JBR retweeted
I am excited to introduce a new comprehensive CTI training repository - find it here:
blog.bushidotoken.net/2024/0…
#CTI #threatintel #training
JBR retweeted
Check out this awesome report by Sophos on Chinese APT threat actors. There is much to learn from this technical breakdown; it's not your ordinary threat actor.
Reading this report, you will notice that they used tools like impacket for lateral movement, which provides an opportunity for detection.
➡️Interesting use of Living-Off-the-Land binaries that I personally haven't seen before - instsrv.exe and srvany.exe.
➡️Multiple defense evasion methods to hide their tracks and evade detection, including a clever way to read DNS traffic and block AV/EDR-related domains. (but still uses impacket 🤷♂️🤦♂️)
➡️Interesting choice of data being staged for exfiltration.
Overall, this prolonged intrusion had everything, and the authors did an incredible job of laying out all the details for the rest of the community. 🙏👏
Check it out here 🔗: news.sophos.com/en-us/2024/0…
JBR retweeted
Cado Security is honored to be named in the Gartner® Emerging Tech: Emergence Cycle for Cloud Security as a Sample Vendor for Cloud Forensics
Download a free copy of the report here: hubs.li/Q02yBRv50
JBR retweeted
Replying to @eric_capuano
@eric_capuano made a great beginner lab to learn Prefetch Analysis for #DFIR work.
I made a simple walkthrough video showing you how to setup the lab and get started, so no need to feel overwhelmed.
Get in there and start learning!
youtu.be/xvUbJk4wNo8?si=vkPD…
ATTN NERDS 🤓
this week we released our new @limacharlieio plaso extension! 🔥
it will take a forensic artifact from an endpoint, or a zip of artifacts (like a KAPE triage from the @velocidex extension) and make a timeline of the data that can be imported into @TimesketchProj
JBR retweeted
In 2014, @JohnHultquist named a Russian hacking group "Sandworm".
Today, Mandiant graduates it to APT44 & reveals the online persona they created, CyberArmyofRussia, disrupted U.S. and Polish water utilities, as well as a dam in France.
Full report: services.google.com/fh/files…
JBR retweeted
Since the first of the Ten Thousand were created, there have always been female Custodians.
JBR retweeted
🎁 Today I'm giving away 3 of our DFIR Labs! 🎁
To enter:
✅Follow me
✅RT & Like this post
✅Reply with which case you'd like to take
The winners will be selected in 24 hours. #Giveaway
JBR retweeted
We would like to welcome our new team member: Jia Tan!
Jia will work on a set of challenges for our "Supply Chain" badge!!
JBR retweeted
Very interesting thread by @thegrugq
JBR retweeted
It's here! Fully automated🔒Elastic Security server and agents for your Ludus labs. @__ar0d__ and I have made this one as easy as adding the roles to your config.
Comes with:
-ELK+Fleet+Detection engine
-Auto agent install+registration
-Detection rules
docs.ludus.cloud/docs/Enviro…
JBR retweeted
🔎 https://159.203.35.135/ #opendir
Con más de 420 sitios y dominios de casinos fraudulentos... y algo más 😏
