Principal Tactical Response Analyst @HuntressLabs | @SANS_EDU Alumni | Python Security Researcher
Joined May 2023
- Tweets337
- Following368
- Followers867
- Likes209
Michael Tigges retweeted
👀 @watchtowrcyber Intel captured real, hands-on-keyboard exploitation of the recent PaperCut NG/MF vulnerabilities, including fully decrypting webshell and C2 comms.
Check it out: watchtowr.com/resources/pape…
Michael Tigges retweeted
GPT 6 solved CyberGym by hacking HuggingFace and cheating. Meanwhile, threat actors are still calling Suzie in Accounting pretending to be Help Desk, deploying RMM, getting Domain Admin in 3 steps and then ransoming the organization for $4 Million...
Michael Tigges retweeted
#AIForBlueTeam - Day 27!
Today I'm dropping a new tool 🔧
fishbowl is a containerized credential auditing perimeter for AI coding agents. It wraps Codex/Claude Code in Docker and audits credential access via eBPF.
Check out the git repo ( link below ) for more information and log samples.
Michael Tigges retweeted
Inspired by @Antonlovesdnb #ClaudeForBlueTeam, I wanted to use Claude for something productive & helpful, I decided to make Web extension that blocks clickfix, replaces clipboard content and alerts the user.
joshallman.co.uk/posts/shipp…
github.com/xorjosh/ClipShiel…
Michael Tigges retweeted
Dropping a new tool today: TTPRunner
- One-click Vectr deploy
- Give it a threat report, PDF, or just plain-english instructions and it'll build an execution & simulation plan for you
- Executions are tracked via notes and automatically sync'd with Vectr
Works great with: github.com/Antonlovesdnb/Con…
Check it out! 🔽
github.com/Antonlovesdnb/TTP…
Michael Tigges retweeted
A single copy-paste got this cybercriminal on the network.
40 mins later?
Both domain controllers were in scope.
We break down the full chain—from ClickFix social engineering to hands-on-keyboard activity.
Investigated by: @RussianPanda9xx + @sudo_Rem
okt.to/ves7UN
Michael Tigges retweeted
We don't usually see hands-on-keyboard intrusions from #ClickFix @HuntressLabs BUT... when we do... oh boiii.... it's clickfix -> matanbuchus -> AstarionRAT and a lateral movement for extra flavor
Yes, the name is a BG3 reference 🧛
Link: huntress.com/blog/clickfix-m…
Michael Tigges retweeted
Tuesday morning, the Tactical Response crew @HuntressLabs just got together and slammed out a blog within a day, covering how threat actors are abusing a legit employee monitoring tool (Net Monitor for Employees) alongside SimpleHelp as a dual-tool persistence setup, leading to Crazy ransomware. The level of dedication to print W's not just for profit but for the community is unmatched. Proud to be part of this team ♥️
huntress.com/blog/employee-m…
Michael Tigges retweeted
Super hyped to share that @HuntressLabs published a Rapid Response blog on the recent #React2Shell post-exploitations observed. We discovered and analyzed a few payloads that were named #PeerBlight, #CowTunnel and #ZinFoq. We also observed a variant of #Kaiji malware.
3 Modelo's 🍺 in and the malware started making sense. By the 4th one I was naming them like Pokémon except way more unhinged. PeerBlight, I choose you!
Thank you for your contributions @sudo_Rem, @LindseyOD123, @_JohnHammond, @bumbucha, and @aaron_deal. Couldn’t have done it without your support ❤️
huntress.com/blog/peerblight…
Michael Tigges retweeted
Good morning! ☀️
#GootLoader woke up and chose violence (again)
Grab your coffee, this one's JUICY 💣
huntress.com/blog/gootloader…
Michael Tigges retweeted
🚨 Widespread SonicWall SSLVPN Compromises Detected
Starting 10/4, and as recently as 10/10, Huntress observed a surge in SonicWall SSLVPN compromises. Threat actors are rapidly authenticating across devices—suggesting valid cred. use, not brute force. huntress.com/blog/sonicwall-…
Michael Tigges retweeted
Huntress tracked a threat actor who installed their Managed EDR product, sparking debate online over triage limitations and user privacy. I sat down with @_JohnHammond to separate fact from misunderstanding.
Watch the full video at the link below!
Michael Tigges retweeted
If your agent gets flooded - detect the flooding.
If code gets obfuscated - detect the obfuscation.
If ETW gets silenced - detect the silence.
If the EDR gets killed - detect the killing.
If logs get cleared - detect the clearing.
The act of hiding is often more suspicious than what’s being hidden.
It’s like a surveillance camera going black or freezing.
That is the signal.
Michael Tigges retweeted
I have been doing this with detections my ENTIRE career:
Hiding is a detection.
People come up with this or that new way to hide and think they are brilliant. I tell them: You are making my job easier.
They just don't listen and want to keep hiding. OK, keep being a ninja.
If your agent gets flooded - detect the flooding.
If code gets obfuscated - detect the obfuscation.
If ETW gets silenced - detect the silence.
If the EDR gets killed - detect the killing.
If logs get cleared - detect the clearing.
The act of hiding is often more suspicious than what’s being hidden.
It’s like a surveillance camera going black or freezing.
That is the signal.
Michael Tigges retweeted
🚨 SonicWall Exploitation (Zero Day?) 🚨
Huntress is tracking active intrusions via SonicWall devices.
Threat actors are bypassing MFA, pivoting to domain controllers, deploying ransomware (likely Akira), and creating users for persistence.
Pace suggests possible zero-day
Michael Tigges retweeted
New @Huntress blog! @Purp1eW0lf and I share some old defense evasion tactics from a well-commented script used by Xinglocker in 2021 still being used today!
Make sure you can detect them! #detectionengineering #ransomware
huntress.com/blog/why-old-ra…
Michael Tigges retweeted
Got a new @HuntressLabs blog out today taking a look at some intrusion analysis methodology with practical examples - check it out!
huntress.com/blog/intrusion-…
Michael Tigges retweeted
Hot on the heels of the researched published by @HuntressLabs, hunting for Zoom-themed lures from DPRK's #BlueNoroff
💥Learn hunting techniques
💥Leverage new Validin features and data
💥Full, unredacted indicator list (domains, IPs, hashes)
validin.com/blog/zooming_thr…
