CTI Analyst @ Deutsche Telekom Security. Open source. Open data. Tech geek. Tweets in 🇩🇪 and 🇬🇧. Views are my own.
Roaming in the cyber realm
Joined January 2009
- Tweets3.8K
- Following844
- Followers498
- Likes6.5K
Fabian Marquardt retweeted
🚨Check out our latest report on a threat activity that has been around for some time and has recently used the Telekom brand as a lure 👇 github.security.telekom.com/…
#CyberThreatIntelligence #ThreatIntel #CyberSecurity
Fabian Marquardt retweeted
Recently, we‘re involved in an incident response engagement related to the ZipLine phishing campaign. The specific activity was linked to a Qilin affiliate that primarily targeted Austrian organizations with the goal of deploying ransomware.
Details👇
🔗 github.security.telekom.com/…
Fabian Marquardt retweeted
🚨 Our Red Team discovered a new Linux vulnerability: “Pack2TheRoot” (CVE-2026-41651)
It affects PackageKit versions 1.0.2–1.3.4 across major distros like Ubuntu, Debian, Fedora & Rocky Linux -potentially impacting servers running Cockpit.
Details 👇github.security.telekom.com/…
Fabian Marquardt retweeted
This is what happens when you give our Red Team a bit of free time to do some research.. #CVE-2026-41651 github.security.telekom.com/…
Fabian Marquardt retweeted
1/12 Lots of people asking if I make every Asian male I interview insult Kim Jong Un - for the avoidance of doubt, I only ask someone to insult Marshal Kim when I'm already confident they're North Korean and trying to defraud.
But how did I know Taro was North Korean? 🧵
Fabian Marquardt retweeted
Targeting NET 9 April for the launch of Mission ‘Onward and Upward’ during the available launch window, which opens at 8pm UTC; 10pm CEST.
The final date remains subject to weather, safety and range infrastructure.
Fabian Marquardt retweeted
“You can see the surface of the Moon…we just went sci-fi.”
On flight day seven, images from our @NASAArtemis II crew amazed, turning science fiction to reality. From the lunar far side to a solar eclipse from the Moon, the views are EVERYTHING. No pressure to pick a favorite.
Fabian Marquardt retweeted
⬇️ Check out our new blog post on recent exploitation of Ivanti EPMM appliances
For some reason, our incident response team was overwhelmed with Ivanti EPMM exploitation cases at the end of February (almost one month later after Ivanti's security advisory). Here are our findings: github.security.telekom.com/… #ivanti
Fabian Marquardt retweeted
Fun IP overlap spotted 🔍
🇮🇷 MuddyWater IP {209.74.87[.]100} reported by @polygonben in his blog (ctrlaltintel.com/threat%20re…)
That same IP appeared in
Telekom Security’s list of IOCs (github.com/telekom-security/…) from their blog (github.security.telekom.com/…) on Ivanti VPN exploitation.
Fabian Marquardt retweeted
For some reason, our incident response team was overwhelmed with Ivanti EPMM exploitation cases at the end of February (almost one month later after Ivanti's security advisory). Here are our findings: github.security.telekom.com/… #ivanti
Fabian Marquardt retweeted
We're bringing progress and ambition back to Europe: Spectrum’s stages for Flight 2 have arrived at our launch pad at @AndoyaSpace , gearing up for pre-flight testing.
Fabian Marquardt retweeted
Today I had a surprise video debate at an AI company apparently in a conference hall.
Asked why I for decades said The Keepers Of The Status Quo at Wikipedia is really bad training to reach AGI.
I played this James Burke video.
It silenced the room!
Fabian Marquardt retweeted
My regular reminder whenever a vendor discloses a 0-day on an edge device:
Patching it doesn’t fix the breach that already happened.
If it was exposed for months, patching it is like changing the front door lock while the burglars are already in your living room.
Fabian Marquardt retweeted
🚨 ALERT: Cybercriminals are sending out fake Telekom invoices via phishing emails to deliver multiple malicious RAT payloads. The activity originates from an attack cluster tracked by Telekom Security under the name "Rodent Weed". 🧵1/6
Fabian Marquardt retweeted
Wondering if a code-signing certificate has been reported? See it in one of your favorite tools: Cert Central's blocklist is now appears in MalwareBazaar!
We've reported ~300 certs so far this year; it is on pace for a record. Keep an eye out and keep uploading. :)
Fabian Marquardt retweeted
I often am asked for pointers on building a VM for malware analysis. I wrote a 40+ page chapter on this in my book Evasive Malware. You can download this chapter from the book on my blog for free here:
evasivemalware.com/EvasiveMa…
Thanks @nostarch for allowing me to give it away 🤓
Fabian Marquardt retweeted
things that bother me about working in cybersecurity (in no specific order):
- glorified burn out culture
- the toxic mindset of “if you’re not spending your free time studying up on cyber, you aren’t working hard enough”
- the toxic mindset of “i had to spend 5 years working on help desk and 3 years as a sys admin before landing my first cyber role, so you should have it this hard too”
- the gatekeeping
- the weird belief that GRC isn’t as important as red or blue teaming
- the insecure men who feel threatened when a female is more successful than them
ick
Fabian Marquardt retweeted
💥 Ransomware kill chain broken – Operation Endgame strikes again
🔸 300 servers taken down
🔸 650 domains neutralised
🔸 €3.5M crypto seized
🔸 20 international arrest warrants
Europol & partners deliver another blow to global cybercrime.
More ⤵️
europol.europa.eu/media-pres…
