Author/Operator of @ScumBots. Blue Team by day, Blue Team by night. Opinions, typos, and bad grammar do not represent my employer. He/Him
✋👈
Joined February 2008
- Tweets16.9K
- Following1.4K
- Followers14.1K
- Likes28.7K
Paul Melson retweeted
Check out his full talk here
youtube.com/watch?v=9FvBwgj6…
Paul Melson retweeted
Paul Melson joined us this year as our keynote speaker to talk about the history of crimeware and its evolution through the years.
In his keynote he also gives some good advice to those who are in the field and creating their professional network. Check out what he had to say!
Paul Melson retweeted
#MalwareChallenge
New way to embed b64-enc EXE in image
@Cryptolaemus1
@executemalware
@HazMalware
@James_inthe_box
@JAMESWT_MHT
@JRoosen
@lazyactivist192
@luc4m
@malwrhunterteam
@MsftSecIntel
@JohnLaTwC
@neonprimetime
@ps66uk
@Racco42
@utsuk_ladki
@l3m0ntr33
@H_Miser
@pmelson
#MalwareChallenge
Looks like Base64 markers changed from
<<BASE64_START>> / <<BASE64_END>>
to
'BaseStart-(.*?)-BaseEnd'
for b64-encoded payloads embedded in images
5879d31ba880a8bf0825ed666ce82913b53830be8ab8f20ea22702f4202ff789
#RemcosRAT
Paul Melson retweeted
I found a what I think novel approach which allowed me to list some of the content of #Lumma #Infostealer Command & Control servers with the help of left behind .DS_Store files. Blog, tool and Lumma files can be found here nexusfuzzy.medium.com/lumma-…
Paul Melson retweeted
@SLEUTHCON off to a great start.
My lesson learned from @pmelson is:
make friends, they probably know something you don’t, and the Intel space is all about not not knowing things
#sharingIsScaring
#CTI
Paul Melson retweeted
We're kicked off at #SLEUTHCON with @pmelson discussing the importance of networking in cyber, not for packet routing or job hunting, but disruption opportunities by pooling our collective access. I agree. Collectively, we're actually more powerful than state actors in many ways.
Paul Melson retweeted
Get ready for this year's Sleuthcon by listening to the episode of THE Microsoft Threat Intelligence podcast all about ScumBots with Paul Melson!
thecyberwire.com/podcasts/mi…
We are excited to announce our 2025 SLEUTHCON keynote speaker: @pmelson, VP of Cybersecurity at Capital One and author/operator of @ScumBots
With over two decades of experience defending networks and disrupting adversaries, Paul brings unmatched insight into the economics of cybercrime.
His talk, A Brief History of Crime[ware], traces the evolution of monetized malware and explores how we can stop attackers by targeting what they care about most: profit.
📍 June 6 | Arlington, VA + Virtual
🎟️ Early bird pricing ends soon
🗓️ CFP closes April 18
⚠️ This event will sell out
REGISTER TODAY: sleuthcon.com/registration
Paul Melson retweeted
We are excited to announce our 2025 SLEUTHCON keynote speaker: @pmelson, VP of Cybersecurity at Capital One and author/operator of @ScumBots
With over two decades of experience defending networks and disrupting adversaries, Paul brings unmatched insight into the economics of cybercrime.
His talk, A Brief History of Crime[ware], traces the evolution of monetized malware and explores how we can stop attackers by targeting what they care about most: profit.
📍 June 6 | Arlington, VA + Virtual
🎟️ Early bird pricing ends soon
🗓️ CFP closes April 18
⚠️ This event will sell out
REGISTER TODAY: sleuthcon.com/registration
Paul Melson retweeted
@censysio Censys has many open positions open right now across the company: sales, marketing, product, engineering, and research. Come join the team building the next generation of Internet scanning technology, the Internet Intelligence Platform. censys.com/careers/
Paul Melson retweeted
Given the significant impact of Hurricane Helene, the BSidesAugusta organizers have decided to cancel BSidesAugusta 2024 and our directly associated events during Augusta Cyber Week.
Paul Melson retweeted
#BruteRatel - #Latrodectus - .pdf > url > .js > .msi > .dll
wscript.exe Document-19-51-48.js
msiexec.exe /V
MSIBA2E.tmp /DontWait
rundll32.exe C:\Users\Admin\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState
(1/3) 👇
IOC's
github.com/pr0xylife/Latrode…
Paul Melson retweeted
#BAMFI ALERT - #Chicago: “Abducted 4y/o from Chicago in Arizona or Texas? Riley Batts, 4, was last seen on Sept 23, in the 5500 block of South Lowe Avenue in the Englewood neighborhood. Police say she was abducted by her non-custodial parent. - via JCodenReports.com
Paul Melson retweeted
#Oakland, #California: 5y/o King Scott has been #missing since yesterday (Tues, Sept 24).
He was last seen in the 1000 blk of Eight St in Oakland. Authorities believe King may be with his Mother, Mikalairene King, who is also missing (pictured).
Pls SHARE to help us find King.
Paul Melson retweeted
Shaun may travel to Irvine, #California, he was last seen in September 7, 2024 in San Clemente, California.. He may be in the need of medical attention.
bit.ly/4dloVa2
Paul Melson retweeted
I am excited to share that the #PEAK #ThreatHunting Framework, which I wrote with @iknowuhack and @letswastetime, has been nominated for a SANS Difference Maker award as "Innovation of the Year."
Vote here: sans.org/about/awards/differ…
Paul Melson retweeted
🔥 #dnSpy is often called the IDA Pro for .NET - in this video, learn the basics of using dnSpy by reversing #formbook malware 👇
youtu.be/LCxdCn9exbQ
Paul Melson retweeted
🚨Threat Intelligence Update: Meduza Stealer Panels🚨
my latest analysis have uncovered fresh and active Meduza Stealer panels🐍
http:**//195.133.18.15**/auth/login
http:**//62.133.60.75**/auth/login
http:**//94.156.177.177**/auth/login
#ThreatIntelligence #MeduzaStealer
Paul Melson retweeted
Critical #MissingPerson 13-year-old Samaiya Nathan, last seen in the 3500 block of 16th St., NW, on Monday, September 16, 2024.
The incident was reported on September 18, 2024.
Have info? Call 202-727-9099/text 50411.
Paul Melson retweeted
#MISSING!
Michael was last seen on September 13, 2024 in Dayton, #Ohio.
missingkids.org/poster/NCMC/…