Just published a deep dive into APT27 (Emissary Panda/Iron Tiger/Lucky Mouse), a Chinese state-sponsored cyber-espionage group active since 2010, known for spear-phishing, watering-hole attacks and exploitation of internet-facing applications. dexpose.io/threat-actor-prof…

Open directory spotted: 20.243.255[.]185 Hosting multiple suspicious files, including: shell_le: Metasploit ELF payload - recently submitted to VirusTotal. true.png: PNG file with embedded VBScript (1/61 on VT) - recently submitted to VirusTotal main_mips: ELF binary flagged by THOR APT Scanner related to github.com/Enelg52/KittyStag… (0/64 on VT) CVE-2021-3156. zip: weaponized Sudo exploit @500mk500 @ViriBack @JAMESWT_WT @skocherhan @1ZRR4H #opendir #CTI

#clickfix #booking #fakecaptcha bokparthub[.]click → (Under Construction) apartmenr-di16[.]click → PowerShell (files.catbox.moe/09fd7c[.]tx…) → LightYellow4.zip → LightYellow4.pfx Hex-based ZIP reconstructed → payload cleaned → executed via regsvr32.exe abuse (LOLBins)

38[.]54[.]50[.]57 --> 1/94 156[.]244[.]19[.]218 --> 1/94

95[.]196[.]78[.]150 --> 0/94 206[.]72[.]192[.]71 --> 0/94 91[.]195[.]240[.]123 --> 9/94

just hunted down fresh undetected & low detected APT43 (kimsuky) infra by pivoting using HTTP header analysis and SSL JARM fingerprinting 162[.]220[.]11[.]84 --> 0/94 194[.]63[.]129[.]86 --> 0/94 3[.]89[.]115[.]251 --> 0/94 110[.]142[.]212[.]109 --> 1/94 More IOCs in replies

FExcited to share that ANY.RUN now supports Android OS inside its interactive sandbox! You can analyze APK behavior in real time, right in the cloud. 🔥 Available for ALL plans (yes, even free!). 📷 Let’s check it out together! app.any.run/?utm_source=x_co…

#ANYRUN just released Safebrowsing — a new service that lets you quickly explore URLs in an isolated virtual browser 🔥 📷 It notifies you about threats and has a friendly interface Give it a try, it's free 📷👉 app.any.run/?utm_source=ally…

My birthday gift arrived today! Thank you so much, @binaryz0ne, for this amazing gift ❤️❤️ I absolutely love the design, @hasherezade!