SKII (@SethKingHi) profile picture

SKII

@SethKingHi

Lead Security Researcher @kaspersky GReAT, tweets and opinions are my own.

 CN
Joined March 2012
  • Tweets307
  • Following603
  • Followers1.2K
95Media
Photo by SKII (@SethKingHi)Photo by SKII (@SethKingHi)Photo by SKII (@SethKingHi)Photo by SKII (@SethKingHi)Photo by SKII (@SethKingHi)Photo by SKII (@SethKingHi)Photo by SKII (@SethKingHi)Photo by SKII (@SethKingHi)Photo by SKII (@SethKingHi)
synology.com/zh-hk/company/n… 群晖警告NAS大规模勒索攻击 #Synology NAS #Ransomware #LOCK3D #C3RB3R #IOC hxxp://94.183.151[.]83/* 28AFFD3D72889A2C15D33D3EEBC320FF - xdy5.sh A1375E0F82AE86DF528876C049B5A23C- libgittcb.bat E5CC0827446E1B664D47E452B0390CE2- qnetd F1EA2976418CE14FFD5EF6CBFCB6FA48 - xdy5.3ac
Image from SKII (@SethKingHi)
Image from SKII (@SethKingHi)
Image from SKII (@SethKingHi)
1
12
3,439
NetamLoader: a highly sophisticated infection chain and a complex .NET assembly-loading framework built on XAML markupю Strong indication of a supply-chain attack targeting a custom Windows build used exclusively by government entities in Asia 👉 kas.pr/9z7h No attribution to any known APT group has been established.
Image from Eugene Kaspersky (@e_kaspersky)
Image from Eugene Kaspersky (@e_kaspersky)
Image from Eugene Kaspersky (@e_kaspersky)
26
1
91
6,305
Together with @bzvr_, @2igosha and Anton Kargin, we identified that the DAEMON Tools software has been compromised in a complex supply chain attack since April 8. We see thousands of infections across 100+ countries. If you use DAEMON Tools, run a malware scan immediately! [1/7]
Image from Georgy Kucherin (@kucher1n)
23
333
50
1,053
184,831
🚨 New IOCs: Notepad++ supply chain attack Kaspersky GReAT analyzed trojanized Notepad++ updates active until Dec 2025. From July–Oct 2025, attackers used 3 distinct infection chains, changing C2s and payloads. Observed behaviors: • Metasploit & Cobalt Strike • Lua-based loaders • DLL sideloading (Chrysalis backdoor) • NSIS installers in early stages • Repeated use of temp[.]sh Victims observed across Australia, Latin America & Southeast Asia. Kaspersky solutions, incl. Kaspersky Next, detect all observed malware. 🔍 Full IOCs & detections: kas.pr/dy3f
Image from Kaspersky (@kaspersky)
5
1
22
2,523
🚨Mission from my big brother @SethKingHi: The payload in the sample is encrypted with AES_CBC and compressed with LZMA. The decryption key is derived from a parameter in Python. The final payload abuses a #Zulip chat room as its #C2. Happy hunting 🍷 & Stay vigilant⏰@Xlab_qax
Image from Alex. Turing (@TuringAlex)
SKII (@SethKingHi) profile pictureSKII
@SethKingHi26 Jul 2025
Replying to @SethKingHi
#OceanLotus #APT32 #PyPi New version, supports Linux. /terminate.dll 1995682d600e329b7833003a01609252 c697848015bb8c2cbb7cc1502905ba23 colorinal-0.1.7-py3-none-xxxx.whl ba2f1868f2af9e191ebf47a5fab5cbab c5f0425dabd01d7ba80dfc3d5ca19841 /terminate.so 38b75af6cbdb60127decd59140d10640 colorinal-0.1.7-py3-none-manylinux1_x86_64.whl 436249e401aa38f6f07ef4b1477b6416
Image from SKII (@SethKingHi)
Image from SKII (@SethKingHi)
Image from SKII (@SethKingHi)
1
4
14
2,810
#OceanLotus #APT32 #PyPi uuid32_utils-1.x.x-py3-none-win32.whl cf3f59e2c4c8767697ea46475171697c 91a476fea45abc8b208e0a9e3293f774 a7a0add66b205967562c1fa9643b8421 22538214a3c917ff3b13a9e2035ca521 02f4701559fc40067e69bb426776a54f 5598baa59c716590d8841c6312d8349e Backward.dll c33782c94c29dd268a42cbe03542bca5 454b85dc32dc8023cd2be04e4501f16a
Image from SKII (@SethKingHi)
Image from SKII (@SethKingHi)