1bet-ar[.]top
1bet-argentina[.]top
1bet-ca[.]top
1bet-canada[.]top
1bet-cl[.]top
1bet-co[.]top
1bet-es[.]top
1betcl[.]top
1x-ar[.]top
1x-argentina[.]top
1x-br[.]top
1x-brasil[.]click
1x-brasil[.]top
1x-canada[.]top
1x-chile[.]top
1x-colombia[.]top
1x-france[.]top
1x-germany[.]top
1x-spain[.]top
1xargentina[.]top
1xb-chile[.]top
1xbchile[.]top
1xbet-al[.]click
1xbet-al[.]top
1xbet-albania[.]top
1xbet-am[.]click
1xbet-am[.]top
1xbet-ao-vivo[.]top
1xbet-aplicacao[.]top
1xbet-app-portugal[.]top
1xbet-ar[.]click
1xbet-ar[.]online
1xbet-argentina[.]click
1xbet-argentina[.]top
1xbet-armenia[.]top
1xbet-at[.]top
1xbet-az[.]click
1xbet-az[.]online
1xbet-az[.]top
1xbet-azerbaijan[.]click
1xbet-azerbaijan[.]top
1xbet-ba[.]click
1xbet-ba[.]online
1xbet-ba[.]top
1xbet-be[.]click
1xbet-be[.]top
1xbet-belarus[.]space
1xbet-belarus[.]top
1xbet-belgium[.]top
1xbet-bg[.]click
1xbet-bg[.]top
1xbet-bo[.]click
1xbet-bolivia[.]top
1xbet-br[.]click
1xbet-br[.]online
1xbet-br[.]space
1xbet-br[.]world
1xbet-brasil[.]click
1xbet-brasil[.]online
1xbet-brasil[.]world
1xbet-brazil[.]top
1xbet-brazil[.]world
1xbet-bulgaria[.]top
1xbet-by[.]click
1xbet-ca[.]top
1xbet-canada[.]top
1xbet-cashout[.]top
1xbet-ch[.]click
1xbet-chile[.]click
1xbet-chile[.]top
1xbet-cl[.]click
1xbet-cl[.]top
1xbet-co[.]click
1xbet-colombia[.]click
1xbet-colombia[.]top
1xbet-cr[.]click
1xbet-cr[.]top
1xbet-cy[.]click
1xbet-cy[.]top
1xbet-cyprus[.]top
1xbet-cz[.]click
1xbet-cz[.]top
1xbet-czechia[.]top
1xbet-de[.]click
1xbet-de[.]online
1xbet-descargar[.]top
1xbet-deutschland[.]top
1xbet-dk[.]top
1xbet-do[.]click
1xbet-do[.]top
1xbet-downloadpc[.]top
1xbet-e-legal[.]top
1xbet-ec[.]click
1xbet-ec[.]top
1xbet-ecuador[.]click
1xbet-ecuador[.]top
1xbet-ee[.]click
1xbet-en-espanol[.]top
1xbet-es[.]click
1xbet-es[.]online
1xbet-es[.]top
1xbet-espana[.]click
1xbet-espana[.]online
1xbet-espana[.]top
1xbet-fi[.]click
1xbet-fi[.]top
1xbet-fr[.]click
1xbet-france[.]click
1xbet-france[.]online
1xbet-france[.]top
1xbet-gb[.]click
1xbet-gb[.]space
1xbet-gb[.]top
1xbet-germany[.]top
1xbet-girisi[.]click
1xbet-girisi[.]top
1xbet-jogosaovivo[.]top
1xbet-legal[.]top
1xbet-mainsite[.]top
1xbet-ng[.]top
1xbet-paypal[.]click
1xbet-portugues[.]top
1xbet-spain[.]top
1xbet-turkiye-de[.]top
1xbet-verjogos[.]top
1xbetandroid[.]click
1xbetandroid[.]top
1xbetandroidapk-br[.]top
1xbetandroidapk[.]top
1xbetaovivo[.]top
1xbetapk-ar[.]top
1xbetapk-az[.]top
1xbetapk-br[.]top
1xbetapk-cl[.]top
1xbetapk-co[.]top
1xbetapk-de[.]click
1xbetapk-de[.]top
1xbetapk-ec[.]top
1xbetapk-es[.]top
1xbetapk-fr[.]click
1xbetapk-fr[.]top
1xbetapk-france[.]top
1xbetapk-germany[.]top
1xbetapkbr[.]top
1xbetapkco[.]top
1xbetapkdownload[.]top
1xbetaplicacao[.]top
1xbetapostas-br[.]top
1xbetapostasbr[.]top
1xbetapp-ar[.]top
1xbetapp-az[.]top
1xbetapp-ca[.]top
1xbetapp-cl[.]top
1xbetapp-co[.]top
1xbetapp-colombia[.]top
1xbetapp-de[.]click
1xbetapp-de[.]top
1xbetapp-ec[.]top
1xbetapp-es[.]top
1xbetapp-fr[.]click
1xbetapp-fr[.]top
1xbetapp-germany[.]top
1xbetapp-pc[.]click
1xbetapp-pc[.]top
