
Threat Research lead @DarkAtlasSquad | Opinions are my own | Nothing is affiliated to my employer(s)
Darkweb
Joined November 2024
- Tweets418
- Following257
- Followers682
- Likes383
دي اول حلقه من بودكاست "Intelligence بالعربي"
اول ضيف معانا هو Muhap Yahia
اتكلم معانا عن خبرته ف السوك وبداياته وشغله حاليا ف ال Threat Detection وعن ال agentic soc والغلطات اللي بيقع فيها الBeginners وازاي تتفادي الغلطات دي
دا اللينك: lnkd.in/ehQdvfVa
look at this
We have identified strong indications that the employee device reportedly involved in the recent Binance security incident is the same device we detected during the final days of June 2026.
Our investigation revealed that the device was infected with #RisePro Infostealer* on **June 23, 2026**, potentially exposing a significant volume of sensitive credentials, authentication tokens, and cloud access keys.
Compromised Data Identified:
- 6 Google OAuth Tokens
- 2 AWS Secret Access Keys
- 2 AWS Access Key IDs
- 2 macOS Keychain artifacts
- 4 AWS Key Pairs
- Google OAuth session artifacts
Additional Exfiltrated Data:
- 548 Credentials
- 865 Cookies
- 1,882 Autofill Records
- 12 Secrets
Ahmed Khalifa retweeted
أنا بحب جداً أتكلم في جامعات وأيفنتات مختلفة، وعارف إن معظمهم ميزانيته ضعيفة وعلى القد، وعمري ما كانت دي مشكلة بالنسبالي.
بس مشكلتي الحقيقية في طريقة التعامل.
بلاقي اللي بيكلمني بيتفرد ويتني، ويحسسني إنه هو اللي هيطلع يقدم الـTalk وأنا مجرد مؤدي عنده. وتلاقي حد بيقولي ابعتلي البطاقة على WhatsApp، وحد تاني عايز الـCV، وجامعات في محافظات تانية عايزيني أسافر وأقعد في فندق على حسابي، مع إن بيكون فيه ميزانية، وبسمع إن فلان اتعرض عليه كذا وفلان اتعرض عليه كذا.
أنا مبكرهش في حياتي حاجة قد عدم السلكان وتشغيل الدماغ، خصوصاً لما حد يفتكر إنه بيتعامل مع مغفل.
الموضوع بالنسبالي مش فلوس، أنا ممكن أجيلك آخر الدنيا على حسابي، بس ألاقيك مؤسسة محترمة، بتقدر الناس اللي بتدعوها، وعارفين بيعملوا إيه، مش بتوع لف ودوران ولقطة.
المفروض إن فيه احترام متبادل، وكل طرف عارف قيمة اللي التاني بيقدمه.
الفترة دي وقتي ضيق جداً، ويدوبك بلاقي وقت آخد فيه نفسي، فلو هخصص جزء من وقتي عشان أروح أتكلم في مكان، هيكون مكان بيعرف ينظم، وبيقدر الناس، وفاهم هو جايب المتحدث ليه، ومين الجمهور اللي مهتم يسمعه.
غير كدا، مفيش حاجة تستاهل المجهود.
وأنا مش ضد الجامعات أو الأيفنتات الصغيرة، بالعكس، ساعات بكون مبسوط بالمشاركة فيها أكتر من مؤتمرات كبيرة. بس مفيش مبرر مبرر لقلة الاحترافية أو عدم احترام الناس.
- عاوز اتجوز يحاج
= لما تشوف جيشك
- عاوز اسافر
= لما تشوف جيشك
- عاوز اجيب شقه ف القاهره
= لما تشوف جيشك
- عاوز اتبسط
= لما تشوف جيشك
- عاوز اعمل اي حاجه زي البشر
= لما تشوف جيشك
Legend 🙏
Park Jin Hyok is a North Korean programmer and hacker reputedly involved in some of the most expensive cyber intrusions in history. North Korea officially denies his existence. Park attended the Kim Chaek University of Technology in Pyongyang and has reportedly traveled to China, where he performed IT work for the North Korean company "Chosun Expo," as well as on behalf of North Korea's Reconnaissance General Bureau.
In North Korea, his exploits may even be celebrated, yet his privileges come with significant limitations: his travel options are severely restricted, with Russia being one of the few countries he can visit, and even that is uncertain. His technical prowess is undeniable; after delving into his background and work, it’s clear that he has chosen to apply his considerable talents toward illicit and illegal activities.
He is one of the finest assets of the RECONNAISSANCE GENERAL BUREAU
Ahmed Khalifa retweeted
CTI is easy:
Russia = ransomware
DPRK = crypto
China + Iran = espionage
everyone else = money
Rip😭😭😭😭
A hacker stole data from the Pentagon, Europol and 40+ companies, built one of the dark web’s biggest stolen data marketplaces, and was eventually caught after accepting a $250 payment in Bitcoin.
> Kai West, better known online as IntelBroker, was accused of running a major stolen-data marketplace on the dark web.
> His alleged victims included Apple, AMD, Cisco, Nokia, General Electric and Europol.
> The operation was also linked to claims involving sensitive US government data, including information about members of Congress.
> For years, IntelBroker operated under a pseudonym, selling stolen data while trying to keep his real identity hidden.
> He reportedly preferred Monero, a cryptocurrency designed to make transactions harder to trace.
> Then came a $250 deal.
> In January 2023, an FBI agent allegedly persuaded him to accept Bitcoin for a purchase of stolen data.
> That payment became a crucial lead in the investigation.
> Investigators spent years connecting online accounts, cryptocurrency activity and other digital evidence to identify the person behind the alias.
> In January 2025, IntelBroker announced he was stepping away from the forum he had been running.
> Three weeks later, French authorities arrested him.
> The case involved allegations of MILLIONS of dollars in damage and attacks affecting dozens of organizations.
> He allegedly spent years hiding behind an online identity, only for one transaction to help investigators close in on him.
The hacker who relied on crypto to hide his tracks may have made one of his biggest mistakes by accepting a different coin.

























