and broken trust. It’s not if AI attackers reach you. It’s whether you’ll see them.
Read more from Howler Cell: bit.ly/4t2dZpD
