@MsmCode

Malware analyst. Cofounder of @p4_team. No independent thought: ALL opinions belong to my employers, cats. and friends. [email protected] https://xitter.cf/t.co/AeZd6IJwQe

 https://msm.lt
tailcall.net
Joined February 2016
  • Tweets139
  • Following67
  • Followers1.7K
18Media
We have just published a new blog article on the topic of ClickFix/fake CAPTCHA campaigns. Step-by-step overview of the infection, malware analysis, IoCs and YARA rules to help secure your own infrastructure. 🔗 cert.pl/en/posts/2026/02/fak…

ClickFix in action: how fake captcha can lead to a company-wide infection

We assisted a large organisation in the investigation and remediation of a live malware infection caused by a successful Fake Captcha attack. In this report, we summarize our observations and publish...

cert.pl
12
41
4,293
msm retweeted
Michał Leszczyński@icedevmlFeb 9
Logowanie do #KSeF z poziomu Pythona przez klucz zgodny z PKCS#11, np. podpis/pieczęć kwalifikowaną w formie karty, tokena USB albo HSMa. Umożliwia też hostowanie kluczy od certyfikatów wydanych przez KSeF w HSMie, albo kluczem na dysku w formacie PEM. github.com/icedevml/pyksef

GitHub - icedevml/pyksef: KSeF XAdES Authentication with PKCS#11 compatible private keys - Python...

KSeF XAdES Authentication with PKCS#11 compatible private keys - Python library - icedevml/pyksef

github.com
1
5
536
🔍 Have you tried monitoring certificate transparency logs lately and found existing tools or libraries disappointing? ✅ Fear not! We're releasing a better one, with tiled format support, async operations, state persistence and an easy-to-use API. 🔗 github.com/CERT-Polska/ct-mo…

GitHub - CERT-Polska/ct-moniteur: A Python library for monitoring Certificate Transparency (CT)...

A Python library for monitoring Certificate Transparency (CT) logs with support for both classic and modern tiled CT logs. Monitor all public CT logs with async operations, state persistence, and e...

github.com
10
2
40
5,000
I analyzed thousands of messages from 35+ suspected state-sponsored hacktivist groups using machine learning—uncovering hidden connections through writing styles, language and topics. After a year of research, here’s what we found and how we did it. 👇 research.checkpoint.com/2025… 1/
6
82
4
218
28,950
🚨 Uwaga na fałszywe reklamy na dużych platformach internetowych! Oszuści nadal skutecznie omijają mechanizmy weryfikacji, a platformy mają problem z ich powstrzymaniem. Jakie są rodzaje oszustw i dlaczego te mechanizmy zawodzą? 🤔 🔍➡️ cert.pl/posts/2024/11/Oszust…

Oszustwa reklamowe na dużych platformach internetowych

Sekretny sposób na zarabianie pieniędzy wyjawiony przez celebrytę, czy możliwość wzbogacenia się na rządowym programie inwestowania w spółki państwowe - takie informacje umieszczane przez oszustów w...

cert.pl
6
25
5
86
25,738
[PL] Oprócz Paged Out!, wypuściliśmy dzisiaj też wywiad z 𝗣𝗼𝗹𝗮𝗻𝗱 𝗖𝗮𝗻 𝗜𝗻𝘁𝗼 𝗦𝗽𝗮𝗰𝗲, tj. (@p4_team + @DragonSectorCTF + przyjaciele) o HACK-A-SAT 4: ↓↓↓ youtube.com/watch?v=9Gl8ZZDb… ↑↑↑
3
16
61
15,829
CERT Poland's Jarosław Jedynak has posted a detailed and technical description of the XWorm analysis process, including the unpacking. XWorm is a multi-purpose malware family, commonly used as a RAT. cert.pl/en/posts/2023/10/dew…
29
1
62
7,496
Better documentation, YARA scanning limitation, easier scaling, better user roles. Those are only some of the changes introduced in mquery 1.4! Full list of changes is available on ⬇️ github.com/CERT-Polska/mquer…

Release Version 1.4 · CERT-Polska/mquery

Version 1.4 Breaking changes [Breaking change] mquery now users typedconfig library instead of the previous config.py file. if you deployed mquery using docker (configurable by environment variabl...

github.com
1
5
1
21
3,892
msm retweeted
p4@p4_team2 Apr 2023
Today Poland Can Into Space placed fourth on @hack_a_sat qualifier and we're going to Vegas! This year's finals will include hacking the Moonlighter platform on orbit! Can 🇵🇱🥫🚀 conquer real 🛰️? We'll find out during DEFCON 31.
4
20
2
119
22,233
Some of @MsmCode and my research on the #phobos ransomware family. Using CUDA to crack stuff was a lot more interesting than expected!
CERT Polska
@CERT_Polska_en23 Feb 2023
We are proud to publish our latest research: A tale of Phobos – how we almost cracked a ransomware using CUDA. In it, we go on a journey of creating a decryptor for the #phobos ransomware and ending up with an almost working CUDA proof of concept. cert.pl/en/posts/2023/02/bre…

