William MacArthur

In an era of sophisticated ⚠️ cyber-attacks, 📝 documenting attack sequences is crucial for proactive🛡️ prevention. 🔗 Read our blog by @anti_Expl0it for a view on threat sequencing and its significance ➡️ hubs.ly/Q02bFstM0 #ThreatSequencing #ThreatIntel #Cybersecurity

InQuest and @Threatlabz have analyzed #MysticStealer, a new malware family that extracts data from various sources, including web browsers and cryptocurrency wallets, through its obfuscation techniques ➡️ bit.ly/3N7IHe1 #Malware #CyberSecurity #Cryptocurrency

The holidays are here. Be careful what gifts you open! inquest.net/blog/2022/12/14/… #ransomware #threatintel

📌 Watch our intro video, access our open research portal: labs.inquest.net Follow our Blog: inquest.net/blog See our open-source work: github.com/InQuest Connect on LinkedIn: linkedin.com/company/inquest……… Tweets with 🤖 are InQuest Labs automation.

Some field notes on an active and successful Phishing campaign that leverages a low-detection document-based lure, to pivot through various hosting providers. Samples, IOCs, and more: inquest-labs.notion.site/202… #phishing #malware #malwareanalysis

We've just added a notion of "collections" to the file corpus (DFI) of labs.inquest.net. Included today are files from InQuest Macro Clustering (~10k), the Enron leak (~16k), and those from the dataset used in the "Invoice #31415 attached" research paper (~15k).

Looks like #Qbot is back in action. Green Lure seen at least, where is the blue :P labs.inquest.net/dfi/sha256/… 5.254.118.]198 91.194.11.]15 146.70.87.]163 @James_inthe_box @Cryptolaemus1 @Anti_Expl0it @Autow00t

Low scoring #maldoc using @OhioHealth, protected file in the lure. labs.inquest.net/dfi/sha256/… @Anti_Expl0it @James_inthe_box @executemalware

As a follow up to the previous graphic outlining threats affecting #Ukraine, here is a high level blog on observed threats. Big thanks to the #infosec community for making this possible, #SlavaUkraini @Anti_Expl0it @Autow00t @juanandres_gs @flakpaket inquest.net/blog/2022/04/07/…

Interesting Doughnut 0 VT Score for a "Test?" Doc leading to #Metasploit labs.inquest.net/dfi/sha256/… FYI: We heard some others seeing some waves of this week. @James_inthe_box @Anti_Expl0it @executemalware @Autow00t

#Hancitor run looks like using Efax Lure - Password is 44 labs.inquest.net/dfi/sha256/… @James_inthe_box @Anti_Expl0it @Cryptolaemus1

An update our previous graphic we shared on the cyber-front of the #ukraine conflict. This content was collected from various sources and collaborations within the #infosec community. Special thanks to all involved. @Anti_Expl0it @Autow00t @juanandres_gs @flakpaket

We are sharing this visual for tracking threat actors/groups related to the current #ukraine conflict. The content was collected from various sources within the #infosec community. Special thanks to all involved. @Anti_Expl0it @Autow00t @juanandres_gs

This is an odd one here with extreme uri length + directory traversal flavor a+ .dotm file suffix. AS37963 - ALIBABA (US) TECHNOLOGY. Note labs.inquest.net/dfi/sha256/… @James_inthe_box @JRoosen @Anti_Expl0it @dms1899

Seeing a lot of low score #Dridex docs right now... lots of various lures again. labs.inquest.net/dfi/sha256/… @JRoosen @Anti_Expl0it @James_inthe_box @Autow00t