#Cybercrime #CTI #OSINT #Cybersecurity https://xitter.cf/t.co/b3uWuDBEVs
France
Joined November 2023
- Tweets221
- Following534
- Followers882
- Likes774
Oleg retweeted
The Kremlin’s cognitive warfare is evolving. Leaked documents from Russia’s Social Design Agency reveal efforts to move beyond planting fabricated stories on social media. Now Russian influence operators are trying to create Wikipedia clones and fake think tanks to shape the information powering search engines and AI chatbots. bloomberg.com/news/features/…
Oleg retweeted
DOJ charged two men over “AudiA6,” an alleged crypto laundering service tied to $389M+ in transactions since 2021. The international takedown hit servers, domains, Telegram accounts, crypto assets, and Dark2Web/AudiA6 sites.
justice.gov/usao-edpa/pr/two…
justice.gov/usao-edpa/media/…
#AudiA6 #Dark2Web #cybercrime
Oleg retweeted
Proud to be the first high school student in the world to ever be sanctioned by an authoritarian regime for uncovering corruption. It just proves that the work I’ve done to expose Russias sanctions evasion stablecoin, A7A5, has touched a raw nerve.
thetimes.com/world/russia-uk…
Oleg retweeted
🤓 Very interesting Incident Response case by Gambit Security where analysts uncovered a threat actor leveraging Claude Code and OpenAI api to breach the Mexico government infrastructure.
I really appreciate the level of details in the report, especially around the Indicators of Prompt Compromise (IoPC).
I extracted most of the prompts (IoPC) used in this attack and I published them into PromptIntel with the ref "MX-GOV-AI-BREACH", so you can understand the risk and take the next step to detect suspicious patterns in your environment.
promptintel.novahunting.ai/f…
Oleg retweeted
Lazarus Group stole $7B in crypto then got caught on camera at some random football match in Russia waving North Korean flags on live TV😂.
Founders, is your lead dev doxxed in there? Might wanna check 👀
TLDR: DPRK ITWs got caught via OSINT after partying in Laos on New Years a few years back by Chollima Group
Source: chollima-group.io/posts/trac…
Oleg retweeted
Mastermind Behind REvil and GandCrab Revealed: Daniil Shchukin (“UNKN”)
krebsonsecurity.com/2026/04/…
Oleg retweeted
Footage of the detention of the administrator of LeakBase forum in Taganrog, Rostov Region, Russia 🇷🇺. Via MVD representatives
Report: "According to available information, the platform hosted hundreds of millions of user accounts, bank details, logins and passwords, as well as corporate documents obtained as a result of hacking. Over 147 thousand users registered on the forum could buy and sell this data, as well as use it to commit fraudulent actions against citizens.
During the search at the detainee's residence, technical equipment and other items of evidentiary significance were seized.
A criminal case has been initiated by the investigator of the Main Investigative Department of the Ministry of Internal Affairs of Russia in Moscow on the grounds of crimes provided for in parts three and six of Article 272.1 of the Criminal Code of the Russian Federation. A preventive measure in the form of detention has been chosen against the defendant."
Oleg retweeted
My blog is now live: "The Close Relationship Between Telegram Bots and Threat Actors"
new stealers, their log structures, telegram bot C2 infrastructure, and threat actors who hacked themselves while building their own
👉 cti.monster/blog/2026/03/24/…
happy hunting!
Oleg retweeted
The Gentlemen is a newly emerged Ransomware-as-a-Service (RaaS) operation consisting of approximately 20 members. Originating from a #Qilin payment dispute, the operator "hastalamuerte" had already developed a locker while still an affiliate. Their primary initial access? A database of ~14,700 compromised FortiGate devices (CVE-2024-55591) and over 900 brute-forced VPN credentials ready for deployment. #Ransomware #DFIR
Oleg retweeted
Telegram fights back in Russia: "Telegram proxies are currently launching a counter-attack against Roskomnadzor’s (RKN) censorship infrastructure, flooding its filters with junk data and overloading them to a critical state. As a result, not only is Telegram suffering, but so is a host of other services—including those the authorities had intended to leave alone.
Consequently, service disruptions are being observed nationwide, even affecting platforms that were never targeted for blocking—such as websites on RKN’s "whitelist," certain government services, and occasionally even VKontakte.
An interesting side effect has emerged: in several regions, WhatsApp (specifically voice and video calls) has suddenly sprung back to life. This occurred because the TSPU (Technical Means of Countering Threats) system temporarily "eased up" on certain filters in an attempt to cope—however imperfectly—with the massive primary load generated by Telegram.
This is currently one of the most widely discussed instances of "technical trolling" directed at RKN in recent years.
