Works in Security. Social Democracy. Change the World or Nothing. Personal Account not my employers, my own views!
UK
Joined August 2012
- Tweets443
- Following93
- Followers2.8K
- Likes459
Today I have posted over 500+ additional domain indicators on a phishing cluster which has targeted organisations across the world utilising CloudFront, Amazon S3, CloudFlare and gCaptcha. The targeting is wide and I recommend all defenders to query their org.
The cluster is related to this activity - blog.nviso.eu/2024/10/02/all…
linkcabin retweeted
We had a short look at the buffer overflow found by fuzzing `process_browse_data` to determine its exploitability. Conclusion: this bug alone won't give you RCE, or even an info leak.
Attacking UNIX Systems via CUPS, Part I
evilsocket.net/2024/09/26/At…
This is actively harmful for defenders and gives attackers an advantage. Why put indicators like this into an image?
I did some new research. Enjoy! Detecting a business email compromise (BEC) threat actor - threatintelligence.substack.…
linkcabin retweeted
The FBI recently sent a warning out regarding DPRK activity against the crypto industry. Today, we documented attacks we've seen on macOS. Attacks start with social engineering and deliver a piece of malware that we call ThiefBucket.
jamf.com/blog/jamf-threat-la…
#malware
linkcabin retweeted
Exploiting an object corruption bug in v8 Javascript engine (CVE-2024-3833)
github.blog/2024-06-26-attac…
Credits @mmolgtm
#chrome #cybersecurity
linkcabin retweeted
New macOS malware. :)
DPRK. Spent some time reversing the dropper written in Swift/SwiftUI.
Here’s the deep dive:
kandji.io/blog/todoswift-dis…
Happy birthday to me I guess as citizenlab reference my Blue Callisto research from my PwC days
🚨 NEW REPORT by @citizenlab in collaboration with @accessnow, @DeptFirst, Arjuna Team and RESIDENT.ngo uncovers a sophisticated and highly-personalized #phishing campaign targeting civil society members in the US and Europe, including Russian opposition in exile, NGOs, and media outlets.
Report led by @jsrailton & @PDXbek with @edok_lotosov and @RonDeibert:
citizenlab.ca/2024/08/sophis…
Scraping ransom leak sites which don't want to be using a JavaScript interpreter library in Python threatintelligence.substack.…
linkcabin retweeted
CPR discovered a network of GitHub Ghost accounts legitimizing repositories and spreading malware like #Atlantida, #Rhadamanthys, and #LummaStealer. The threat actor has possibly operated Stargazers Ghost Network as a #DaaS since August 2022.
research.checkpoint.com/2024…
