Chief #malware analyst, reverse engineer, #APT and #ransomware researcher, programmer. Tweets represent my personal views.
Joined March 2021
- Tweets516
- Following1.8K
- Followers4.8K
- Likes1.8K
virustotal.com/gui/file/99ac…
Finally something interesting.
It's amazing to see constant-time memcmp in a ransomware.
The #GenieLocker cryptoscheme is similar to Venus/Trinity #ransomware.
But honestly, expected more from this one ;-)
github.com/f6-dfir/Ransomwar…
#Bearlyfy
Don't pay the ransom! Paying the ransom doesn't you'll be given the decryptor.
My colleagues inform me that Makop affiliates ([email protected]) are scammers
#Ransomware #Makop
rivitna retweeted
🚨Group-IB’s Threat Intelligence team has uncovered a sophisticated ransomware operation, #HuntersInternational, emerging in October 2023, with technical overlaps with the dismantled #Hive ransomware group. The group has implemented a dual extortion model, prioritizing data exfiltration while still maintaining file encryption across Windows, Linux, and ESXi systems. #CyberSecurity
Here is the new version of #PE32 #ransomware.
PE32 ransomware uses AES-256 CTR and ML-KEM Kyber1024, RSA-4096 🤯
virustotal.com/gui/file/f6b5…
rivitna retweeted
🎯I would help #malware analysts to bypass anti-analysis measures by concealing their processes, like x64dbg or procmon
⚔️Excited to introduce hollowise!
check this out: github.com/reecdeep/hollowis…
#CyberSecurity #CyberSec #informationsecurity #infosec
#PE32 is a new family of #ransomware
It's not hard to guess where this ransomware was developed.
But it is noteworthy that it's developed in #Rust.
Perhaps the author's name is Farza, and he himself uploaded the first versions of his ransomware to VT.
github.com/facct-ransomware/…
pe32s #Ransomware
md5 : 1289a867fafe321b51a93aa47afaffc9
ext : [org_filename].[victim_id].[org_ext].pe32s
rivitna retweeted
💡Did you know that #Hunters International provides a tool to their affiliates that allows them to leak stolen data on the brand storefront *without* uploading it anywhere and keeping it on their own servers? #Ransomware
Six months ago, we posted a list of all possible passwords and the code to generate them :)
github.com/facct-ransomware/…
ShrinkLocker used decryptors as a threat—then reversed course. Discover how this ransomware unfolded and what it means for your defenses.
🔗 bitdefend.me/48NONKS
#Cybersecurity #InfoSec #Ransomware
My Top 10 most difficult data encryption implementations in #ransomware:
1. #TeslaRVNG / #Secles
github.com/facct-ransomware/…
2. #Hunters International / #Hive v6
github.com/rivitna/Malware/b…
3. #Mimic
github.com/facct-ransomware/…
4. #RCRU64
github.com/rivitna/Malware/b…
#WEAXOR #Ransomware
What's it?
Is this a rebranding of #Mallox ransomware?
weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd[.]onion
lazylazy@tuta[.]com
help.service@anche[.]no
virustotal.com/gui/file/e21c…
rivitna retweeted
Still #cyberpanel #ransomware:
Thanks to @rivitna2 you can now also decrypt files that were encrypted with the .encryp extension.
More details at gist.github.com/gboddin/d788…
You are a little late, I developed the Mallox decryptor more than a year ago, and published its final version back in March 😏
github.com/rivitna/Malware/t…
🚨 Great news! 🚨
Our team has released a free #decryption tool for the #Mallox / #TargetCompany #ransomware variant that was active throughout 2023 and early 2024. Find the download link and full details here: gendigital.com/blog/news/inn… #DontPayUp #GenThreatLabs
rivitna retweeted
Компания F.A.C.C.T. выпустила первое подробное исследование группировки «двойного назначения» Shadow/Twelve, активно атакующей российские организации.
Скачать отчет «Тени не скроются: Расследование атак группировки Shadow»: facct.ru/resources/research-…
