MSc Infosec, #DFIRMA, Telecommunications | DFIR Group Manager | GCIH/GRID/GCFA/CHFI/CISM/CPTE/SFCP/ITIL | #Kaspersky #GERT
Closer
Joined January 2010
- Tweets21.4K
- Following1.3K
- Followers2.2K
- Likes6.7K
Pinned Tweet
You can't wait until life isn't hard anymore before you decide to be happy!!!
Jane Marczewski
Eduardo Chavarro retweeted
Check out what we’ve uncovered about the high-profile PHP vulnerabilities that are making rounds all over the internet, and how we detect malicious activity associated with them. For the record, our products and services are not affected by these vulnerabilities: kas.pr/55tw
Eduardo Chavarro retweeted
An extensive study by our Security Services team examines how secure a modern warehouse is from an attacker’s perspective. It explores how a warehouse can be compromised via a barcode scanner, a mobile printer, or even a power outlet behind a storage rack. It also explains why the warehouse management system (WMS) is the primary target, and what can be done about it.
Read more here: kas.pr/9hoh (presented at the SAS 2026 conference).
Eduardo Chavarro retweeted
🏆 No todos los rankings son motivo de celebración. Hay un Top 3 que revela una realidad alarmante sobre la ciberseguridad de las empresas en América Latina.
En su nueva columna para Portal ERP Colombia, Daniela Álvarez de Lugo, gerente general para la Región Norte de América Latina en Kaspersky, analiza lo que este ranking revela sobre la preparación de las empresas y por qué fortalecer la seguridad digital va mucho más allá de invertir en tecnología.
Aqui los detalles: portalerp.com/co/articulo/un…
Eduardo Chavarro retweeted
No malware needed: in a real 2026 incident, our experts found that attackers with domain admin rights created a single malicious GPO named PAYLOAD to drop ransom notes, hijack wallpapers and disable local admin accounts across an entire domain.
More:
purpleshift.io/purple/2026-0…
Eduardo Chavarro retweeted
La tecnología es importante, pero también se necesitan profesionales capaces de operarla. Ante la escasez global de talento en ciberseguridad, un SOC tercerizado puede tercerizar las tareas rutineras como el monitoreo continuo para permitir que el equipo interno enfoque en tareas más estratégicas. Dwayne Porr analiza cómo los servicios especializados pueden ayudar a enfrentar este desafío.
🎧 La conversación completa sobre los retos de los SOC en nuestro sitio web: kas.pr/6ptn
Eduardo Chavarro retweeted
Mind the hole in your AI budget. Denial of wallet is the new DDoS: attackers make your AI agents burn tokens on purpose.
How it works and 5 ways to stop it:
kas.pr/uwd7
Eduardo Chavarro retweeted
We all know what DDoS attacks are. But how much do we know about the underground market behind them?
Join Kseniya Kudasheva and João Brandão on Oct 8, 14:00 UTC for a closer look at the DDoS-for-hire ecosystem.
#DDoS #Cybersecurity
brighttalk.com/webcast/15591…
Eduardo Chavarro retweeted
Every vendor claims they're number one.
None of them can show you the proof.
13 independent labs can. They run the tests, we just show up.
Every year since 2013.
Whose numbers do you actually trust?
kas.pr/7jco
#cybersecurity #infosec
Eduardo Chavarro retweeted
Attackers abuse NTFS streams to hide code. Linux has a similar trick: extended attributes (xattr) can stash a payload in a legit file like .bash_history, read back by a small C loader and most Linux EDRs never look there.
More about how to detect it:
purpleshift.io/purple/2026-0…
Eduardo Chavarro retweeted
‼️ BREAKING: A flaw in ChatGPT let researchers reach data inside the apps people connect to it: Gmail, Google Drive, Microsoft Teams, GitHub. A hidden prompt was enough to make the chatbot hand it over, with nothing visible to the user.
The channel was a clipboard shared between ChatGPT's normally isolated containers, which carried instructions from one account into another's session. In their proof-of-concept the researchers pulled a victim's Gmail messages, chat history and uploaded files while that user watched their own request run as normal.
The hidden instruction could arrive through a malicious prompt, a shared conversation or a custom GPT. Check Point found it in June 2026 and says the channel had already closed before they reported it; OpenAI confirmed the internal server behind it was decommissioned.
Eduardo Chavarro retweeted
New IR case from our GERT team: Toy Ghouls, a financially motivated group that's been targeting Russian organizations, has moved on from open-source and leaked tools to building its own backdoors.
Both versions use "bird" naming and talk to their C2 over unusual channels: the HiveMQ MQTT broker and the Element messenger.
Full breakdown: kas.pr/nd4y
Felicitaciones al equipo Fluid Attacks de Colombia
Eduardo Chavarro retweeted
The financially motivated Toy Ghouls group, which has been attacking Russian organizations since 2025, is expanding its toolkit: in addition to the GenieLocker ransomware, we’ve detected use of its own backdoor for the first time – two versions at once, with non-standard C2 channels (the HiveMQ MQTT broker and the Element messenger). Details: kas.pr/z5gd
Eduardo Chavarro retweeted
The Mirage Kitten APT’s toolkit is evolving: we’re exploring its two previously undocumented cross-platform RATs – NodeRabbit and PollCat – that are targeting aviation and FinTech sectors across the Middle East and Africa. Spear-phishing (fake recruiters and trojanized coding challenges) is the key attack vector. These RATs mark the group's first documented use of Node.js/JavaScript malware. Full analysis: kas.pr/vs7i
Eduardo Chavarro retweeted
A while ago we were tasked to analyze a file with an initial classification as adware. A deeper research turned up suspicious network activity - the sample did far more than serve ads. In fact, its advertising functionality doesn’t even work; instead, it triggers an infection chain that delivers the ValleyRAT backdoor.
More details 👉 kas.pr/73e8
Eduardo Chavarro retweeted
EDUARDO CHAVARRO | Director del Equipo Global de Respuestas a Incidentes para Américas de @kaspersky
En entrevista con DPL News, Eduardo Chavarro Ovalle (@EChavarro) revela cómo atacantes tomaron control total de redes corporativas en México y Colombia sin instalar un solo malware: usaron credenciales legítimas y herramientas nativas de Windows para cifrar datos e imprimir sus demandas de rescate directamente en las impresoras de la oficina.
¿Está tu empresa cometiendo el mismo error básico?
La entrevista completa, aquí en DPL News👇
🔗 dplnews.com/malas-practicas-…
#Ciberseguridad #Kaspersky #Pymes #Ransomware
Eduardo Chavarro retweeted
📊 8 de cada 10 empresas en América Latina reforzarán su #ciberseguridad durante el próximo año. Las organizaciones están respondiendo a un panorama de amenazas cada vez más complejo con más inversión, tecnología y capacidades de protección.
▶️ La mejor solución aquí: kas.pr/wm22
#Tech #CyberSecurity #Kaspersky #Latam
