Ethical Hacker | Reverse Engineer | CEO @AdvIntel | Malware Course Author "Zero2Hero" / "Zero2Automated" | Former .gov Cybercrime | Threat Seeker Award
New York, NY
Joined August 2015
- Tweets4.7K
- Following86
- Followers43.2K
- Likes6.3K
Vitali Kremez retweeted
The Week in Ransomware - October 21st 2022 - Stop the Presses - @LawrenceAbrams
bleepingcomputer.com/news/se…
#Royal ransomware operation in action.
1/ So, site impersonating @Fortinet downloads signed MSI that uses Powershell to run #BatLoader, if the user is connected to a domain (corporate network) it deploys:
1) #Ursnif (Bot)
2) #Vidar (Stealer)
3) #Syncro RMM (C2)
4) #CobaltStrike
And possibly
5) #Ransomware 💥
Vitali Kremez retweeted
New Royal Ransomware emerges in multi-million dollar attacks - @LawrenceAbrams
bleepingcomputer.com/news/se…
Offsecurity: First time flying as a private pilot single engine land from east -> west coast of Florida.
Aircraft: Cessna 172N
IFR training and rotorcraft add-on next!
Vitali Kremez retweeted
The Week in Ransomware - September 16th 2022 - Iranian Sanctions - @LawrenceAbrams
bleepingcomputer.com/news/se…
🔥Breaking Blog: AdvIntel's State of #Emotet aka "#SpmTools" Displays Over Million 🌎Compromised Machines Through 2⃣0⃣2⃣2⃣
Insight:
*⃣Emotet infection chain is currently attributed to #Quantum & #BlackCat ransomware chains.
advintel.io/post/advintel-s-…
Vitali Kremez retweeted
The Week in Ransomware - September 9th 2022 - Schools under fire - @LawrenceAbrams
bleepingcomputer.com/news/se…
Vitali Kremez retweeted
Someone is hitting Cobalt Strike servers used by former members of the Conti ransomware gang with messages urging to stop Russia's war:
“Stop the war!”
“15000+ dead Russian soldiers!”
“Be a Russian patriot!”
"Stop Putin!"
📌We have observed the "Anti-Putin" messages from Cobalt Strike flooding activities mapped to ex-Conti cybercrime enterprise members.
Ransomware gang's Cobalt Strike servers DDoSed with anti-Russia messages - @Ionut_Ilascu
bleepingcomputer.com/news/se…
Insight:⚡️#Emotet loader-as-a-service infection metrics globally for 2022 of ~1,300,000 unique bot_ids / top targeted infected by loader (including honeypot activity). Still alive but on a general decline.
The public report is incoming.
⚡️2022 Trend: Call-back phishing campaigns aka "BazarCall" are the de-facto top method of getting a backdoor on the protected corporate networks.
1⃣Ransomware and extortionists want to talk to the corporate employees over ☎️.
2⃣Targets are just larger & phishing is more complex
Vitali Kremez retweeted
We're publishing so much great stuff in coming days.
There's another Between Two Nerds episode with @tomatospy and @thegrugq, plus @campuscodi interviews @VK_Intel about his call that Ransomware as a Service is dying.
Risky Biz News RSS risky.biz/subscribe
⚡️Timely report on the latest Cobalt Strike domain fronting technique leveraging tyk[.]io.
Many ex-Conti groups leverage this domain fronting technique for Cobalt Strike beacon resolver/traffic.
Watch out for tyk[.]io traffic.
shells.systems/oh-my-api-abu…
🤔Prediction: Expect less ransomware locker deployment but a prolong phase of corporate espionage/exfiltration by cybercrime enterprises.
The ransomware-as-a-service (RaaS) as well as targeted ransomware deployment model is almost dead for the following reasons 1/n
👇
1 - overt and shadow sanctions/ban of Russia affected cryptocurrency brokers procuring money for data recovery services
2 - evolution of backup soft/services with physical backup implemenations made the effect of ransomware less impactful than before
2 / 3
Vitali Kremez retweeted
Advanced Intel's @VK_Intel has published a BazarCall advisory. The “BazarCall” style attack, or call back phishing, is an attack vector that utilizes targeted phishing methodology and first emerged in 2020/2021 as a tool of Ryuk (later rebranded Conti). advintel.io/post/bazarcall-a…
Vitali Kremez retweeted
These three ex-Conti extortion gangs are responsible for the surge of 'BazarCall' callback phishing schemes.
bleepingcomputer.com/news/se…