A tale of Phobos - how we almost cracked a ransomware using CUDA

For the past two years we've been tinkering with a proof-of-concept decryptor for the Phobos family ransomware. It works, but is impractical to use for reasons we'll explain here. Consequently, we've...

cert.pl
3
11
1,842
msm retweeted
p4@p4_team1 Mar 2022
Together with @DragonSectorCTF we've donated our winnings from Russian CTFs to humanitarian aid towards 🇺🇦#Ukraine! $3,000 from each team which we'll match from our #PolandCanIntoSpace winnings. $12,000 in total for @PAH_org. #NoToWar 🇺🇦🇵🇱 #CTFforUA siepomaga.pl/ctfforua

#CTFforUA

#CTFforUA

siepomaga.pl
2
36
1
135
Pracownicy CERT Polska wystosowali list otwarty w sprawie ostatnich doniesień medialnych dotyczących kierownika zespołu CERT Polska, Przemysława Jaroszewskiego. Treść listu znajduje się pod poniższym adresem: cert.pl/posts/2021/11/list-o…

List otwarty pracowników CERT Polska w sprawie Przemysława Jaroszewskiego

Pracownicy CERT Polska wystosowali list otwarty w sprawie ostatnich doniesień medialnych dotyczących kierownika zespołu CERT Polska, Przemysława Jaroszewskiego. Zapraszamy do zapoznania się z jego...

cert.pl
11
154
29
301
msm retweeted
p4@p4_team6 Nov 2021
Winner winner, chicken dinner! We've won our first #hackceler8 match, a game hacking CTF by Google, and qualified to the final round. Thanks to @FlatNetworkOrg for sharing the tooling ❤
8
39
"Linux kernel BPF protection against Speculative Store Bypass can be bypassed (...)" - Amazing research by Piotr from @p4_team Btw. This is 6th CVEs form Piotr in BPF regarding Spectre. openwall.com/lists/oss-secur…
19
2
54
msm retweeted
p4@p4_team17 May 2021
A short behind-the-scenes presentation about @OMHconf CTF. Learn from our mistakes and players' feedback. Multiple bad memes included. docs.google.com/presentation…

OMH2021 CTF

CTF Behind the scenes and random notes Beware: this is a low-effort and informal presentation

docs.google.com
4
26
Extract #malware configs with mwcfg.info! 🥳🎉 Use the web interface or API! Registration not required, and it's FREE! curl -X POST --upload-file dump.bin mwcfg.info
10
128
3
283
Introducing #mwcfg, a feature full #MalDuck #malware configuration extractor CLI utility. Feel free to contribute your own modules/extractors. Works with #mwdb #karton #framework. Special thanks to @CERT_Polska! github.com/c3rb3ru5d3d53c/mw… github.com/c3rb3ru5d3d53c/mw…
2
36
1
107
Always wanted to learn more about our Karton framework but you were too afraid to ask? We're starting a complete step-by-step tutorial on building your own malware pipelines. We've just released the first part, read it here ⬇️ cert.pl/en/posts/2021/04/kar…

Karton Gems 1: Getting Started

Table of contents Getting Started Your first karton Malware extraction with malduck What is Karton? Karton is a framework for microservice orchestration, designed by security researchers for security...

cert.pl
9
1
27
We are excited to announce Rizin — a free and open-source Reverse Engineering framework 🎉 Rizin is a fork of radare2 focusing on usability and stability and strives to provide a welcoming environment for developers and users. Our official announcement >> rizin.re

Rizin

Rizin is a free and Open Source Reverse Engineering Framework

rizin.re
7
109
25
299
Czym mogłem sterować przez Internet w Polsce? Zajawka z roku trwania akcji @CERT_Polska #BezpiecznyPrzemysł na screenach, a więcej szczegółów podczas mojej prezentacji na @OMHconf 🏭👨‍🏭
Oh My Hack@OMHconf19 Nov 2020
👋 Marcin Dudek Ekspert ds. bezpieczeństwa teleinformatycznego, członek zespołu CERT Polska. 🤖 Na #OMH2020 dowiecie się: 🟪 Jak mogłem sterować polskim przemysłem, czyli czego nie wystawiać do sieci 🟪 ▶️omhconf.pl/lecture#id=63662
2
8
3
30
Load more