threat Intelligence - opinions my own
CyberSpace
Joined June 2019
- Tweets3.2K
- Following2.7K
- Followers1.3K
- Likes8.5K
Pinned Tweet
"The morpheme ‘cyber-’, even though it nowadays seems to have lost the direct link to its origins, is still inextricably linked to systemic thinking. The notion of ‘systems’ is absolutely central in the context of cyber-threats and has several practical and theoretical
ramifications for how the issue is approached."
Cavelty, Myriam Dunn. (2008) Cyber-security and threat politics: US efforts to secure the information age., Nova York: Routledge 16p.
ꙮ i d m retweeted
🚨🇧🇷 $470,000 shipment of RTX 5090 graphics cards goes missing at Brazilian airport
Brazilian technology distributor Oderço says two pallets of Zotac GeForce RTX 5090 GPUs disappeared after reportedly arriving at São Paulo’s Guarulhos International Airport.
⠀
The company valued the shipment at R$2.5 million, approximately $470,000, based on its acquisition cost.
Oderço said it has sought information about the shipment but received no official explanation. The distributor described the incident as unprecedented in its 38-year history.
⠀
The number of missing graphics cards remains unknown. No arrival date, tracking information or other shipment records have been made public.
Authorities have not confirmed that the shipment was stolen, and the circumstances of its disappearance remain unclear.
ꙮ i d m retweeted
VirusTotal is now available in ChatGPT
Scan files, URLs, and domains for potential threats, right from your chat
chatgpt.com/plugins/plugin_a…
ꙮ i d m retweeted
🚨 BREAKING: Microsoft's October 2026 Patch Tuesday is MASSIVE!
Microsoft has fixed a record-breaking 1,411 security vulnerabilities, including 70 critical flaws and 3 zero-days, one of which is actively exploited in attacks.
🔥 317 remote code execution flaws
⚠️ 677 privilege escalation flaws
🛡️ 40 security feature bypass flaws
💻 Time to get patching!
ꙮ i d m retweeted
do WSJ: "Presidiários aplicam golpe com celulares contrabandeados em famílias nos EUA"
Maior parte dos casos ocorre no estado da Georgia.
Onde já se viu uma coisa dessas...
How Inmates With Contraband Phones Are Scamming Families Across America.
Prisoners need little more than contraband cellphones and well-honed scripts passed inmate to inmate.
They dial randomly, threatening arrest if fines are paid.
wsj.com/us-news/inmates-phon…
ꙮ i d m retweeted
Exclusive: The NSA will undergo its most extensive internal restructuring in at least a decade, according to officials.
The initiative calls for the creation of five new organizations in AI, China, cybersecurity, combat support, and global intelligence. wapo.st/4gYYyKQ
ꙮ i d m retweeted
Brazil has reached the point where fraud has a storefront, a shopping cart, and live chat.
This morning’s review of fr4ud[.]xyz — branded “FR4UD SHOP”, .xyz TLD, registered on 16 June 2026 with GoDaddy, DNS on Cloudflare, registrant hidden, no CNPJ on the page. Eighty-eight days online. Almost no public indexing. A bot wall at the edge. Behind that, a Portuguese storefront, Pix checkout, and the tagline “simple, direct, and easy to buy.”
The catalog does not hide the merchandise. On the left: old logins (26), Steam keys (10), panels (8), “method 7” kits (7), fake APKs (4), documents (2). On the right, cards with an AUTOMATIC badge and marketplace pricing: unlicensed Adobe software, a Steam key generator, “Premium” Spotify, SMS from R$1, followers, a “CLT loan” panel, lookup/search tools — and, in the same grid, panels advertised to “place a debt” and “place a death record.” From R$15.99 to R$89.99. Paid in Pix, on the spot.
There is no underground here. There is a checkout.
That is banalization completed: the visual language of ordinary Brazilian e-commerce — search, category, price filter, a widget asking “how can we help?” — applied to inputs for fraud, document forgery, and data abuse. Crime left the closed group and opened a shopping bag.
Three hard facts on this asset:
1. No corporate identity on the storefront.
2. A catalog that describes, in commercial language, products incompatible with lawful trade.
3. Disposable architecture: young domain, hidden registrant, global CDN, thin search footprint.
Operators are betting on collective fatigue. When the grotesque gets professional UX, the public stops being shocked and starts treating it as “just another store.” That is the real product.
Do not buy. Do not test. Do not share it as a curiosity. Capture it, report it, and send it on:
• Federal Police / cybercrime units
• SaferNet (safernet.org.br)
• [email protected] and Cloudflare’s abuse channel
• Central Bank / MED, if Pix was used in a loss
Fraud in Brazil no longer needs to hide. It only needs a cheap domain, a dark theme, and a Pix key.
