CipherTechs is a global Cyber Security service provider founded in 2001 that remains privately held with headquarters in New York City.
New York, NY
Joined May 2010
- Tweets692
- Following296
- Followers358
- Likes114
CipherTechs, Inc. retweeted
- "... and then he said to sign my malware.exe with faked Microsoft cert to evade AVs/EDRs. Would you believe?"
(￣y▽￣)╭ Ohohoho.....
Sign-Artifact.ps1 - based on @mattifestation research & implementation shamelessly borrowed here:
github.com/mgeeky/Penetratio…
CipherTechs, Inc. retweeted
LAPSUS$ extortion group claims to have breached @Okta. They have released 8 photos as proof.
The photos we are sharing has been edited so no sensitive information or user identities are displayed.
Image 1 - 4 attached below.
CipherTechs, Inc. retweeted
Sandy Bacik, Director of Audit and Compliance at @CipherTechs, will present on PCI 4.0 next week at SecureWorld Philadelphia. See the conference agenda and register here: hubs.li/Q0168mQt0 #SWPHL22 #GRC
CipherTechs, Inc. retweeted
Can confirm!
➡️Splashtop
SRUtility.exe
➡️AnyDesk
AnyDesk.exe
AnyDeskMSI.exe
➡️Atera
AteraAgent.exe
AgentPackageSTRemote.exe
AgentPackageHeartbeat.exe
AgentPackageWindowsUpdate.exe
AgentPackageADRemote.exe
Thanks for sharing @AltShiftPrtScn!
#Conti ransomware affiliates using AnyDesk, Atera, Splashtop, Remote Utilities and ScreenConnect to maintain network access. During initial stage of IR I recommend blocking ALL remote access tools via Application Control policies, allow only the ones required & monitor their use.
CipherTechs, Inc. retweeted
Elevate to SYSTEM from a Service Account with Impersonate privileges by only using C# code and the built-in RPC runtime!
Great research from @tiraniddo googleprojectzero.blogspot.c…
CipherTechs, Inc. retweeted
APT cyber actors are among those exploiting vulnerability in ManageEngine ADSelfService Plus, CVE-2021-44077. In partnership with @FBI, we published a joint advisory about the cyber threat associated with this active exploitation: us-cert.cisa.gov/ncas/alerts…
CipherTechs, Inc. retweeted
The CVE-2021-40444 patch does not prevent to run active scripts from Word. You can still pretend to be a haxxor by using a valid URI scheme like "Calculator:"
🙃
CipherTechs, Inc. retweeted
Apple has released an update for iOS 14.8 and iPadOS 14.8 vulnerabilities that may have been exploited in the wild. Patch. go.usa.gov/xMjeK. #Cybersecurity #InfoSec
CipherTechs, Inc. retweeted
Since THOR adds multiple external vars in YARA rule matching, we can write a rule that looks for ELF binaries written by the #confluence user but outside any confluence directory for a compromise assessment
YARA rules
github.com/Neo23x0/signature…
THOR manual
thor-manual.nextron-systems.…
CipherTechs, Inc. retweeted
One of the developers for Babuk ransomware group, a 17 year old person from Russia, has been diagnosed with Stage-4 Lung Cancer. He has decided to leaked the ENTIRE Babuk source code for Windows, ESXI, NAS.
You can download the Babuk source here: vx-underground[.]org/tmp/
CipherTechs, Inc. retweeted
Windows 365 is expensive and without basic security
Did #mimikatz dumped my Azure *cleartext* password here? Or my Primary Refresh Token?
It's funny how you don't apply best practices you recommend to the customer to avoid securing by default
> github.com/gentilkiwi/mimika…
CipherTechs, Inc. retweeted
After several weeks of work, it's finally there!🔥
Introducing PPLdump, a tool for dumping PPL processes with a Userland exploit!😈
👉Post 1: itm4n.github.io/lsass-runasp…
👉Post 2: blog.scrt.ch/2021/04/22/bypa…
👉Tool: github.com/itm4n/PPLdump
Credit goes to @tiraniddo for the technique.
CipherTechs, Inc. retweeted
SentinelOne : Congratulations to Niccolo Alicandri of @CipherTechs, winner of our Silver Slugger Award for partner excellence!
#infosec #sentinelone #xdr #cybersecurity #edr #channel #success #innovation #growth #silverslugger #CipherTechs
CipherTechs, Inc. retweeted
If you as unpriv user wanna hide something a place where:
Only SYSTEM can do directory listing
Survives windows reinstall
Is not indexed
Normally never looked at
Is outside you profile directory
Never emptied
C:\SYSTEM~1\ClientRecoveryPasswordRotation
Is for you
CipherTechs, Inc. retweeted
CVE-2021-3156 also impacts @apple MacOS Big Sur (unpatched at present), you can enable exploitation of the issue by symlinking sudo to sudoedit and then triggering the heap overflow to escalate one's privileges to 1337 uid=0. Fun for @p0sixninja
CipherTechs, Inc. retweeted
[1/2]
🆕 Network admins beware, #SystemdMiner is now using DNS over HTTPs to connect to its .onion C2.
We uploaded IoCs to VT:
Modified UPX -> d5b98358d261730a9a81b480bd94cbc8
Unpacked -> 61d36807f333e9dd01737d74b2724ab9
->>
CipherTechs, Inc. retweeted
Just announced: Sandy Bacik will present on #IncidentResponse, #Forensics, and #CyberInsurance next month at #SecureWorldVirtual New England. Register with code SWVCSOC here: hubs.ly/H0D_rGG0 #DFIR
CipherTechs, Inc. retweeted
My take: Many Azure AD (AAD) environments are repeating same mistakes as they did with Active Directory.
Improve AAD Security:
1. Use PIM to control AAD roles (limit permanent members)
2. Only admin accounts in AAD roles
3. Ensure cloud admins use admin systems
Thread 1/3
This quoted post is unavailable.