Pinned Tweet
A little late to announce, released new research from @Acronis TRU Team, where we uncovered a threat under the alias #RedHeron performed rapid weaponization of n-day flaws in Gitea(CVE-2026-60004) and successfully targeting & exfiltrating sensitive details while uploading backdoors, across 5 countries mainly sectors such as an energy company in Canada, e-learning, voting/democracy, NGOs in USA & a famous trading firm in Argentina and a victim around Sri Lanka, further dropping a novel Linux rootkit, which we track under the alias #SIXZUT. Released a list of fresh IOCs as well!
Read the research here: acronis.com/en/tru/posts/red…
NtAlertThread retweeted
New WebSockets Backdoor Likely Targeting Iraq
📡 Staging: 153.75.247[.]94:80
📡 C2: www.xionamiconm[.]com:8050/ws/
dmpdump.github.io/posts/webs…
#APT #Backdoor
h/t: @malwrhunterteam
Presenting two of our research tomorrow & day after tomorrow at @virusbtn( Virus Bulletin) with @riv3r_styx , for the second consecutive year, if you are around, let's catch up!
virusbulletin.com/conference…
virusbulletin.com/conference…
Also, here's a small found, basically a TA's project known as Hephaestus targeting Indonesian government & all entities in Indonesia, looks like someone's entire arsenal with details like recon, exfiltrated stuffs & POCs of multiple vulns related to Cacti, Roundcube, Webmin, LiteSpeed, Joomla, Laravel! All props to @etugenio !
194[.]233[.]72[.]68[:]9999
NtAlertThread retweeted
New video: basic reversing of a Windows kernel driver.
WESP, the new endpoint security driver in Insider builds, has no device objects and no dispatch routines. Its imports tell you how it really talks to user mode: a filter communication port.
Full write-up: trainsec.net/library/malware…
NtAlertThread retweeted
Washing the dishes doesn't exercise your brain or deepen your understanding of the problem. Solving technical problem by yourself does. Once you stop practicing, you loose the ability to think certain way, and you won't be good to even supervise the machine or question it. I am all for using LLMs, but let's be honest, promoting is too easy to even be called a skill. If this is our core education, humanity will degrade.
NtAlertThread retweeted
Two names in a Linux rootkit configuration led back to HestiaCP compromises reported months before Acronis's Red Heron report.
I used VirLabs to follow the trail through SIXZUT, JITTERLY and their infrastructure.
virlabs.ai/blog/red-heron/
NtAlertThread retweeted
Chinese hackers exploit multiple technologies to steal govt data
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Cool research from guys at @GreyNoiseIO , also this one here overlaps with #RedHeron APT’s campaign which we disclosed a week earlier, thank you the reference!
🚨 A suspected Chinese-speaking attacker stole 18,566 records from an unnamed Western government body in under three hours on 22 July.
The records include plaintext passwords and personal data tied to law enforcement and government agencies.
The attacker got in through a WordPress exploit chain.
The same actor held multiple campaigns, compromised at least 49 organisations in 29 countries, plus 996 Zyxel switches in 48 countries.
NtAlertThread retweeted
also we are not some random dudes, check our work before, we work with companies like perplexity and vercel.
hacktron.ai/blog/
NtAlertThread retweeted
We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more.
It was literally xkcd #234, one obscure image library beneath a huge number of apps. 🧵
NtAlertThread retweeted
Quick notes on a likely #Pakistan nexus #backdoor targeting #Afghanistan 🇦🇫
#APT #Backdoor
🐞 dxgi.dll (a6ceacda670b88e8a8ec9ff5da6a77d9f1c896d6479b2dadb700474a8c408f80)
📡 C2: 185.235.137[.]35:9000
dmpdump.github.io/posts/Back…
NtAlertThread retweeted
Thread 🧵
1/ 🚨 NEW RESEARCH: We identified a training program provided to government employees in Angola by the Israeli influence-for-hire company BlackCore.
Full report: citizenlab.ca/research/black…
Recovered a very weird open directory located out of China, using @etugenio , possibly related to anti-corruption bureau(?) , while contrasting they are abusing instances related to CVE-2026-24061 PoC written @C2IRIS , bonus, found this weird video as well, possible AI-Generated, related to anti-corruption!
NtAlertThread retweeted
🚨 Red Heron exploited a Gitea RCE to compromise 13 organizations across six countries.
The actor automated a public exploit, stole repositories and credentials, and in one Taiwanese environment reached root on a three-node Proxmox cluster.
How the campaign escalated: thehackernews.com/2026/09/re…
NtAlertThread retweeted
Red Heron weaponized a Gitea n-day within days, scanned 1,386 instances, and automated exploitation and repository theft. New research by @Acronis' TRU @ElementalX2 acronis.com/en/tru/posts/red…
What interests me, around this entire campaign, the the TA had PRC-linguistics on the targets and multiple scripts to filter out the important one out, while in an interesting case, where they compromised a Taiwanese company, they performed lateral movement possibly compromising their NAS services as well!
NtAlertThread retweeted
Excited to speak at @MITREattack #ATTACKcon 7.0! 🎤
In “Breaking the Defenders,” I’ll share what MSP telemetry reveals about EDR killers, BYOVD, and Defense Impairment techniques that precede ransomware.
📍 McLean + virtual, Oct 27–28. Who’s joining?
na.eventscloud.com/mitreatta…
