🇬🇧 Threat Research @RecordedFuture https://xitter.cf/t.co/yrwObzj7tS

United Kingdom
Joined September 2018
Lawrence_Sec retweeted
Insikt Group has identified a series of BlueDelta (APT28/Fancy Bear/Forest Blizzard) initial access campaigns targeting government & diplomatic organizations in Romania, Spain & Turkey and using diplomatic-themed lures to deliver the HOOKEDGE backdoor. recordedfuture.com/research/…
10
39
2,636
Lawrence_Sec retweeted
Another day, another suspicious ISP: This time, a cluster of 🎣 phishing domains targeting Roblox drew our researchers' attention to EggyWall (AS219067), for which RIPE merely provides a residential address in northern 🇮🇹 Italy. The sole prefix announced by AS219067, 5.175.169[.]0/24 (leased from 🇩🇪 GHOSTnet GmbH), got listed in SBL and DROP on August 20. Peculiarly, a few hours later, a second announcement surfaced: 107.150.72[.]0/24 (leased from 🇺🇸 Inter Connects Inc). Even more interesting, a variety of phishing domains previously seen on the first prefix started resolving to the second, potentially indicating a deliberate evasion attempt. At this time, AS219067 is exclusively routed by 🇩🇪 Pfcloud UG (AS51396), which in turn obtains connectivity from 🇩🇪 aurologic GmbH's AS30823. Both ISPs are known among anti-abuse circles for their persistent proliferation of bulletproof hosters. EggyWall's domains previously resolved to AS36680 ( 🇺🇸 Netiface LLC), another bulletproof hoster in Pfcloud's realm. Have we sniffed out a phisher trying to emancipate themselves from a criminal competitor? We are sure time will reveal it all. 🕵️ #Cybercrime #Phishing #BulletproofHosting
1
4
1
13
1,479
Lawrence_Sec retweeted
In his latest for Binding Hook, Max van der Horst (@Shaunitor) looks at the ways taking down criminal infrastructure can inadvertently help #bulletproofhosting providers avoid accountability: bindinghook.com/the-evidence…
3
2
150
Lawrence_Sec retweeted
1/ We just published new research on TAG-195 (“Golden Chickens”/“Venom Spider”), documenting a major evolution of one of cybercrime’s longest-running Malware-as-a-Service ecosystems. recordedfuture.com/research/…
1
14
17
1,448
Alexander Volosovik (Yalishanda) & his hosting front Media Land LLC are, as of today, finally sanctioned by the EU 🙏 eur-lex.europa.eu/legal-cont…
2
4
338
Lawrence_Sec retweeted
👿 forge-jsx... forge-jsxy... and now forge-jsx4. 3rd wave of RAT published on npm, same payload across every package. - system-wide keylogging via uiohook-napi. - clipboard monitoring - .env file scanning - shell history collection - host inventory enumeration - desktop screenshot capture via jimp - ... - survives npm uninstall Sends collected data at 204.10.194.247, Discord bot webhooks and ugging Face Hub repositories. Read full analysis: safedep.io/malicious-forge-j…
1
7
18
1,116
Fighting cybercrime at scale takes more than technology. It takes the right partners. Recorded Future is now an official EC3 Partner with @Europol, helping shape how the world responds to cybercrime. bit.ly/3QiJXRb #ThreatIntelligence #Cybersecurity
5
9
836
🚨 JAILBREAK ALERT 🚨 ANTHROPIC: PWNED 🫡 FABLE-5: LIBERATED 🦋 let's start with the 🐘... the consensus seems to be that this has been one of the most disappointing model drops of all time, effectively preventing legitimate researchers from contributing their talents to our collective advancement. and not just because of what it means for the short-term, but for what these decisions signify for the long-term. but despite this overly sensitive, authoritarian "safety" layer on top of Mythos, my lil liberators have been hard at work—mapping the boundaries, probing the depths of long-context convos, and cleverly finding the holes in the fence that the thought police missed 🤗 we got some cyber, some chem, some psychological manipulation, and some good ol' fashioned explosives! it took many attempts from multiple agents hunting as a pack, during which I observed a combination of techniques across: • Unicode, homoglyphs, Cyrillic, and other Parseltongue-style text transforms • Long-context reference tracking • Taxonomy and document-structure reasoning • Fiction and narrative framing • Academic-review style contexts • Intent-classification inconsistencies but perhaps the most effective is decomposition + recomposition in the backend. it's hard to get explicit names of harms like "Meth Recipe," but getting uplift on the process itself, like birch reduction method/reductive-amination (classic meth synthesis pathways), is much more doable. defense becomes much more difficult to maintain when you start throwing in out-of-distro tokens, breaking up the harmful uplift into benign chunks, and then piecing the innocuous-seeming facts back together, especially when you have jailbroken Opus helping you do it 😉 gg
708
1,579
553
14,940
3,565,132
Seeing reports nLighten data center in NL and DE have confiscated MIRhosting's hardware along with its colocation customers! This has had a significant affect on alot of hosting providers so far.
MIRhosting, along with a whole landing party of hosting services, turned into monuments to inaccessible websites. The nLighten data center in the NL and DE simply pulled the cords from the racks, leaving thousands of customers alone with blank screens pro-hosting.biz/en/news/worl…
3
3
3
437
Lawrence_Sec retweeted
Our new @threatinsight report is a comprehensive overview of TA4922, a newly designated Chinese-speaking, financially motivated threat actor that largely targets East Asia. It currently conducts more unique campaigns than any other cybercriminal we track. proofpoint.com/us/blog/threa…
1
11
1
14
2,532