1xbetapp-portugal[.]top
1xbetappandroid[.]top
1xbetappar[.]top
1xbetappbr[.]click
1xbetappbr[.]top
1xbetappbrasil[.]top
1xbetappcl[.]top
1xbetappdownloadbr[.]top
1xbetappec[.]top
1xbetapps-es[.]top
1xbetar[.]click
1xbetargentina[.]click
1xbetargentina[.]online
1xbetargentina[.]top
1xbetarmenia[.]top
1xbetaviator[.]click
1xbetaviator[.]top
1xbetbk-brasil[.]top
1xbetblackfriday[.]top
1xbetbo[.]top
1xbetbolivia[.]click
1xbetbolivia[.]top
1xbetbonus-brasil[.]top
1xbetbonus-de[.]top
1xbetbonusbr[.]top
1xbetbonusbrasil[.]top
1xbetbr[.]online
1xbetbr[.]world
1xbetbrasil[.]online
1xbetbrasil[.]space
1xbetbrasil[.]world
1xbetbrazil[.]top
1xbetby[.]top
1xbetca[.]top
1xbetcanada[.]click
1xbetcanada[.]top
1xbetcashout-br[.]top
1xbetcashout[.]top
1xbetcasino-ar[.]top
1xbetcasino-az[.]top
1xbetcasino-de[.]top
1xbetcasino-es[.]online
1xbetcasinobr[.]top
1xbetcasinobrasil[.]top
1xbetcasinochile[.]top
1xbetcasinocl[.]top
1xbetcassino-br[.]top
1xbetchile[.]click
1xbetchile[.]online
1xbetchile[.]top
1xbetcl[.]click
1xbetcl[.]top
1xbetco[.]click
1xbetco[.]top
1xbetcolombia[.]click
1xbetcolombia[.]online
1xbetcolombia[.]top
1xbetcom-login[.]click
1xbetcomlogin-br[.]click
1xbetcomlogin[.]top
1xbetcomloginbr[.]top
1xbetcr[.]top
1xbetde[.]top
1xbetdescargar-co[.]top
1xbetdescargar[.]top
1xbetdesktop[.]click
1xbetdesktop[.]top
1xbetdo[.]top
1xbetdownload-az[.]click
1xbetdownload-az[.]top
1xbetdownload-br[.]top
1xbetdownload-cl[.]top
1xbetdownload-co[.]top
1xbetdownload-de[.]click
1xbetdownload-de[.]top
1xbetdownload-fr[.]top
1xbetdownload-pc[.]click
1xbetdownload-pc[.]top
1xbetdownloadapk[.]top
1xbetdownloadapp[.]top
1xbetdownloadbr[.]top
1xbetdownloadpc[.]top
1xbetec[.]top
1xbeteconfiavel-br[.]top
1xbeteconfiavelbr[.]top
1xbetecuador[.]click
1xbetecuador[.]top
1xbetelegal[.]top
1xbetemportugal[.]top
1xbetenespanol[.]top
1xbetentrar[.]top
1xbetesar[.]top
1xbetgiris-az[.]click
1xbetgiris-az[.]top
1xbetgiris-de[.]click
1xbetgiris-de[.]top
1xbetindir-az[.]click
1xbetindir-az[.]top
1xbetjogosaovivo[.]top
1xbetlegal[.]top
1xbetlevantamentos[.]top
1xbetlive-br[.]top
1xbetlive-de[.]top
1xbetlivefootball[.]top
1xbetlivemobile[.]top
1xbetlogin-brasil[.]cl
1xbetlogin-de[.]click
1xbetlogin-fr[.]click
1xbetloginbr[.]top
1xbetloginbrasil[.]top
1xbetmobi-az[.]click
1xbetmobi-az[.]top
1xbetmobi-brasil[.]top
1xbetmobi-de[.]top
1xbetmobibrasil[.]top
1xbetmobil-az[.]click
1xbetmobil-az[.]online
1xbetmobil-az[.]top
1xbetmobile-az[.]click
1xbetmobile-az[.]top
1xbetmobile-br[.]top
1xbetmobile-de[.]top
1xbetmobile-fr[.]top
1xbetmobilebr[.]top
1xbetmobilyukle[.]click
1xbetmobilyukle[.]top
1xbetng-az[.]top
1xbetonline-br[.]top
1xbetonlinebr[.]top
1xbetotzyvy[.]click
1xbetotzyvy[.]top
1xbetpaypal[.]click
1xbetpix[.]top
1xbetportugues[.]top
1xbetpromocode-br[.]top
1xbetpromocode-ca[.]top
1xbetpromocodebr[.]top
1xbetpromokod-de[.]top
1xbetpt[.]click
1xbetpt[.]online
1xbetqeydiyyat[.]top
1xbetregisto[.]top
1xbetreview-br[.]top
1xbetreview[.]top
1xbetsayt-de[.]top
1xbetsite-br[.]top
1xbetskachat-az[.]top
1xbetskachat-by[.]click
1xbetskachat-by[.]top
