Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2022-06-17 ⋅ Github (NtQuerySystemInformation) ⋅ Twitter (@kasua02)
A reverse engineer primer on Qakbot Dll Stager: From initial execution to multithreading.
QakBot
2022-06-14 ⋅ Twitter (@3xp0rtblog) ⋅ 3xp0rt
Tweet on Keona Clipper
Keona
2022-06-11 ⋅ Twitter (@MsftSecIntel) ⋅ Microsoft Threat Intelligence
Tweet on DEV-0401, DEV-0234 exploiting Confluence RCE CVE-2022-26134
Kinsing Mirai Cobalt Strike Lilac Typhoon
2022-06-02 ⋅ Twitter (@sysopfb) ⋅ Jason Reaves
Tweets on UpdateAgent - GolangVersion
UpdateAgent
2022-05-08 ⋅ Twitter (@malmoeb) ⋅ Stephan Berger
Twitter Thread on popularity and detection of r77
r77
2022-05-08 ⋅ Twitter (@CraigHRowland) ⋅ Craig Rowland
Twitter Thread with description of functionality for BPFDoor
BPFDoor
2022-05-08 ⋅ Twitter (@cyb3rops) ⋅ Florian Roth
Tweet on source code for BPFDoor found on VT
BPFDoor
2022-05-06 ⋅ Twitter (@MsftSecIntel) ⋅ Microsoft Security Intelligence
Twitter Thread on initial infeciton of SocGholish/ FAKEUPDATES campaigns lead to BLISTER Loader, CobaltStrike, Lockbit and followed by Hands On Keyboard activity
FAKEUPDATES Blister Cobalt Strike LockBit
2022-05-04 ⋅ Twitter (@felixw3000) ⋅ Felix
Twitter Thread with info on infection chain with IcedId, Cobalt Strike, and Hidden VNC.
Cobalt Strike IcedID PhotoLoader
2022-05-04 ⋅ Twitter (@ESETresearch) ⋅ Twitter (@ESETresearch)
Twitter thread on code similarity analysis, focussing on IsaacWiper and recent Cluster25 publication
IsaacWiper
2022-04-28 ⋅ Twitter (@vinopaljiri) ⋅ Jiří Vinopal
#ONYX Ransomware is based on #Chaos Ransomware Builderv4
Chaos
2022-04-28 ⋅ vx-underground ⋅ Twitter (@vxunderground)
Tweet on leaked Prynt Stealer source code and similarity to AyncRAT
AsyncRAT Prynt Stealer
2022-04-19 ⋅ Twitter (@Cryptolaemus1) ⋅ Cryptolaemus
#Emotet Update: 64 bit upgrade of Epoch 5
Emotet
2022-04-14 ⋅ Twitter (@silascutler) ⋅ Silas Cutler
Tweet on sample discovery for potential INCONTROLLER
INCONTROLLER
2022-04-12 ⋅ Twitter (@silascutler) ⋅ Silas Cutler
Tweet on analysis of CADDYWIPER used alongside with INDUSTROYER2
CaddyWiper INDUSTROYER2
2022-04-12 ⋅ Twitter (@apt773) ⋅ Section 773
Tween on Lapsus$ (UNC3661) Attack chain of compromise via Sitel (Okta subprocessor)'s systems
2022-04-11 ⋅ Twitter (@3xp0rtblog) ⋅ 3xp0rt
Tweet on Safire Miner
2022-04-07 ⋅ Twitter (@ChicagoCyber) ⋅ Joshua Miller
Tweet on TA455 (Iranian threat actor) IoCs
2022-04-01 ⋅ Twitter (@3xp0rtblog) ⋅ 3xp0rt
Tweet on 000stealer, written in GO and its panel
000Stealer
2022-03-31 ⋅ Twitter (@3xp0rtblog) ⋅ 3xp0rt
Tweet on Eternity stealer
Eternity Stealer