@Intel_Ops_io

Adversary Infrastructure Hunting & Training Curated Threat Intelligence Feed (Coming Soon) https://xitter.cf/t.co/N9OKrTrvV0 https://xitter.cf/t.co/3YFZfEbgpI

academy.intel-ops.io/courses/hunting-adversary-infra
Joined January 2024
  • Tweets113
  • Following4
  • Followers2.4K
49Media
🚨New Partnership Announcement!🚨 All students will receive enhanced access to @Validin providing improved hunting capabilities. Upcoming training on Validin and real-life use cases tracking threat actors are on the way! inc. dedicated Discord channel for Validin. 🔥🔥🔥
4
2
2
30
21,019
We're tracking an interesting cluster linked to ShadowSyndicate that suggests that the operators are involved in various initial access campaigns, leverage multiple post-exploitation techniques, tools and ransomware.
2
8
36
4,909
Activity: Chaos Remote Administration Tool. Hijack Loader delivers StealC, Danabot. FakeUpdates delivers Rhadamanthys. PowerShell to retrieve payloads. Historical use of Cobalt Strike and Metasploit Cerber and Xorist ransomware samples identified.
1
1
1
1,459
Infrastructure predominantly distributed across Flyservers S.A. hosting, but the following also used: HOSTKEY-USA, Global Layer B.V. Bunea TELECOM SRL, DATAHOME S.A, Krez 999 Eood, Fbw Networks SAS.
1
1,236
New impersonation domains for @anydesk and @NotionHQ delivering malicious MSI packages, likely via SEO poisoning: 45.93.20[.]93 - AS 57523 (Chang Way Tech Co. Ltd) amydlesk[.]com (0/93) notlilon[.]co (1/93) notliion[.]com (8/93)
2
15
2
55
20,408
microsoft.com/en-us/security…. redcanary.com/blog/threat-in…

Financially motivated threat actors misusing App Installer | Microsoft Security Blog

Threat actors Storm-0569, Storm-1113, Sangria Tempest, Storm-1674, use the ms-appinstaller URI scheme (App Installer) to distribute malware.

microsoft.com
1
1
4
2,120
Interesting recently created (2024-05-22) domain impersonating @GEHealthCare. Resolving to 46.101.212[.]131, running #CobaltStrike server. Using @Huntio we can see: ➡️the DNS record, ➡️Hoster: @digitalocean, ➡️Watermark: 987654321 (cracked version).
10
39
5,189
APT43/Kimsuky (Black Banshee)🇰🇵 /141.11.95.135 /67.217.60.68 /67.217.62.219 /185.141.171.31 /185.203.119.14 /note.iiiii.info /share-defence.uberlingen.com /imagedownload.ignorelist.com /signin-ym.quest /mnlp.quest /oso-usps.com /drives.youramys.com /www.uidlogin.o-r.kr /wilsoncenter.port0.org /drive.wilsoncenter.port0.org /wilsoncenter.0rg.us /drive.wilsoncenter.0rg.us /naververify.p-e.kr /uidlogin.o-r.kr /atlanticcouncil.youramys.com /atlanticacouncil.org.youramys.com H/T @1ZRR4H
7
34
149
26,773
Hunting Cobalt Strike C2 with @ValidinLLC🎯 Initial node acquired by @Intel_Ops_io 213.148.25.161 (0/90 VT)
2
12
62
12,485
We are pleased to announce a new partnership between @Intel_Ops_io and @Huntio🤝 This partnership will provide all current and new IntelOps students with access to the Hunt.io platform. Students will learn to use the platform effectively for exploring new pivoting methods and hunting for malicious infrastructure, including new C2s🥷, APTs 🇮🇷 🇰🇵 🇷🇺 🇨🇳 and ransomware groups 🔐 hunt.io/ academy.intel-ops.io/courses…
11
2
93
7,826
Cybersecurity "experts" be like... APTs in 2024 will be using Artificial Intelligence to create undetectable malware, payloads, zero-day exploits, cyber weapons, and probably some cyber nuclear bombs too🥱 Meanwhile, APTs (Muddy Water 🇮🇷)in 2024 🙃
8
41
4
300
50,019
This one is a good example how infrastructure is reused by different actors. 216.189.159[.]34 - BianLian Ransomware💰 216.189.159[.]34 - North Korean APT 🇰🇵 @Intel_Ops_io
4
10
1
53
7,986
Intel-Ops retweeted
Validin
@ValidinLLC20 May 2024
New feature now available to premium AND community users! Per popular request, Validin now supports pivoting of certificate SHA256 hashes in addition to SHA1. This pivot makes it easier to continue searches from or on other platforms that favor SHA256.
8
24
3,663
🚨Hunting Black Basta's Cobalt Strike🧵 Intel-Ops is actively tracking #CobaltStrike servers in the wild, including those deployed by #BlackBasta. In this post, we’ll cover some findings from our analysis of #C2 servers included in the FBI/CISA advisory. medium.com/@Intel_Ops/huntin…
1
26
2
86
13,591
more replies
To conduct similar analysis and track threats such as these, we offer students a "Hunting Adversary Infrastructure" course: academy.intel-ops.io - students gain special Intel-Ops accounts for the @ValidinLLC platform (additional query and API credits) to help with learning.

Hunting Adversary Infrastructure Training Course

academy.intel-ops.io
1
1
4
733
Coming soon, students will also be able to have access to the @Huntio platform to use for Threat Hunting!
4
619
Load more