https://xitter.cf/t.co/KzA263NyyE @vulonehq

building
Joined January 2024
less retweeted
VIETJACK: ActiveMQ exploitation toolkit with cross-platform Go backdoor targeting 14 architectures and a Veeam deserialization exploit. All sitting in an open directory. z3r0s6.github.io/posts/vietj…
2
1
8
200
One of the clearer examples so far of AI agents being used at scale for real intrusions, and the OPSEC was terrible
A China-linked operator used AI agents to hit Vietnam’s Ministry of Defence, Taiwan’s legislature, and Indonesia’s intelligence agency. 66 separate operations. 48 got some level of access. Then the entire campaign was left sitting open on the internet.
3
211
You can't say "clean" with quotes as if what he's being doing as of recent isn't legitimate. Let's make something truly clear; your inability to accept one's change in character shows your laggardly behaviour being unsuited for the world of threat intelligence. Try harder.
Of course Pryx is “clean”. And now attention seeking through Reuters. Let me make something clear here. This dude is a cybercriminal should be arrested as well.
1
1
1
8
987
Litellm Compromise Checker
Was your secret exposed in the TeamPCP LiteLLM attack? We built a LiteLLM Compromise Checker to help you verify whether your secrets appear in the exfiltrated data.
1
4
313
What if your hacking workstation was reproducible, hardened, themed, and left no traces on disk? Meet pwnbox: NixOS + Home Manager for hacking, reverse engineering, Active Directory, and networking. 26 tool categories. One declarative setup. Zero disk traces. Credits to @wall3ss for the whole website and hosting! pwnbox.one
4
20
102
4,270
If you already have one fact on a crew, let's say for example an email, a wallet or a handle. You start there and we give you the rest of the person. vulone.com/book-a-demo
realized we haven't really explained what we're building at vulone very well it's not just a threat intel or IOC database, even thought we do collect IOCs. we've profiled 9M+ threat actors and built an engine that connects their aliases, emails, IPs, wallets, PGP keys, accounts, infrastructure, etc to each threat actor. so you can start with basically one piece of information and trace the connections around it. we've also been collecting activity from underground communities to understand how these actors think, behave and operate, not just what indicators they leave behind. we built this on a budget of less than 5K$ other companies would spend 50k$ at least to get his up and running. because have brains and we know how to run shit, imagine what we could do with 50k, that's why we are currently seeking investment. I'm confident with enough funding, we can build something on a completely different level.
3
12
1,081
less retweeted
We started tracking a new ransomware group called 'global ransomware" this era of ransomware operators seem to be relying alot on vibecoding
2
1
11
815
Bitget: user funds are safe also Bitget: you cannot withdraw them Schrödinger’s solvency
1
7
408
We found an open directory on the internet holding about 343,000 logins. IP addresses, usernames, passwords, all in plain text. Full writeup in the comments.
2
7
565
👀
VULONE writeup attributes Doxbin co-founder / ViLE “CC-1” (KT) to an Australian in NSW. Separate from the Welsh KT later convicted over swatting. Unindicted in the 2023 US case. @vulonehq @te_mpe_st @wall3ss @Ivanklydz vulone.com/blog/the-australi…
3
573
less retweeted
We started tracking a new ransomware group called foxsec with 1 victim claimed "corover(.)ai" apparently the ransomware group let AI handle their firewall for them which explains the IP leakage.
1
4
1
7
2,005
New article @vulonehq @Ivanklydz
99 listings. 28,634 victims. 27 forums. We priced the access, mapped the sellers, and matched the sectors that were already for sale against who actually got hit. Your network wasn’t “at risk.” In a lot of cases it was already on the menu. vulone.com/blog/your-network… @vulonehq @Ivanklydz @wall3ss
4
287
Replying to @IntCyberDigest
@IntCyberDigest doxxed the wrong guy. He claimed a Spanish kid called "GnomodelincuenT" is the Cyberleek GTA 6 leaker. Which is absolutely not true. Thread 🧵
Meet the GTA 6 leaker behind one of the Cyberleek channels, whom we believe to be someone from Spain going by the moniker "GnomodelincuenT". This video of him was published in 2012. We found him through a Google Drive account linked to his online presence. A thread 🧵
Readers added context they thought people might want to know
The claim that this individual is the GTA 6 leaker is incorrect. Reports and users have pointed out that "GnomodelincuenT" is an impersonator pretending to be Cyberleek, which is an activist group brand rather than a single identified person. dexerto.com/gta/who-is-cyb…
1
2
1,663
Full breakdown with all evidence is live on VULONE @vul1n. We rate the Spanish attribution as LOW confidence. Link in replies.
1
80