Threat Intelligence Researcher @esthreat 🚀🚀| Blue Teamer
Joined August 2014
- Tweets5.4K
- Following4K
- Followers2K
- Likes15.4K
Pinned Tweet
Today marks my first day to work as a SOC analyst. Perhaps one thing I have learned over the years is to be persistent, never stop grinding, and chasing down your dream. Here is my timeline for me to achieve my dream.
Bohan Zhang retweeted
New: The FBI believes an exec at a prestigious U.S. consulting firm (1,000+ associates) helped run Shinywire, the ShinyHunters site used to extort nearly 100 victims.
The people victims hire to negotiate with hackers may have been on the other side of the table.
- Dutch police raided ShinyHunters suspect Pepijn van der Stap with flash-bangs while he was logged into Signal
- His chats showed frequent contact with ransom negotiators in the U.S. and Canada
- Those negotiators often knew about new victims before the victims knew they'd been breached
- Per sources, Edward Dubrovsky, a Canadian negotiation exec charged earlier this month, knew ShinyHunters had the FBI's personnel files and never told the FBI
- Dubrovsky's other firm, CyberSteward, helped PowerSchool pay its ~$2.85M ransom
Meanwhile ShinyHunters was griping on Telegram that Coveware kept telling victims not to pay and it was wrecking their conversion rate.
Bohan Zhang retweeted
HUGE news about the October release of EZTools is coming soon! You wont believe your eyes! #DFIR
Bohan Zhang retweeted
‼️ Hackers were backdooring Nextcloud servers via a critical Collabora flaw by Sept 10, five weeks before it got a CVE.
They planted PHP webshells, then hunted for KeePass databases and crypto wallets.
Bohan Zhang retweeted
UPDATE: We have high-confidence the threat actor has also abused these ConnectWise Cloud Management apps:
-Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519)
-MS Teams (24205314-2b89-4e07-a2a4-579e898a5640)
-SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb)
Bohan Zhang retweeted
The current MSSP incident reported by Huntress is a good reminder why you should enable app instance property lock for your applications to prevent malicious takeover in a compromised customer tenant.
huntress.com/blog/vendor-cre…
learn.microsoft.com/en-us/en…
Bohan Zhang retweeted
Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens across customer tenants.
ConnectWise Cloud Backup is a multitenant vendor application; customers grant consent for the application to operate in their tenants. We assess that the threat actor likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All.
On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor.
Microsoft Defender detects post-exploitation activity with the following alerts:
- Any alert related to "Suspicious sign-in"
- Graph API activity from a Microsoft threat intelligence IP address
- Verified Threat Actor IP
Defenders should review service principal sign-ins from unrecognized IP addresses, app credential changes, and OAuth grant activity associated with this specific OAuth AppId. In addition, we recommend looking for Threat Intelligence alerts on matching of IP against the Graph API activity and service principal activities.
We will continue to monitor this incident and will share updates as they become available. We encourage customers to check ConnectWise advisory for more information and additional guidance: msft.it/6013aQBvV.
Indicators of compromise (IOCs):
- App name: ConnectWise Cloud Backup
- AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae
- Publisher name: SkyKick
- Source IP: 144.172.64[.]128
- User agents: Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2
Bohan Zhang retweeted
Inside the Teenage Hacker Mafia Terrorizing the Internet
Teenage hackers stole millions, disrupted Las Vegas casinos, breached major corporations, and eventually turned against each other.
A Data War documentary explores The Com, a loosely connected online community associated with groups like Scattered Spider, LAPSUS$, and ACG.
The documentary examines how activities ranging from SIM swapping and ransomware escalated into kidnappings, swatting, and extremist connections, exposing the darker side of an increasingly dangerous cybercriminal network.
Bohan Zhang retweeted
Gh0stRat variant signed "Zhengzhou Xiaoye Network Co., Ltd."
ca47e13a2980817e7849ddfef70312542ed11efaeba7b1b583161c06a440baf2
C2:
Primary: 103[.]82[.]53[.]214:7661
Backup: 103[.]82[.]53[.]214:80
rogueauthority.org/signed-se…
h/t @malwrhunterteam
Bohan Zhang retweeted
The ongoing #DarkSword iOS exploit campaign reveals a broader tooling infrastructure on Telegram. Channel "渗透漏洞安全" is distributing tooling and selling victim access, leveraging AI-assisted malware dev and a centralized C2. 🧵👇
Bohan Zhang retweeted
Analysts @HuntressLabs have been seeing an uptick of malicious MFA apps from the Microsoft Store the last few days. In some cases, they're being delivered via tech support scams through Teams, in others via malvertizing.
We've been digging into it, and hopefully we'll have more info soon.
Bohan Zhang retweeted
Fresh @Mandiant and GTIG blog detailing zero day exploitation of CVE-2026-102764 in BeyondTrust Remote Support by 🇨🇳 nexus espionage actor ARMORY CASTLE (fka UNC5221).
cloud.google.com/blog/topics…
Bohan Zhang retweeted
A former senior cybersecurity researcher with Microsoft’s Detection and Response Team received a care package of Russian trinkets on his doorstep after investigating Midnight Blizzard 😯: theregister.com/cyber-crime/…
Bohan Zhang retweeted
Check out our latest deep-dive for #AhsayCBS, an enterprise backup solution.
Reported as exploited in-the-wild by @HuntressLabs, CVE-2026-105133 and CVE-2026-105134 allow an unauthenticated attacker to execute commands as SYSTEM or root on the server.
horizon3.ai/attack-research/…
Bohan Zhang retweeted
Update: 2 weeks ago, @JSemonSecurity and @the_MarkOH detailed a campaign that abused #ChatGPT's Custom GPT feature, luring victims in via the legit ChatGPT domain and then directing them to a ClickFix attack.
Attackers are now using new malicious domains: huntress.com/blog/chatgpt-cu…
Bohan Zhang retweeted
1/8 Today, @JulianVoeg from @RecordedFuture and I are publishing “Break the Silence: Tracking Silent Lynx Through Exposed Infrastructure,” a report on cyber espionage across Central Asia and the wider CIS that we presented today at @virusbtn
blog.talosintelligence.com/b…
Bohan Zhang retweeted
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators and an illicit marketplace selling tools and infrastructure for large-scale phishing, enabling cybercriminal operations worldwide. msft.it/6014asXPO
Bohan Zhang retweeted
We are currently rapidly reacting to CVE-2026-104935, an authentication bypass vulnerability enabling unauthenticated remote command execution on Ivanti Connect Secure appliances.
Active watchTowr Platform clients have been made aware of their exposure. Reach out for support.
Bohan Zhang retweeted
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work.
At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.
We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
Bohan Zhang retweeted
.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.
Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure.
Read the full analysis, including detection guidance and IOCs, in our blog post here: volexity.com/blog/2026/10/13…
#DFIR #threatintel #memoryforensics
