@FaLconIntel
Joined January 2020
  • Tweets207
  • Following12
  • Followers461
134Media
FaLcon Intelligence retweeted
DirectoryRanger@DirectoryRanger26 Sep 2021
Post Compromise Active Directory Checklist pwndefend.com/2021/09/15/pos…
2
79
2
203
FaLcon Intelligence retweeted
BleepingComputer
@BleepinComputer24 Sep 2021
Exploit code released for three iOS 0-days that Apple failed to patch - @serghei bleepingcomputer.com/news/se…

Researcher drops three iOS zero-days that Apple refused to fix

Proof-of-concept exploit code for three iOS zero-day vulnerabilities (and a fourth one patched in July) was published on GitHub after Apple delayed patching and failed to credit the researcher.

bleepingcomputer.com
4
124
12
263
FaLcon Intelligence retweeted
Max_Malyutin@Max_Mal_13 Sep 2021
#MSHTML RCE Vulnerability #CVE-2021-40444 (#CVE202140444) #DFIR #BlueTeam - Not only Control - CPL‼️ Potentially the exploit could run: #LOLBins 🔥🔥🔥🔥 MSHTA - HTA ✅ WSCRIPT - JS, JSE, VBA, WSF...✅ JAVAW - JAR ✅ MSIEXEC - MSI ✅ RegEdit - REG ✅ And MORE (?)
10
132
8
316
FaLcon Intelligence retweeted
Jakub Kroustek
@JakubKroustek9 Sep 2021
#Sodinokibi / #REvil #ransomware is back and not just their sites. The latest variant from today: virustotal.com/gui/file/ab0a…
1
60
15
138
FaLcon Intelligence retweeted
BleepingComputer
@BleepinComputer9 Sep 2021
Windows CVE-2021-40444 defenses bypassed as new info emerges - @LawrenceAbrams bleepingcomputer.com/news/mi…

Windows MSHTML zero-day defenses bypassed as new info emerges

New details have emerged about the recent Windows CVE-2021-40444 zero-day vulnerability, how it is being exploited in attacks, and the threat actor's ultimate goal of taking over corporate networks.

bleepingcomputer.com
1
117
8
223
FaLcon Intelligence retweeted
Max_Malyutin@Max_Mal_9 Sep 2021
#MSHTML RCE Vulnerability #CVE-2021-40444 #DFIR How to find mhtml object: 1) Unzip the MalDoc 2) Navigate to *\word\_rels\* 3) open document.xml.rels 4) Screech for: Target="mhtml: Sample: bazaar.abuse.ch/sample/d0e1f…
4
51
2
146
FaLcon Intelligence retweeted
Gen Threat Labs
@GenThreatLabs7 Sep 2021
We’ve found #UnderminerEK has the following modules and can exploit a whopping 11 different vulnerabilities including #PrintNightmare.
nao_sec@nao_sec7 Sep 2021
#UnderminerEK is back! Now dropping #Amadey (CC: @malware_traffic, @jeromesegura) tria.ge/210907-pfppgsfgbq/be…
1
17
37
FaLcon Intelligence retweeted
RIVER@wugeej18 Aug 2021
Fortinet FortiWeb OS Command Injection [‼️0-day] [PoC] POST /api/v2.0/user/remoteserver.saml HTTP/1.1 ... ... Content-Disposition: form-data; name="name" `touch /tmp/vulnerable` rapid7.com/blog/post/2021/08…
17
548
34
1,206
FaLcon Intelligence retweeted
Florian Roth ⚡️
@cyb3rops10 Jul 2021
A #PrinterNightmare overview borncity.com/win/2021/07/08/…
4
67
1
303
FaLcon Intelligence retweeted
Virus Bulletin@virusbtn30 Jun 2021
Proofpoint reports an increase in malicious use of Cobalt Strike in threat actor campaigns. Cobalt Strike is currently used by more cybercrime and general commodity malware operators than APT and espionage threat actors. proofpoint.com/us/blog/threa…
7
17
FaLcon Intelligence retweeted
Analysis Center@jpcert_ac1 Jul 2021
ラッキービジター詐欺で不正サイトへのリダイレクトに悪用されるドメインを掲載するレポジトリを公開しました。新しい不正ドメインが観測された際は、こちらに掲載されますので、ご活用ください。 ^ST github.com/JPCERTCC/Lucky-Vi…