#Cybersecurity #Fraud #Pix #Brazil #OSINT #DataPrivacy
ꙮ i d m retweeted
É delicioso ver um lugar ambientado no inferno e com nome de Madame Satã se sentir ultrajado pela descoberta de que Vorcaro e convidados estiveram no local. É como se o capeta - com uma imagem a zelar - não tolerasse ser associado ao banqueiro e seus convidados do poder público.
ꙮ i d m retweeted
INTEL BRIEF
The fastest way to move a hunt forward is knowing what an IP is before you chase it. Total Insights informational tags do exactly that. They describe the infrastructure and context behind an address so you can filter the noise and spend your time on what is actually huntable. Built by a team of analysts that know this pain intimately.
List of interesting informational context tag categories:
TAG # of IPs
Residential - 172M
VPS - 140M
CGNAT - 89M
Router - 12.3M
SOCKS - 7.6M
CDN - 7.5M
IoT - 5.3M
Proxy - 1.3M
Scanner - 1.25M
Shared-host - 1.06M
Bogon - 300K
The real value is at the model level. Router resolves to 261 device-model tags across 58 vendors, IoT breaks into 56 device types, and ICS into 97 device families. When you can see the exact make and model, both attribution and filtering get sharper and hunts become more efficient (looking at you ORBs 😉).
For threat hunting this is the difference between chasing and clearing. Bogon, sinkhole, honeypot, top-site, and CDN let you drop non-actionable addresses fast. CGNAT and shared-host warn you that one IP maps to many users, so you weight it accordingly. VPS, router, and IoT tell you what you are actually looking at before you spend a cycle on it.
#TotalInsights #ThreatIntel #ThreatHunting #DFIR
team-cymru.com/total-insight…
ꙮ i d m retweeted
Do you use Kusto Query Language (KQL) for querying your Azure Data Explorer / Log analytics / Azure monitor data?
I’ve just released a new, cross platform, querying/analytics tool with tons of features.
github.com/i-am-shodan/OpenK…
ꙮ i d m retweeted
O relatório anexado pelo ministro Alexandre de Moraes sobre o ministro André Mendonça tem indícios do uso de Inteligência Artificial em sua confecção
ꙮ i d m retweeted
Os manuais de direito constitucional e processual penal se tornam rapidamente peças de ficção nesse país.
ꙮ i d m retweeted
A Brazilian Magecart operation evolved from card skimming to real-time PIX hijacking, swapping QR codes at checkout to redirect payments. The script abuses GTM's dataLayer to match transaction values and generate PIX payloads on the fly.
#CTI #ThreatHunting #Magecart #PIX
ꙮ i d m retweeted
Financially Motivated Threat Actor BREEZE COMET Targets Brazil | Google Cloud Blog cloud.google.com/blog/topics…
ꙮ i d m retweeted
"How to make a honeypot with a Raspberry Pi" by Cody Bernardy, who I also saw deploy a honeypot that purports to be JWICS, which is insane 😂 youtu.be/e_xpdO6vAHM?is=Nisf…
ꙮ i d m retweeted
If you only watch one talk from Defcon
youtu.be/656058JxTM0?is=rNRf…
ꙮ i d m retweeted
I had a discussion with a friend in threat intelligence about AI-driven attacks, and one thing stuck with me.
Threat actors used to have a certain fingerprint.
You could sometimes look at a few commands and think, this looks Iranian. Or even, this looks like OilRig. Not because of one magic IOC, but because of the combination of tools, command patterns, naming habits, the way things were chained together, recurring mistakes, service names, usernames, all that stuff.
There was character in the activity.
AI agents are starting to blur that.
My friend recently went through hundreds of scripts from an intrusion and after a few hours realized that the attacker had basically just pointed Cairn, an autonomous pentesting tool, at a domain. At that point, what are you really analyzing?
The attacker, or Cairn?
You can end up with hundreds of commands, retries, scripts and small variations, but much of it is generic. It tells you how the agent works, how it reacts to errors, how it solves a problem. It may tell you surprisingly little about the person behind it.
That feels like a real problem for threat intelligence.
In the past, more telemetry often meant more chances to understand the actor. With AI agents, you can get much more telemetry and at the same time less identity.
Maybe the fingerprints will just move somewhere else. Which models or agents they use, how they prompt them, what they automate, where they intervene, what they leave to the machine.
But I think this change is going to make actor tracking a lot messier.
