
🇬🇧 Threat Research @RecordedFuture https://xitter.cf/t.co/yrwObzj7tS
United Kingdom
Joined September 2018
- Tweets467
- Following561
- Followers229
- Likes972
Lawrence_Sec retweeted
Check out the full reports:
📖 Record Future blog:
recordedfuture.com/blog/tag1…
📖 Cisco Talos blog:
blog.talosintelligence.com/b…
📄 Full Virus Bulletin paper:
virusbulletin.com/uploads/pd…
Lawrence_Sec retweeted
Great to see my and @ashl3y_shen’s Silent Lynx (TAG-193/UAT-6275) research featured by @razhael at @Reuters!
Cyber espionage isn’t just for the big players. Our findings shed light on Kazakhstan-linked activity targeting Russia and the wider CIS.
reuters.com/legal/litigation…
Lawrence_Sec retweeted
BlueDelta, overlapping with APT28/Fancy Bear, deployed the HOOKEDGE Windows backdoor against European diplomatic, government & defense targets. Read our blog for more details and related PolySwarm samples:
blog.polyswarm.io/hooked-on-…
#Cybersecurity #APT28 #BlueDelta #Malware
Fantastic work from BIRN, with new findings on Aeza, including a German AfD figure behind the registration of the sanctioned shell company Smart Digital Ideas. Great to see earlier @RecordedFuture research by @_whoisnt and me help inform the investigation.
BIRN has identified Andreas Maul, a town councillor for Germany’s far-right AfD party, as the man behind a Serbian company sanctioned by the US for aiding a Russian alleged cybercrime service provider.
balkaninsight.com/2026/08/28…
Article here: balkaninsight.com/2026/08/28…
Lawrence_Sec retweeted
Insikt Group has identified a series of BlueDelta (APT28/Fancy Bear/Forest Blizzard) initial access campaigns targeting government & diplomatic organizations in Romania, Spain & Turkey and using diplomatic-themed lures to deliver the HOOKEDGE backdoor. recordedfuture.com/research/…
Another day, another suspicious ISP: This time, a cluster of 🎣 phishing domains targeting Roblox drew our researchers' attention to EggyWall (AS219067), for which RIPE merely provides a residential address in northern 🇮🇹 Italy.
The sole prefix announced by AS219067, 5.175.169[.]0/24 (leased from 🇩🇪 GHOSTnet GmbH), got listed in SBL and DROP on August 20. Peculiarly, a few hours later, a second announcement surfaced: 107.150.72[.]0/24 (leased from 🇺🇸 Inter Connects Inc). Even more interesting, a variety of phishing domains previously seen on the first prefix started resolving to the second, potentially indicating a deliberate evasion attempt.
At this time, AS219067 is exclusively routed by 🇩🇪 Pfcloud UG (AS51396), which in turn obtains connectivity from 🇩🇪 aurologic GmbH's AS30823. Both ISPs are known among anti-abuse circles for their persistent proliferation of bulletproof hosters.
EggyWall's domains previously resolved to AS36680 ( 🇺🇸 Netiface LLC), another bulletproof hoster in Pfcloud's realm. Have we sniffed out a phisher trying to emancipate themselves from a criminal competitor? We are sure time will reveal it all. 🕵️
#Cybercrime #Phishing #BulletproofHosting
Lawrence_Sec retweeted
First blog out today via @RecordedFuture: Reviewing CopyCop’s recent targeting of Western AI investments in Armenia and potential areas where the influence operation may target next.
Read: recordedfuture.com/blog/copy…
Lawrence_Sec retweeted
In his latest for Binding Hook, Max van der Horst (@Shaunitor) looks at the ways taking down criminal infrastructure can inadvertently help #bulletproofhosting providers avoid accountability:
bindinghook.com/the-evidence…
1/ We just published new research on TAG-195 (“Golden Chickens”/“Venom Spider”), documenting a major evolution of one of cybercrime’s longest-running Malware-as-a-Service ecosystems.
recordedfuture.com/research/…
Alexander Volosovik (Yalishanda) & his hosting front Media Land LLC are, as of today, finally sanctioned by the EU 🙏 eur-lex.europa.eu/legal-cont…
Lawrence_Sec retweeted
👿 forge-jsx... forge-jsxy... and now forge-jsx4.
3rd wave of RAT published on npm, same payload across every package.
- system-wide keylogging via uiohook-napi.
- clipboard monitoring
- .env file scanning
- shell history collection
- host inventory enumeration
- desktop screenshot capture via jimp
- ...
- survives npm uninstall
Sends collected data at 204.10.194.247, Discord bot webhooks and ugging Face Hub repositories.
Read full analysis: safedep.io/malicious-forge-j…
Lawrence_Sec retweeted
Fighting cybercrime at scale takes more than technology. It takes the right partners. Recorded Future is now an official EC3 Partner with @Europol, helping shape how the world responds to cybercrime.
bit.ly/3QiJXRb
#ThreatIntelligence #Cybersecurity
Lawrence_Sec retweeted
🚨 JAILBREAK ALERT 🚨
ANTHROPIC: PWNED 🫡
FABLE-5: LIBERATED 🦋
let's start with the 🐘...
the consensus seems to be that this has been one of the most disappointing model drops of all time, effectively preventing legitimate researchers from contributing their talents to our collective advancement. and not just because of what it means for the short-term, but for what these decisions signify for the long-term.
but despite this overly sensitive, authoritarian "safety" layer on top of Mythos, my lil liberators have been hard at work—mapping the boundaries, probing the depths of long-context convos, and cleverly finding the holes in the fence that the thought police missed 🤗
we got some cyber, some chem, some psychological manipulation, and some good ol' fashioned explosives!
it took many attempts from multiple agents hunting as a pack, during which I observed a combination of techniques across:
• Unicode, homoglyphs, Cyrillic, and other Parseltongue-style text transforms
• Long-context reference tracking
• Taxonomy and document-structure reasoning
• Fiction and narrative framing
• Academic-review style contexts
• Intent-classification inconsistencies
but perhaps the most effective is decomposition + recomposition in the backend. it's hard to get explicit names of harms like "Meth Recipe," but getting uplift on the process itself, like birch reduction method/reductive-amination (classic meth synthesis pathways), is much more doable.
defense becomes much more difficult to maintain when you start throwing in out-of-distro tokens, breaking up the harmful uplift into benign chunks, and then piecing the innocuous-seeming facts back together, especially when you have jailbroken Opus helping you do it 😉
gg
Seeing reports nLighten data center in NL and DE have confiscated MIRhosting's hardware along with its colocation customers! This has had a significant affect on alot of hosting providers so far.
MIRhosting, along with a whole landing party of hosting services, turned into monuments to inaccessible websites. The nLighten data center in the NL and DE simply pulled the cords from the racks, leaving thousands of customers alone with blank screens
pro-hosting.biz/en/news/worl…
No official confirmation this is law enforcement related... chatter among the community seems to think the action was taken by nLighten themselves. lowendspirit.com/discussion/…
Lawrence_Sec retweeted
Our new @threatinsight report is a comprehensive overview of TA4922, a newly designated Chinese-speaking, financially motivated threat actor that largely targets East Asia.
It currently conducts more unique campaigns than any other cybercriminal we track. proofpoint.com/us/blog/threa…


