GitHub - JPCERTCC/Lucky-Visitor-Scam-IoC: Automatically update IoC for lucky visitor scam

Automatically update IoC for lucky visitor scam. Contribute to JPCERTCC/Lucky-Visitor-Scam-IoC development by creating an account on GitHub.

github.com
1
48
5
72
FaLcon Intelligence retweeted
nao_sec@nao_sec18 Feb 2021
New blog post! #nccTrojan is a RAT used by #TA428 in attacks targeting East Asian defense and aviation organizations. Please see the analysis result of nccTrojan v1 and v2😆 insight-jp.nttsecurity.com/p…
1
28
1
50
FaLcon Intelligence retweeted
nao_sec@nao_sec29 Dec 2020
#PurpleFox Exploit Kit -> #PhantomNugget app.any.run/tasks/ba193e96-d…
12
31
FaLcon Intelligence retweeted
nao_sec@nao_sec5 Dec 2020
Recent #Malsmoke Campaign -> MSI -> #Zloader app.any.run/tasks/9b9d698c-e… (ref: blog.malwarebytes.com/threat…)
1
12
20
FaLcon Intelligence retweeted
nao_sec@nao_sec22 Nov 2020
#PurpleFox Exploit Kit -> #PhantomNugget app.any.run/tasks/48756484-1…
1
10
22
FaLcon Intelligence retweeted
JPCERT/CC@jpcert_en16 Nov 2020
New Blog Post: ELF_PLEAD - Linux Malware Used by BlackTech ^YU blogs.jpcert.or.jp/en/2020/1…

ELF_PLEAD - Linux Malware Used by BlackTech - JPCERT/CC Eyes

In a past article, we introduced Linux malware ELF_TSCookie, which is used by an attack group BlackTech. This group also uses other kinds of malware that affects Linux OS. PLEAD module for Windows...

blogs.jpcert.or.jp
15
2
39
JPCERT/CC Eyes「攻撃グループBlackTechが使用するLinux版マルウェア（ELF_PLEAD）」を公開。BlackTechが使用するWindows版マルウェア「PLEADモジュール」とLinux版マルウェア「ELF_PLEAD」を比較しながら、ELF_PLEADの特徴を紹介しています。^MM blogs.jpcert.or.jp/ja/2020/1…

攻撃グループBlackTechが使用するLinux版マルウェア（ELF_PLEAD） - JPCERT/CC Eyes

以前のJPCERT/CC Eyesで攻撃グループBlackTechが使用するLi...

blogs.jpcert.or.jp
31
2
58
FaLcon Intelligence retweeted
Analysis Center@jpcert_ac10 Nov 2020
攻撃グループBlackTechは、Linux OSをターゲットにしたマルウェアを複数使用することを確認しています。今回はELF_PLEADの分析結果を公開しました。 ^ST blogs.jpcert.or.jp/ja/2020/1…

攻撃グループBlackTechが使用するLinux版マルウェア（ELF_PLEAD） - JPCERT/CC Eyes

以前のJPCERT/CC Eyesで攻撃グループBlackTechが使用するLi...

blogs.jpcert.or.jp
36
3
75
FaLcon Intelligence retweeted
nao_sec@nao_sec1 Nov 2020
#PseudoGate -> #FalloutEK -> #SmokeLoader -> #Zloader app.any.run/tasks/414bef9b-b… bazaar.abuse.ch/sample/d7387…
3
8
29
FaLcon Intelligence retweeted
JPCERT/CC@jpcert_en30 Oct 2020
New Blog Post: LogonTracer v1.5 Released ^YU blogs.jpcert.or.jp/en/2020/1…

LogonTracer v1.5 Released - JPCERT/CC Eyes

JPCERT/CC has released LogonTracer v1.5, the latest version of the event log analysis tool. While this tool was initially focused on post-incident investigation, we have received many requests for...

blogs.jpcert.or.jp
1
23
2
37
Load more