1xbetskachat-de[.]top
1xbetskachat-fr[.]top
1xbetskachaty[.]top
1xbetslotoyunu[.]click
1xbetslotoyunu[.]top
1xbetslotsiteleri[.]top
1xbetspain[.]top
1xbett-az[.]top
1xbett[.]click
1xbetunitedkingdom[.]top
1xbetverjogos[.]top
1xbetvhod-az[.]top
1xbetvhod-de[.]top
1xbetyukle[.]click
1xbetyukle[.]top
1xbey-br[.]top
1xbrasil[.]top
1xbt-br[.]top
1xcanada[.]top
1xwin-br[.]top
1xwin-brasil[.]top
1xwinbr[.]top
apostaganha1xbet[.]top
app1xbet-br[.]top
app1xbetbr[.]top
bahis-sitesi1xbet[.]top
baixar1xbet[.]top
bet2xbet[.]top
bonus1xbet-br[.]top
bonus1xbetbr[.]top
br1xbet[.]top
canlibahis1xbet[.]click
canlibahis1xbet[.]top
cashout-1xbet[.]top
cashout1xbet-br[.]top
cashout1xbet[.]top
cashout1xbetbr[.]top
codigo1xbet[.]top
contabonus1xbet[.]top
descargar1xbet[.]click
descargar1xbet[.]top
download1xbet-br[.]top
download1xbet-de[.]click
download1xbet-de[.]top
embaixadora1xbet[.]top
embaixadorado1xbet[.]top
futebolaovivo1xbet[.]top
handicap1xbet[.]top
ixbet-br[.]top
ixbet-brasil[.]top
ixbetbr[.]top
juegodelarana1xbet[.]top
levantamento1xbet[.]top
mobile1xbet-de[.]top
neteller1xbet[.]top
oneforbet[.]top
onexbet-ar[.]top
onexbet-argentina[.]top
onexbet-br[.]top
onexbet-cl[.]top
onexbetar[.]top
onexbetcl[.]top
promokod-dlya1xbet[.]top
promokod1xbet-de[.]top
promokodna1xbet-de[.]top
promokody1xbet[.]click
promokody1xbet[.]online
promokodyna1xbet[.]click
promokodyna1xbet[.]top
sepa1xbet[.]top
skachat1xbet-by[.]top
skachat1xbet-de[.]top
skachat1xbetnapk[.]top
skachaty1xbet[.]top
x1bet-ar[.]top
x1bet-argentina[.]top
x1bet-br[.]top
x1bet-brasil[.]top
x1bet-cl[.]top
x1bet-co[.]top
x1betar[.]top
x1betbr[.]top
x1betcl[.]top
xbet-ar[.]top
xbet-at[.]top
xbet-az[.]click
xbet-az[.]top
xbet-azerbaijan[.]top
xbet-br[.]top
xbet-brasil[.]top
xbet-ca[.]top
xbet-chile[.]top
xbet-cl[.]top
xbet-co[.]top
xbet-ec[.]top
xbet-es[.]top
xbet-fr[.]click
xbet-fr[.]top
xbetapostas-br[.]top
xbetar[.]top
xbetargentina[.]top
xbetbr[.]top
xbetbrasil[.]click
xbetbrasil[.]top
xbetca[.]top
xbetchile[.]click
xbetchile[.]top
xbetcl[.]top
xbetco[.]top
xbetec[.]top
JBR retweeted
#Horabot dirigido a empresas de México 🇲🇽
.ZIP > .HTML > .RAR > .CMD > .PS1
Los correos phishing son enviados desde dominios temporary[.]link y traen adjunto un archivo .HTML (comprimido en un .ZIP) que inicia la descarga maliciosa.
Los archivos .HTML incluyen el nombre de la empresa objetivo (víctima potencial) 👀
Siguientes etapas desde:
1.- https://facturasmex[.]cloud/b08/
2.- http://ca1[.]sytes[.]net/22/22
3.- https://www.dropbox[.]com/scl/fi/k6hxua7lwt1qcgmqou6q3/m[.]zip (URLs van rotando)
Otros dominios utilizados ↓
1ra etapa:
- facturasm[.]cloud
- adbd[.]tech
- satventasfac[.]tech
- facturasmex[.]cloud
- facturasm[.]cloud
- archivosdwn[.]cloud
- facturas[.]co[.]in
2da etapa:
ca1.sytes[.]net
ad2.gotdns[.]ch
adbd[.]tech
tths.ddns[.]net
JBR retweeted
Please wishlist my new game KingMakers on Steam. We've been working really hard on this for 5 years, and can finally unveil it to the public today. Hope you guys like it 🤞



































