butterfly effect
Westeros
Joined February 2024
- Tweets172
- Following402
- Followers407
- Likes216
somedieyoungZZ retweeted
We anticipated this talk a lot. Prajwal Awasthi peeked inside StealthServer, part of the C2 infrastructure allegedly belonging to APT36. Wait, it's not StealthServer, it's now called SPIDY C2 😂 #TheSAS2026
somedieyoungZZ retweeted
Terrible opsec by Transparent Tribe described by @IdaNotPro at #TheSAS2026
@Mao_Ware you’d love this, a big fan of opsec failures by any sorts of CATS
somedieyoungZZ retweeted
🎯 APT research gets especially interesting when the operators forget basic OPSEC.
Prajwal Awasthi, Threat Intelligence Analyst at CloudSEK, brings one such case to #TheSAS2026.
His talk "No OPSEC, No Problem: Inside Transparent Tribe" centers on an undocumented APT36 C2 framework discovered while it was being built. This offers a rare, hilarious and informative look at adversary workflow.
✈️ Join us to see it live: thesascon.com/
somedieyoungZZ retweeted
Honored to be on the #TheSAS2026 speaker lineup. 🌴
Bringing a research we’ve been sitting on for a while. See you in Bali.
🔥 The #TheSAS2026 agenda is live: thesascon.com
Browse the sessions, plan your route, then hit REGISTER if you haven’t already. 😉
Yes, there’s still some chaos. A few timings and details may still shift. No, that’s not unusual when active research and fresh findings are involved.
A couple of talks will be revealed closer to the event while vulnerability fixes are still in progress.
See you in 🌴 Jimbaran Bay!
Honored to be on the #TheSAS2026 speaker lineup. 🌴
Bringing a research we’ve been sitting on for a while. See you in Bali.
🔥 The #TheSAS2026 agenda is live: thesascon.com
Browse the sessions, plan your route, then hit REGISTER if you haven’t already. 😉
Yes, there’s still some chaos. A few timings and details may still shift. No, that’s not unusual when active research and fresh findings are involved.
A couple of talks will be revealed closer to the event while vulnerability fixes are still in progress.
See you in 🌴 Jimbaran Bay!
somedieyoungZZ retweeted
🔥 The #TheSAS2026 agenda is live: thesascon.com
Browse the sessions, plan your route, then hit REGISTER if you haven’t already. 😉
Yes, there’s still some chaos. A few timings and details may still shift. No, that’s not unusual when active research and fresh findings are involved.
A couple of talks will be revealed closer to the event while vulnerability fixes are still in progress.
See you in 🌴 Jimbaran Bay!
🤖 Made with AI
somedieyoungZZ retweeted
A Russian-speaking Aurora ransomware affiliate used the AI coding assistant Cursor to plan attacks on more than 20 organizations
Researchers found the chat logs, credential dumps and encryptor binaries on the operator's own server, left open on port 8888
somedieyoungZZ retweeted
ALT Dear all, We know that many of you have been waiting to hear from us regarding the events of the past week. It would be an understatement to say that having videos of Grand Theft Auto VI gameplay leak in this way has been heartbreaking for our team, and this is obviously not how we intended for you to see the game after all this time. We are very sorry that everything has taken as long as it has \u2014 from getting the game finished (nearly there!) to sharing more details and official gameplay, and providing the community with everything you want to know. We are very excited for everyone to see the extended look tomorrow. It has taken longer than we wanted to get it ready, but as with everything we do, we know we need to exceed your expectations, and we are determined to deliver at the level you expect and deserve.
somedieyoungZZ retweeted
There's a lot of misinformation and panic going around about the Windows GDID (Global Device ID), let's talk about what it actually is. 🧵
> Peter Stokes
> Scattered Spider guy
> Arrested
> Microsoft helps FBI
> Read court documents
> Page 12
> Microsoft tracks Stokes from GDID
> Microsoft Global Device Identifier (GDID)
> Stokes used Windows
> Page 34
> GDID assigned to each OS install
> GDID unique to each device
> GDID only change if OS wiped
> Stokes GDID 6755467234350028
> GDID reported internet activity to Microsoft
> GDID showed Stokes using Ngrok
> GDID reported Stokes IP address
> GDID showed Stokes web activity
> GDID showed timestamps of web activity
> GDID mapped with video game activity
> GDID showed games played
> GDID undocumented
> GDID only mentioned in one MSDN document
> Azure UCDOStatus
> Azure Monitor Logging
somedieyoungZZ retweeted
New supply chain threat uncovered
CloudSEK TRIAD found an npm campaign using crypto-javascri, a typosquatted package impersonating crypto-js.
It steals npm/GitHub credentials, hijacks maintainer accounts, and uses Tor-based C2 to stay harder to disrupt.
cloudsek.com/blog/inside-a-t…
somedieyoungZZ retweeted
Our first Blog post is live, Introduction to RustPack 🔥
msecops.de/blog/posts/rustpa…
More to follow in the future for sure!
somedieyoungZZ retweeted
🚨 New Research Alert: Inside the RedSun Windows 0day
A closer look at why this vulnerability exists and how Defender’s own logic enables the system compromise.
Read more:
cloudsek.com/blog/redsun-win…
h/t @WeirdQuadratic 🐐
#Windows #RedSun #0Day
🚨 New Research Alert: Inside the RedSun Windows 0day
A closer look at why this vulnerability exists and how Defender’s own logic enables the system compromise.
Read more:
cloudsek.com/blog/redsun-win…
h/t @WeirdQuadratic 🐐
#Windows #RedSun #0Day
somedieyoungZZ retweeted
Here's the exploit in action, using the RedSun PoC
(note this is demostrated in virtual machines and this is purely for educational purposes, please don't repilcate the exploit on any systems you are not permited to do so)
Windows defender has been compromised.
right now there is a public unpatched exploit that gives any app on your windows PC full system admin access. no password. no popup. nothing
your antivirus doesnt stop it. your antivirus IS the exploit. windows defender is the attack vector
ransomware gangs can use this to encrypt your entire machine and steal every saved password, browser session, and discord token you have. fully patched windows 11. real time protection on
thread
somedieyoungZZ retweeted
CloudSEK Triad has published a detailed investigation into the RAMP cybercrime forum, covering its operations and working from 2021 through its seizure by the FBI in January 2026.
Read the full report: cloudsek.com/blog/the-rise-a…
somedieyoungZZ retweeted
Sergey Mineev was the greatest APT hunter of all time. He sought no glory, he just loved the hunt. And his discoveries repeatedly redefined our collective knowledge of global cyberespionage.
Heartbroken to hear about the passing of @Skvern0. He was one of the best threat hunters in the industry - even APTs were afraid of him. I’m grateful for the time we worked together and for everything I learned from him. Rest in peace.
somedieyoungZZ retweeted
Excited to share my latest research on APT37 (aka ScarCruft) and their evolving campaign targeting so-called "isolated" networks through a carefully orchestrated multi-stage infection chain.
Key findings:
▶️Ruby-based loader: APT37 is deploying full Ruby runtimes with trojanized script to blend execution within legitimate environments.
▶️USB dead-drop technique: A refined removable media workflow bridges air-gapped segments, leveraging hidden directories to stage tasking and exfiltrate data.
▶️Cloud C2 evolution: The group has expanded its cloud abuse playbook, incorporating Zoho WorkDrive as an operational command-and-control channel.
In this research, I detail the full intrusion lifecycle from the initial LNK lure to the deployment of the surveillance backdoors with technical breakdowns.
Blog: zscaler.com/blogs/security-r…
