@andsyn1

Expert dishwasher loader

 Straat van het reisdoel
Joined December 2019
  • Tweets2.2K
  • Following451
  • Followers454
389Media
Current #ViperSoftX C2: newoldpa[.]com (from bideo-cdn[.]xyz TXT records)
1
220
andsyn1 retweeted
Gizmo@TeamDreier29 Jan 2024
#APT #SilentLibrarian Silent Librarian domains /www.ez.liblogin.com /ezproxy.ug.edu.gh.liblogin.com /neptune.ndu.edu.lb.liblogin.com /ezproxy.hkr.se.liblogin.com /ezproxy3.hkr.se.liblogin.com /proxy.mau.se.liblogin.com /proxy2.mau.se.liblogin.com Detected with SIE Europe
2
1
3
376
Something I have spent a lot time on this and last week. What's interesting about this chain is the unique combination of different LOLBAS in every single VHD, creating a unique execution flow for every VHD that the actor is using. Read more in the thread 👇
Threat Insight@threatinsight22 Jan 2024
We recently identified a campaign with emails from various senders that included subjects such as “RFQ”. They contained a OneDrive URL that triggered the download of a VHD when clicked. The campaign began on 1/17 and continued through 1/18 to include over 1,300 messages.
1
3
1
19
9,288
Current #ViperSoftX C2: 5yh8[.]eu (from bideo-cdn[.]xyz TXT records)
1
2
272
🎯#Qakbot Botnet Takedown in Operation Duck Hunt! 💻 700,000 Victim Computers 💰 $8.6m in cryptocurrency seized by DOJ 💰 Qakbot has earned $58m in ransoms 🔒 Qakbot used by Conti, ProLock, Egregor, REvil, MegaCortex, and Black Basta ransomware groups justice.gov/usao-cdca/pr/qak…

Qakbot Malware Disrupted in International Cyber Takedown

The Justice Department today announced a multinational operation involving actions in the United States, France, Germany, the Netherlands, the United Kingdom, Romania, and Latvia to disrupt the...

justice.gov
3
106
6
230
39,199
#phishing dropsite at Universidad Católica Nordestana @ucneenlinea /ucne.edu/image/email.php @HGSupport please act, thank you cc @CNCSRD @malwrhunterteam @JAMESWT_MHT @JCyberSec_ @dubstard @YourAnonRiots @andsyn1 @UK_Daniel_Card @BeeHiveCyberSec @SwiftOnSecurity
3
7
1,166
Replying to @arkham
@ArkhamIntel #phishing /platform-arkham-intelligence.com Registrar: @Google @malwrhunterteam @JAMESWT_MHT @JCyberSec_ @dubstard @YourAnonRiots @andsyn1 @UK_Daniel_Card @BeeHiveCyberSec @SwiftOnSecurity @sniko_ @JRossNicoll
4
8
1,449
Stop using your work computer for personal use.
68
105
43
758
140,727
Don Lawrence
A massive double-decker train in rails is moving through a futuristic city. The train is yellow and the rest of the city is blue.

ALT A massive double-decker train in rails is moving through a futuristic city. The train is yellow and the rest of the city is blue.

42
905
99
8,008
593,907
👀👀
Daniel Naim@naimious22 Jun 2023
I hope they won't get heartbroken when we unify MDE and MDI together and installer won't be needed anymore :(
1
121
#OnThisDay 1997: The world was first introduced to Maureen, trying to pass her driving test with the help of dutiful husband Dave, in Driving School - a fly-on-the-windscreen documentary about learner drivers. Watch the whole series on @BBCiPlayer. bbc.co.uk/iplayer/episodes/p…

BBC Driving School, 1997

Learner driver Maureen, takes the car onto a dual carriageway - a truly terrifying ordeal for her husband Dave.

35
100
55
701
189,237
New #ViperSoftX C2: apibilng[.]com (from bideo-cdn[.]xyz TXT records)
4
233
28
110
14
1,216
91,396
andsyn1 retweeted
Secu@secu_x119 May 2023
I just used PingCastle in a pentest and, reading the report generated, I find the work done by @mysmartlogon spectacular. The quality of the explanation of the vulnerabilities, the recommendations, the references... is great! 🫶🏻
3
20
1,781
Trend Micro's Don Ovid Ladores analyses recent updates to information stealer ViperSoftX. The new campaign uses DLL sideloading for its arrival & execution technique, a more sophisticated encryption method of byte remapping, & a monthly change in C2 server trendmicro.com/en_us/researc…
1
16
1
23
5,456
When you're wrapping meat in tinfoil, should it be shiny side up or dull side up? 🤔🍗
27
74
22
617
289,173
Must be that time again, again.
5
17
6
97
15,310
Current #ViperSoftX C2: static-cdn-349[.]net
Goldwave@OGoldwave13 Mar 2023
#ViperSoftX is back, doesn't look like much has changed. c2 arrowlchat[.]com Still fetching powershell txt records from privatproxy-schnellvpn[.]xyz
1
110
URLhaus is operational for over 5 years, notifying hosting providers + network operators about malware hosted in their network 🪲 It's a shame that some hosting providers ignore abuse reports, spreading malware for over four years 🤯 Here's our current 💩-list 👇 AS38841 kbro 🇹🇼, spreading #hajime: 🌐 urlhaus.abuse.ch/url/86646/ AS23520 Columbus Networks 🇧🇸, spreading #hajime: 🌐 urlhaus.abuse.ch/url/91891/ AS29873 Newfold Digital 🇺🇸, spreading #FormBook: 🌐 urlhaus.abuse.ch/url/117832/ AS58955 Bangmod 🇹🇭, spreading #Emotet: 🌐 urlhaus.abuse.ch/url/200073/
Oldest, active malware distribution site tracked by URLhaus

ALT Oldest, active malware distribution site tracked by URLhaus

3
18
1
59
11,141
Load more