@kafeine

Sleep is a symptom of caffeine deprivation.

malware.dontneedcoffee.com
Joined August 2008
  • Tweets1.3K
  • Following618
  • Followers15.1K
543Media
Kafeine's last tweet&post. Choose Again. malware.dontneedcoffee.com/2… Over and out.
88
65
20
279
TFW your favorite actor, Sagrid (TA543), does not come back from vacation
4
12
1
64
Is Gootkit gone?
1
2
8
Archeology: Necurs (crap2p) and its distribution. If you are interested in what they were doing in 2011,you might want to look at this FakeRean: 7d5ea317f2d1248386b904301bb19bbde44df3e1c3d8d08cd0644fed24362e2a cc/thx @maciekkotowicz @Antelox
15
49
I wrote something, it is also first public mention that i have a company and im free to hire ;]
MalwareLab.pl@malwarelabpl26 Feb 2020
Our first public analysis, new campaing from #Aggah analyzed with a lot of #bashfu blog.malwarelab.pl/posts/bas…

(Ab)using bash-fu to analyze recent Aggah sample

Intro Recently one of my generic signatures for malformed documents was hit, this type of malformation was used mostly by Zebrocy so i was curious whats cooking. After some analysis it turns out that...

blog.malwarelab.pl
1
18
53
Posting malware wireshark screencaps is pretty cool, but sharing #pcap with @ET_Labs to help protect the community is even cooler.
1
15
1
34
Replying to @grsecurity @argvee @halvarflake @imaguid @dinodaizovi
the future of users not having control of their own systems is a cure worse than the disease
1
19
1
37
Today @TrendMicroRSRCH published research that me and my colleges have been hard at work on. For 6 months we ran a factory. trendmicro.com/vinfo/us/secu…

Fake Company, Real Threats: Logs From a Smart Factory Honeypot | TrendAI (US)

To determine threat actors' degree of knowledge in compromising a smart factory, we deployed our most elaborate honeypot to date. The incidents we observed show the kinds of attacks that can easily...

trendaisecurity.com
1
43
3
63
2029206 - ET EXPLOIT Possible Citrix Application Delivery Controller Arbitrary Code Execution Attempt (CVE-2019-19781) (exploit.rules) in the @EmergingThreats OPEN set as of Dec 29th
18
1
19
Unsure yet what this comeback/evolution, after 2 years missing, of Zloader/Terdot.A is about...but this is one of the emerging trend in december 2019. cc/thx @tildedennis @threatinsight
1
20
44
Kafeine retweeted
Fumik0_@fumik0_25 Dec 2019
Let’s play (again) with Predator the thief fumik0.com/2019/12/25/lets-p…
6
54
2
141
Illustration of some ServHelper distribution for the past year (TL;DR: it's more than one actor)
22
50
Note:TA505 != Dridex. They were massively spreading it, with, as customer, Necurs. Dridex 125 then 220 and 7200, but also Locky 3, Trickbot mac1 before moving to ServerHelper and FlawedAmmyy. Other actor are spreading Dridex. Smilex was part of the team spreading Dridex 120.
2
47
2
108
Russian National Charged w/ Decade-Long Series of Hacking, Bank Fraud Offenses Resulting in Tens of Millions in Losses; 2nd Russian National Charged w/ Involvement in Deployment of “Bugat” Malware. Announced w/ @NCA_UK, @StateINL, @FBI, @WDPAnews, @USAO_NE justice.gov/opa/pr/russian-n…

Russian National Charged with Decade-Long Series of Hacking and Bank

The United States of America, through its Departments of Justice and State, and the United Kingdom, through its National Crime Agency (NCA), today announced the unsealing of criminal charges in...

justice.gov
21
180
16
232
Buer loader - proofpoint.com/us/threat-ins…
18
41
I don’t endorse the vocabulary in this tweet but I’d like to share our side of things and perhaps set the records straight. We never really wanted to (and still don’t want to) discredit Dragos publicly, there is really no point. 1/x
This quoted post is unavailable.
Try viewing anyway · View on X
3
84
7
217
For the records, sLoad is still dropping Ramnit "fB1oN5frGqf" in Italy. virustotal.com/gui/file/2c09… cc/thx @reecDeep @Antelox (cf: xitter.cf/reecdeep/status/118623… )
reecDeep@reecdeep21 Oct 2019
again 👾#sload #malware #geofenced #italy 🇮🇹 hxxps://passneet.com/cert/leultimenotizie.jpg same c2: hxxps://rtexo.eu/view/, hxxps://nvroe.eu/view/ @JAMESWT_MHT @malwrhunterteam @matte_lodi @luc4m @vxsh4d0w @VK_Intel @gigafio #ThreatIntel #ThreatMonitoring #Threat #infosec
1
11
35
New Exploit Kit #Capesand Reuses Old and New Public Exploits and Tools, Blockchain Ruse blog.trendmicro.com/trendlab…
2
33
41
The use of the Application Shimming technique was especially interesting: attack.mitre.org/techniques/… Also used by FIN7 in the past: fireeye.com/blog/threat-rese…
Kafeine@kafeine16 Oct 2019
TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader - proofpoint.com/us/threat-ins… - cc @tildedennis @mesa_matt
1
14
1
33
TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader - proofpoint.com/us/threat-ins… - cc @tildedennis @mesa_matt
49
1
71
Load more