Image from SKII (@SethKingHi)
2
6
22
3,207
#OceanLotus #APT32 #PyPi New version, supports Linux. /terminate.dll 1995682d600e329b7833003a01609252 c697848015bb8c2cbb7cc1502905ba23 colorinal-0.1.7-py3-none-xxxx.whl ba2f1868f2af9e191ebf47a5fab5cbab c5f0425dabd01d7ba80dfc3d5ca19841 /terminate.so 38b75af6cbdb60127decd59140d10640 colorinal-0.1.7-py3-none-manylinux1_x86_64.whl 436249e401aa38f6f07ef4b1477b6416
Image from SKII (@SethKingHi)
Image from SKII (@SethKingHi)
Image from SKII (@SethKingHi)
1
2
1
15
5,270
#OceanLotus #APT32 #PyPi Import the above malicious library - colorinal termncolor-3.1.0-py3-none-any.whl 5152410aeef667ffaf42d40746af4d84
Image from SKII (@SethKingHi)
Image from SKII (@SethKingHi)
Image from SKII (@SethKingHi)
1
1
8
3,966
Beware of tampered WPS installers C:\Program Files (x86)\wps\wps\splayer supek12[.]exe c5359dab0a9d2b1c5bc1fa9db3dd134e
Image from SKII (@SethKingHi)
1
5
1,084
#GhostContainer Some clues can link puzzles together. Keywords: App_Web_8c9b251fb5b3 App_Web_Container_1
Kaspersky (@kaspersky) profile pictureKaspersky
@kaspersky18 Jul 2025
🚨 New Cyber Threat Alert: GhostContainer Backdoor Targets Exchange Servers High-value organisations in Asia are under attack! A sophisticated backdoor, GhostContainer, is compromising Exchange servers via N-day vulnerabilities. This malware evades detection, acts as a proxy, and grants attackers full control. 🔍 Key targets: Government agencies & high-tech firms. ⚠️ Urgent action needed: Patch & monitor your systems. Learn more about the threat & how to protect your organisation 👉 kas.pr/pt1j #Cybersecurity #APT #ThreatIntelligence
1
4
517
🚨 New Cyber Threat Alert: GhostContainer Backdoor Targets Exchange Servers High-value organisations in Asia are under attack! A sophisticated backdoor, GhostContainer, is compromising Exchange servers via N-day vulnerabilities. This malware evades detection, acts as a proxy, and grants attackers full control. 🔍 Key targets: Government agencies & high-tech firms. ⚠️ Urgent action needed: Patch & monitor your systems. Learn more about the threat & how to protect your organisation 👉 kas.pr/pt1j #Cybersecurity #APT #ThreatIntelligence
1
1
1
3
2,133
#MysteriousElephant #RTF - 61677da805217dd8816735897feaa83f #HTA - 6d1516b55d7025cb715093a6ee1ef9a4 http://mail-gdrive[.]com/ascos.exe #GEOShell - f2b3fd3a1034aaee49457e4611c8bb8b http://158.255.215[.]45:8899/nina/anotherLife?credPart=F86ymcBb9a&dumbPart=3.3.3.3 91.103.66[.]202:46882
1
1
11
949
Nice try OL! Anti-disassemble trick. Tampering with IPtoStateMap (Windows Exception Handling Metadata)
Image from SKII (@SethKingHi)
1
6
1,353
Now learning from Ye Jin (@SethKingHi), from Kaspersky GREAT team, on “The Dropping Elephant never dropped”. #VB2023
Image from __veronica__ (@verovaleros)
Image from __veronica__ (@verovaleros)
Image from __veronica__ (@verovaleros)
1
2
1
11
1,665
#APT #DoNot MD5: cd97a53fc8071e00625b4d9bc4ef5c4a - Vtyrei C2: hxxps://adjusteble[.]info/LHgausZEKtauASHjSvfUU/rokoprexcobatrs - URL 45.61.139[.]219 - IP Related to #APT #PaperPin ? C2: hxxps://ethertestnet[.]pro/paperpin3902.jpg - URL 45.61.139[.]219 - IP blog.sonatype.com/malicious-…
Image from SKII (@SethKingHi)
1
9
1,352
kb.cert.org/vuls/id/127587 Of course root problems can be propagated to any branch #CVE-2023-24329 #Scrapy
Image from SKII (@SethKingHi)
Image from SKII (@SethKingHi)
1
4
1,296
#DoNot APT 23aa033b8032febed751a20573dd82b1 germscleaner[.]store
4
12
1,895
#APT #Bitter c3e0e2dda8485e56bfcf26b36ada4da5 vsetmediasvc[.]com
1
8
1,283
Load more