TheEmperors retweeted
The identity of the Lockbit leader has been revealed. It's #OSINT time!
THREAD 1/n
A leader of what was once the world’s most harmful cyber crime group has been unmasked and sanctioned by the UK, US and Australia, following an NCA-led international disruption campaign.
#Cronos @FBI @Europol
Full story ➡️ nationalcrimeagency.gov.uk/n…
I'm happy to announce the release of 2 useful tools:
1/github.com/mohamedaymenkarmo… it process the raw Falcon Crowdstrike logs in a human readable format (authentication and process tree)
2/github.com/mohamedaymenkarmo… it shows a graphical searchable process tree
#edr #CyberSecurity #tool
TheEmperors retweeted
I'm thrilled to share my entire research parts on one of the most notorious banking Trojans out there - Qakbot, titled "The Heist: Unmasking the Qakbot Banking Trojan" I've delved deep into the complexities of this malware's operations.
lnkd.in/eaem2DbG
Thread [1/3]
TheEmperors retweeted
Creatde a "cheat sheet" of sorts for Windows log sources and some of the event IDs. Credit to @SecurityYamato and @keydet89 for their awesome work in this space and their tools.
Hope this helps someone. github.com/herbiezimmerman/W…
TheEmperors retweeted
How the FBI nuked Qakbot malware from infected Windows PCs - @LawrenceAbrams
bleepingcomputer.com/news/se…
TheEmperors retweeted
CISA: LockBit ransomware extorted $91 million in 1,700 U.S. attacks - @serghei
bleepingcomputer.com/news/se…
TheEmperors retweeted
I’m excited to kick the morning off by announcing the release of 🍎 Living Off the Orchard: macOS Binaries (LOOBins)!
loobins.io
You can find more details about the LOOBins project in my “Introducing LOOBins” Medium post here:
infosecb.medium.com/introduc…
TheEmperors retweeted
This a reminder that @nas_bench put together an excellent list of Sigma resources.
github.com/nasbench/SIGMA-Re…
TheEmperors retweeted
👇🧵Here are 10 reliable tools we use for research and discovery in the darkweb. A thread >> 🧵 1/12
TheEmperors retweeted
👉New Blog: I have attempted to track what happened to Conti this year after the leaks and collapse of the group. Here are my findings, largely based on #OSINT. Enjoy!
blog.bushidotoken.net/2022/1… #Conti #Quantum #BlackBasta #Royal #WizardSpider #CTI
TheEmperors retweeted
@NOP_0x90v1 showed me a fantastic way to audit breached passwords in a Compromise Assessment using the HIBP passwords (hashes). [1]
The result of the audit is a CSV file with users in the AD using a password from the HIBP DB (sorted by pwdLastSet).
[1] alitajran.com/secure-active-…
TheEmperors retweeted
Emotet asks targets to copy the spreadsheet to these folders as they are 'trusted' by Microsoft Office.
When a file is launched from these folders it bypasses the Microsoft Office Protected View security feature, allowing macros to automatically execute without warning.
TheEmperors retweeted
Microsoft data breach exposes customers’ contact info and emails - @serghei
bleepingcomputer.com/news/se…