ImPureMotion (@ImPureMotion) header
ImPureMotion (@ImPureMotion) profile picture

ImPureMotion

@ImPureMotion

The Cyberz

Joined February 2015
  • Tweets110
  • Following621
  • Followers195
29Media
Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)
HTML Smuggling Leads to Domain Wide Ransomware ➡️Initial Access: Thread-Hijacked Email > HTML Attachment ➡️Credentials: LSASS Access, SessionGopher ➡️Lateral Movement: RDP, PsExec ➡️C2: IcedID, Cobalt Strike ➡️Impact: Nokoyawa Ransomware thedfirreport.com/2023/08/28… 1/X
HTML Smuggling Leads to Domain Wide Ransomware - The DFIR Report

HTML Smuggling Leads to Domain Wide Ransomware - The DFIR Report

We’ve previously reported on a Nokoyawa ransomware case in which the initial access was via an Excel macro and IcedID malware. This case, which also ended in Nokoyawa Ransomware, involved the threat...

thedfirreport.com
5
161
5
369
97,022
Operation JOKAA(RR) #molerats #gazacybergang #apt #malware #infosec mymalwareparty.blogspot.com/…
Image from MalwareParty (@MalwareParty)
2
13
2
23
Iranian #Oilrig campaign decoy: "User list must change password.xls", target in Saudi Arabia. C2: coldflys[.]com Further analysis: docs.google.com/document/d/1… Leads and analysis with @ImPureMotion and @blu3_team
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
9
13
#AridViper uses pastes on pastebin.com/u/virtualnote for second stage scripts delivery Recent sample: محضر اجتماع اليوم - (Minutes of today 's meeting) Details and Indicators in Raw Threat Intelligence: docs.google.com/document/d/1… Credit @ImPureMotion
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
10
16
First blog post... taking a stab at it, had some fun with the logo mymalwareparty.blogspot.com/… #malware #molerats #infosec #cybersecurity
Image from MalwareParty (@MalwareParty)
4
1
4
Tweak your sandbox to make it harder for malware to detect that it's being analyzed - Cheat sheet PDF by @fr0gger_: unprotect.tdgt.org/images/2/…
4
190
5
316
North Korea Is Not Crazy bit.ly/2sCISHa #ThreatIntel
8
2
9
#Lazarus #APT Group (#Bureau121 #SilentChollima) behind Op. Troy #DarkSeoul #SonyHack #SWIFThack revealed @Group-IB blog.group-ib.com/lazarus
Image from Paul Hutchinson (@AllAboutAPT)
2
3
ImPureMotion retweeted
Elon Musk (@elonmusk) profile picture
Elon Musk
@elonmusk16 May 2017
Moonlight Sonata instagram.com/p/BUK6BQnBNuK/
193
792
102
3,651
#RIgEK New URI Pattern and spelling is interesting... "wendsday" IP : 69.61.66[.]226 Notable: wendsday= policy= ct= q=
5
7
All ransomware which detects it is running on a Russian system is Locky. No other ransomware does this.
Image from RansomwareConspiracy (@ransomspiracy)
2
19
24
Cyber Attack Impersonating Identity of Indian Think Tank to Target CBI and Possibly Indian Army Officials cysinfo.com/cyber-attack-tar…
Cyber Attack Impersonating Identity of Indian Think Tank to Target Central Bureau of Investigation...

Cyber Attack Impersonating Identity of Indian Think Tank to Target Central Bureau of Investigation...

In my previous blog posts I posted details of cyber attacks targeting Indian Ministry of External Affairs and Indian Navy’s Warship and Submarine Manufacturer. This blog post describes another attack...

cysinfo.com
8
10
Targeted attack against the Ukrainian military | Nioguard Blog nioguard.blogspot.de/2017/05…
16
15
APT3 is Boyusec, an MSS contractor #boyusec #mss #apt #apt3 #gothicpanda #buckeye… intrusiontruth.wordpress.com…
Image from Intrusion Truth (@intrusion_truth)
10
8
Greenbug’s DNS-isms #Shamoon > Is your Threat Intel / IOC / IDS env ready for IPv6 addresses? arbornetworks.com/blog/asert…
Image from Florian Roth ⚡️ (@cyb3rops)
1
10
20
ImPureMotion retweeted
SpaceX (@SpaceX) profile picture
SpaceX
@SpaceX1 May 2017
Split screen shot of Falcon 9 first stage as it returns to Earth and lands at Landing Zone 1.
324
6,196
716
15,462
ImPureMotion retweeted
Unit 42 (@Unit42_Intel) profile picture
Unit 42@Unit42_Intel5 Apr 2017
#Unit42 uncovers targeted attacks in the Middle East using KASPERAGENT & MICROPSIA bit.ly/2nDI3XN
20
10
ImPureMotion retweeted
Seongsu Park (@unpacker) profile picture
Seongsu Park
@unpacker4 Apr 2017
RedLeaves - Malware Based on Open Source RAT blog.jpcert.or.jp/2017/04/re…
2
1
5
ImPureMotion retweeted
Kaspersky (@kaspersky) profile picture
Kaspersky
@kaspersky3 Apr 2017
A look under the hood of the #Lazarus group. via @Securelist #theSAS2017 kas.pr/4PZv
Image from Kaspersky (@kaspersky)
25
2
24
ImPureMotion retweeted
Eyal Sela (@eyalsela) profile picture
Eyal Sela
@eyalsela1 Apr 2017
Jerusalem Post and other Israeli websites compromised by Iranian threat agent CopyKitten, clearskysec.com/copykitten-j…
Image from Eyal Sela (@eyalsela)
29
2
16
Load more