security, stonks, games. Lead Security Engineer. Previously IronRadar. Developing proactive threat intelligence capabilities.
Joined August 2010
- Tweets5.1K
- Following523
- Followers734
- Likes5.1K
Pinned Tweet
Finally finished v0.3 of 📦pyMalleableProfileParser 🥳
- Complete overhaul of code base
- You can now validate Malleable Profiles (4.0+)
Upgrading is fairly easy:
pip3 install --upgrade pyMalleableProfileParser
Source: github.com/brett-fitz/pyMall…
#CobaltStrike
To be a security practitioner does not mean you need to follow every “best practice” out there. To be honest a lot of them are created by compliance folks and that have never truly practiced or designed security models.
Designing a system or service to be secure takes first the business needs and applying security measures around them.
Brett Fitzpatrick retweeted
Really cool research from @MauroEldritch, Heiner García and ANY.RUN. The amount of visibility they got here is pretty wild.
They set up a fake DeFi startup, hired suspected DPRK IT workers and watched how they actually worked.
A few things that stood out to me: they used dxdiag, systeminfo and wmic to profile the machine and understand the environment, then checked their exit IP before deciding everything looked safe enough to continue.
From there, they set up remote access, used AstrillVPN and VPS infrastructure as their entry points, shared 2FA codes between operators through 2fa.cn, and relied heavily on ChatGPT/Gemini for coding, troubleshooting, translation and creating fake documents.
There’s a ton more around accounts, wallets, browser data, infrastructure and even details about the operators themselves.
The interview videos might still be my favourite part 😂
Really impressive work.
any.run/cybersecurity-blog/l…
This 👇 and to be fair there is a push by companies (and maybe the community) to get their employees to put out more content and analysis but no one wants to hear or read AI slop. I tune into specific analysts and researchers because I like to hear their unique perspective and insights. If that becomes generic or lost then the value is lost.
Don’t have AI write your report.
I genuinely feel sorry for the new generation of InfoSec analysts.
Many of them are doing great work, spending hours researching, testing, writing, and sharing everything publicly so others can learn from it.
But because so many people are using AI to pump out low-effort slop, everyone else is now paying the price. A few bad apples are ruining it for everyone.
I’m not sure how we fix this, but it genuinely sucks.
Brett Fitzpatrick retweeted
@Wietze talking about hit awesome LNK research at @NorthSec_io
Live here > youtube.com/watch?v=-Q-_UwVD…
Brett Fitzpatrick retweeted
Good morning 🇺🇸
I caught up on my beauty sleep, the team put out an excellent write up of the axios 🗑️🔥: wiz.io/blog/axios-npm-compro…
Dangling threads I'm monitoring:
- Reporte bug in the linux payload (@N3mes1s)
- DPRK attribution (@DefSecSentinel)
- Addt'l infra (@InvictusIR)
Can’t wait to see this get abused for phishing and delivery 😭
From Claude Code to the web in seconds.
No git push. No build step. 100% free.
Just say: publish to here.now
Brett Fitzpatrick retweeted
𝗝𝘂𝘀𝘁 𝗹𝗮𝘂𝗻𝗰𝗵𝗲𝗱 𝗮𝘄𝗲𝘀𝗼𝗺𝗲-𝗱𝗳𝗶𝗿-𝘀𝗸𝗶𝗹𝗹𝘀 𝘄𝗶𝘁𝗵 @fr0gger_ !
Designed to save time during investigations and everyday DFIR tasks
Thomas has built an excellent malware triage skill, and I’ve added a couple of timeline analysis skills to help you get started. Feel free to contribute and use these skills to save a ton of time, like we already do.
github.com/tsale/awesome-dfi…
Learn about skills:
- developers.openai.com/codex/…
- support.claude.com/en/articl…
Tracking a phishkit that is leveraged by a cluster under "the comm":
(hash:"1aa9ba7cd3843882cfa388e92424c114524a3bcecd93eb7d4bd769a410589fc4" OR hash:"8fefa240ca7765401b4a08ab87fab4b2521c9339ef540a700fefbfc2e94850a3")
AND NOT page.domain:google.com
Threat cluster is performing wide net phishing campaigns targeting Okta users for big game hunting. Instead of targeted phishing campaigns with company branded Okta phishing sites, the cluster is leveraging a generic Okta login page to simplify operations:
okta.login-enterprisesso[.]com
okta.login-request[.]com
sso-accountservices[.]com
Likely #ScatteredSpider Cluster (G1015)
@censysio Query
(
services.banner_hashes="sha256:4e790c829f6352c5648575f97a399a98cbd5f7e324b82579e179604f134f184e" AND (services.tls.certificates.leaf_data.names: *okta-*.com OR services.tls.certificates.leaf_data.names: *-okta*.com)
)
blog.sekoia.io/solving-the-7…
Censys Query
same_service(services.telnet.banner="xlogin:" and services.port: 7777) and services.software.vendor=`TP-LINK` and services.port: 11288
There is an interesting http service located on
18.194.131[.]106:80
Shares the same characteristics of a C2 listener attributed to APT28 by @_CERT_UA. However, they typically drop SSH on a non-standard port.
Anyone else with insights drop a DM.
📦 v0.2.0 aws-sso-manager released today
- Bug fixes
- Enhancements to CI workflow (gha)
github.com/brett-fitz/aws-ss…
If you’re running Splunk enterprise and don’t have it behind a corp VPN/SDP update ASAP!
(Still update regardless of course)
github.com/nathan31337/Splun…
How does one distinguish generated self-signed certificates for Sliver and Havoc? 👇
Havoc copied sliver's v1 cert generator but there is a key difference in the process. Sliver only fills in the subject DN whereas havoc fills in both the issuer and the subject with the same DN.
One could filter for this in @censysio using the following query:
same_service(services.tls.certificates.leaf_data.subject_dn="C=*, ST=*, L=*, street=*, O=*, CN=*" and not services.tls.certificates.leaf_data.issuer: *)
Note: The wildcard will catch the possible postal code RDN.