Malware analysis, Incident Response, Penetration Testing
Joined December 2020
- Tweets560
- Following9
- Followers1.1K
- Likes30
Pinned Tweet
I've reverse engineered the infamous NSO Group's Pegasus spyware for Android. Check out the article if you want to know how it implements its functionalities. cybergeeks.tech/a-technical-… #pegasus #spyware #dfir
CyberGeeksTech retweeted
Hybrid Analysis reports fake cryptocurrency wallets distributed as oversized Advanced Installer packages. The campaign impersonates wallets (e.g. Anchor, Zec, Iota, Onto, Dark, Stellar) using search-ranked attacker domains & valid code-signing certificates hybrid-analysis.blogspot.com…
CyberGeeksTech retweeted
I've recently analyzed a suspected russian threat actor that created fake crypto wallets and deployed a Russian RMM tool. Targets include Anchor, Zec, Iota, Onto, Dark, and Stellar wallets as oversized Advanced Installers. Full analysis at hybrid-analysis.blogspot.com…. #crypto #dfir
CyberGeeksTech retweeted
Suspected Russian Threat Actor Impersonates Legitimate Crypto Wallets to Deploy Remote Utilities hybrid-analysis.blogspot.com…
CyberGeeksTech retweeted
Suspected Russian Threat Actor Impersonates Legitimate Crypto Wallets to Deploy Remote Utilities hybrid-analysis.blogspot.com…
I've recently analyzed a suspected russian threat actor that created fake crypto wallets and deployed a Russian RMM tool. Targets include Anchor, Zec, Iota, Onto, Dark, and Stellar wallets as oversized Advanced Installers. Full analysis at hybrid-analysis.blogspot.com…. #crypto #dfir
CyberGeeksTech retweeted
攻撃者が配布用インストーラに自らのSSH認証情報やGitLabトークンをハードコードしたまま残し、約1年間の窃取キャンペーン全体を露呈させた事例が報告されています。偽の暗号資産取引アプリ「TralertFX」を囮に使う北朝鮮系アクターVELVET_CHOLLIMAの活動とみられ、フロント企業とみられる名義の正規EV証明書で署名されたMSIのAV検知率はわずか3/52。
窃取データの送出にGitLabへの自動コミットを使い境界防御の回避を狙った一方、配布物に認証情報やトークンを残す致命的なミスでインフラ全体が露呈した形です。
【攻撃の仕組みと規模】
・GitLabリポジトリをペイロード配信と窃取データの送出の両方に利用。システム偵察、キーロガー、ブラウザ認証情報窃取の3モジュールが30分間隔のgitコミットで盗んだデータを自動送信し、通常の開発者トラフィックに紛れる構成
・発見時点でコミット数は4,100件超、侵害ホストは90台以上。攻撃者は被害者ごとに名前付きフォルダで窃取データを手動分類し、暗号資産トレーダーを優先的に選別していたとされる
・最終ペイロードはオープンソースRATであるXenoRATの派生マルウェア「MoonPeak」。2025年6月から続くオペレーションで、当初はGitHubを使用していたが10月にGitLabへ移行し、11月以降は文字列ごとにシフト値の異なるシーザー暗号で難読化を強化
・EV証明書の発行先AgilusTech LLCはフロント企業と中〜高い確度で評価されており、コンパイルから署名まで26分で完了する自動ビルドパイプラインの存在も示唆されている
詳細は以下を参照：
hybrid-analysis.blogspot.com…
CyberGeeksTech retweeted
Velvet Chollima leaks its own backend infrastructure keys inside a malicious "Tralert FX" installer signed with a valid EV certificate.
#VelvetChollima #MalwareAnalysis #ThreatIntel #GitLab #CyberSecurity #InfoSec #CryptoTheft #OpSec #WindowsSecurity #EDR
securityonline.info/velvet-c…
CyberGeeksTech retweeted
I've analyzed a new VELVET CHOLLIMA (NK) campaign involving a fake trading app called Tralert FX. Key findings:
- Multi-module stealer
- GitLab-based auto-exfiltration
- Hardcoded creds exposed entire infrastructure
- MoonPeak payload
hybrid-analysis.blogspot.com… #dfir #threatintel
CyberGeeksTech retweeted
#Malware_analysis
1. Bandook RAT - C2 Traffic Analysis
github.com/HariCipher/bandoo…
// IOC extraction, protocol analysis, and detection notes
2⃣. VELVET CHOLLIMA Infostealer Campaign
hybrid-analysis.blogspot.com…
// Final payload is MoonPeak, a custom variant of the open-source XenoRAT malware
3⃣. Gentlemen RaaS
research.checkpoint.com/2026…
// The group actively evaluates CVE-2024-55591-github.com/robomusk52/exp-cm…, CVE-2025-32433- github.com/ProDefense/CVE-20…, CVE-2025-33073- synacktiv.com/en/publication… and combines them with technique‑driven paths like backup and management‑controller abuse and NTLM relay workflows
CyberGeeksTech retweeted
"VELVET CHOLLIMA Infostealer Campaign Using Trading App as Lure" published by @HybridAnalysis. #VelvetChollima, #DPRK, #CTI hybrid-analysis.blogspot.com…
CyberGeeksTech retweeted
VELVET CHOLLIMA Infostealer Campaign Using Trading App as Lure hybrid-analysis.blogspot.com…
I've analyzed a new VELVET CHOLLIMA (NK) campaign involving a fake trading app called Tralert FX. Key findings:
- Multi-module stealer
- GitLab-based auto-exfiltration
- Hardcoded creds exposed entire infrastructure
- MoonPeak payload
hybrid-analysis.blogspot.com… #dfir #threatintel
CyberGeeksTech retweeted
#Malware_analysis
1⃣ VoidLink: Dissecting an AI-Generated C2 Implant
ontinue.com/resource/voidlin…
2⃣ Technical Analysis of GuLoader Obfuscation Techniques
zscaler.com/blogs/security-r…
3⃣ "Opulous" - malicious Electron-based application
hybrid-analysis.blogspot.com…
4⃣ Fake 7-Zip downloads are turning home PCs into proxy nodes
malwarebytes.com/blog/threat…
CyberGeeksTech retweeted
Organized Traffer Gang on the Rise Targeting Web3 Employees and Crypto Holders reddit.com/r/InfoSecNews/com…
CyberGeeksTech retweeted
I've discovered an organized traffer gang (likely of Russian origin) that targets Web3 employees and Crypto holders and published the research at hybrid-analysis.blogspot.com…. #malware #threatintelligence #dfir
CyberGeeksTech retweeted
Hybrid Analysis reports an organised “traffer gang” targeting crypto holders and Web3 employees. The operation delivers malware via fake Electron apps, disguised as legitimate tools. hybrid-analysis.blogspot.com…
CyberGeeksTech retweeted
Hybrid Analysis , Organized Traffer Gang on the rise targeting Web3 employees and crypto holders -- hybrid-analysis.blogspot.com…
CyberGeeksTech retweeted
Organized Traffer Gang on the Rise Targeting Web3 Employees and Crypto Holders reddit.com/r/blueteamsec/com…
CyberGeeksTech retweeted
Organized Traffer Gang on the Rise Targeting Web3 Employees and Crypto Holders
hybrid-analysis.blogspot.com…
CyberGeeksTech retweeted
Organized Traffer Gang on the Rise Targeting Web3 Employees and Crypto Holders hybrid-analysis.blogspot.com…