I have a feeling that Durov’s team is going to make life very difficult for RKN in the future—especially when comparing the skill levels and salaries of Durov’s programmers against those of RKN’s mediocre coders, who are scraping by on peanuts. (After all, the truly talented programmers have either emigrated or are working for private companies.) t.me/borisenkoD/33677
Oleg retweeted
LEAKED: Chucky's private cloud wiped and dumped — 4TB, 10,000+ files exposed
forum.duty-free.cc/threads/6…
@RussianPanda9xx @sky31337
#leak #dataleak #leaked #chucky #leakbase
Oleg retweeted
As part of the SYS initiative, @PRODAFT is notifying users affected by the RAMP forum database leak. Threat actors are being encouraged to assist with the de-anonymization of some of the most active cybercriminals and ransomware operators — developments that are expected to make headlines. Choose a better path for yourself.
xitter.cf/PRODAFT/status/2019928…
RAMP Forum User Intelligence Available for Our Platform (U.S.T.A. & Catalyst) Members
🫶Our SYS initiative remains highly active, as a well-known forum member voluntarily contacted us. We are grateful for their contribution. Even when admins attempt to dox each other for 10 BTC, it's good to see some members doing it voluntarily for us.
🔍As a result, our team has acquired intelligence associated with 7,709 RAMP forum users, including the following high-value investigative datasets:
📧Private messages exchanged between threat actors, enabling reconstruction of operational planning and coordination;
👾Attachments sent and received between threat actors, supporting malware, tooling, and infrastructure attribution;
🔐Authentication and login activity, facilitating access-pattern analysis and operational security assessment;
🌌Forum search history, providing insight into intent, targeting, and operational focus;
🧐Profile information, including but not limited to registered email addresses, supporting identity correlation and cross-platform attribution;
🗣️Chat room and group communication metadata, indicating collaboration structures and coordinated activity across specific operations and campaigns.
We will be correlating these datasets to support and advance multiple previously unsolved investigations.
#cyberintelligence #ramp #LockBitSupp <3
Oleg retweeted
What happens when stolen credit card data is sold like a service? 💳
Dump shops have evolved into carding-as-a-service (CaaS) marketplaces bundling stolen card data, tools, and support.
A new blog explores how these illegal marketplaces operate: r-7.co/4bX0oet
Oleg retweeted
RAMP Forum User Intelligence Available for Our Platform (U.S.T.A. & Catalyst) Members
🫶Our SYS initiative remains highly active, as a well-known forum member voluntarily contacted us. We are grateful for their contribution. Even when admins attempt to dox each other for 10 BTC, it's good to see some members doing it voluntarily for us.
🔍As a result, our team has acquired intelligence associated with 7,709 RAMP forum users, including the following high-value investigative datasets:
📧Private messages exchanged between threat actors, enabling reconstruction of operational planning and coordination;
👾Attachments sent and received between threat actors, supporting malware, tooling, and infrastructure attribution;
🔐Authentication and login activity, facilitating access-pattern analysis and operational security assessment;
🌌Forum search history, providing insight into intent, targeting, and operational focus;
🧐Profile information, including but not limited to registered email addresses, supporting identity correlation and cross-platform attribution;
🗣️Chat room and group communication metadata, indicating collaboration structures and coordinated activity across specific operations and campaigns.
We will be correlating these datasets to support and advance multiple previously unsolved investigations.
#cyberintelligence #ramp #LockBitSupp <3
Oleg retweeted
New Blog! Analysing Carding Infrastructure 💳💰
team-cymru.com/post/analysin…
Oleg retweeted
Sharing indicators with the boys!
This blog is definitely a solid write up!
medium.com/@0xOZ/how-to-get-…
The C2 indicator shared is interesting because it sets the c2 on standard port of MongoDB. In the comments I will share 6 IPs that are serving as a C2 as of today!
Oleg retweeted
🇷🇺 FSB-linked APT based in Crimea launched a wiper attack 👀
A new wiper attack has been identified by ClearSky Cyber Security affecting Ukraine.
We named this wiper "GamaWiper" (VBS-based wiper).
The intrusion chain begins with the exploitation of a vulnerable WinRAR version (CVE-2025-80880). We assess with moderate confidence that this activity is linked to the Gamaredon APT group.
This marks the first observed instance of Gamaredon conducting destructive operations rather than its traditional espionage activities.
Related IoCs:
95262c4094a9a5e589a218e354ef54b3800aa0abc3b6a343bbcfdcbf021fc04f – initial ZIP with vulnerability CVE-2025-80880
68e21d7599d20444232415a7e74214ce50d7b4643215d83b8320e74c95a9dfd3 – downloaded VBA
aafa4c206495163a5e408aa5c296139fe9f330a9f819a226c6934921493de9c6 – downloaded (padded+base64) wiper
d4ce4776bdad9b741a1e8345b41737245b80f4cf8d361ebb1ae5415c7a4fe1eb – base64 encrypted wiper
9a39423ec90dc06a3058279cd744c08d83252d1c7096633b9853e435cc205755 – deobfuscated wiper
Network:
dears[.]serveirc[.]com
whitesalad[.]zzrak08526[.]workers[.]dev
Oleg retweeted
Our new Insikt Group research exposes how German hosting provider aurologic GmbH has become a central hub for high-risk networks.
It’s a revealing look at the tension between neutrality and accountability in the global hosting ecosystem. 👇
bit.ly/4qG2MLj
#threatintelligence #cybersecurity
Oleg retweeted
Discord se fait racketer suite à la compromission de leur instance Zendesk, on parle de 2.1 millions de pièces d'identité subtilisées grâce aux gros génies qui imposent la vérification d'identité.
Que l'on arrête cette folie maintenant.
