@Intrinsec

Notre métier ? Protéger le vôtre ! Management des risques, Évaluation, Cyber Threat Intelligence, Détection, Réponse (CERT), Innovation.

 Courbevoie, France
intrinsec.com
Joined March 2013
  • Tweets1K
  • Following103
  • Followers2.5K
363Media
BitLocker corrigé… mais un vieux boot manager vulnérable suffit encore à le contourner.. On explique comment une downgrade attack fait tomber BitLocker en quelques minutes et comment s’en prémunir ! 👉 intrinsec.com/contournement-… #BitLocker #SecureBoot #Windows #Cybersecurity
1
5
321
🪜 Vidar climbs to #1 stealer after Lumma & Rhadamanthys takedowns ! New version + Telegram collab, kill-chain via fake software, dead drops... Our CTI analysis breaks it all down. 👇 intrinsec.com/chaos-is-a-lad… #InfoStealers #threatintel
2
253
New hands-on article: Detect REDSUN LPE in Microsoft Defender on Windows, even with incomplete telemetry. Focuses on native artifacts (Defender logs, filesystem, Prefetch). No public exploits needed ! 👉Full article : tinyurl.com/4w44chvn
6
17
1,644
🔒 Webinar | Panorama de la menace cyber 2025 L’équipe Cyber Threat Intelligence d’Intrinsec décrypte les faits marquants de 2025 : ransomware, hacktivisme, IA générative, écosystème cybercriminel… Lien d'inscription : shorturl.at/AGC2k
3
402
🚨 New Cyber Threat Alert for Russian #Aerospace Sector! 🚨 Intrinsec’s report uncovers #spearphishing & #malware campaigns targeting Russian aerospace & supply chains #hacktivist groups linked to 🇺🇦, using credential phishing & custom malware. Read more: lnkd.in/ej_WKjB9
1
3
450
Administrative features and attackers may become best friends... Learn how attackers use GPO and filters to compromise their target assets, hiding the threat behind legitimate features : intrinsec.com/hide-the-threa… #Redteam #CyberSecurity
1
5
272
🔐 Une nouvelle attaque simple et rapide contourne le chiffrement Bitlocker par défaut, bien plus accessible que le TPM sniffing. Activez un PIN et protégez vos données. 👉 On vous explique tout : intrinsec.com/contournement-…

Contournement Bitlocker : une alternative plus simple au TPM sniffing

Découvrez comment le contournement Bitlocker peut exposer vos données. Est-ce que le chiffrement est vraiment suffisant ?

intrinsec.com
2
4
230
When you think there’s a new APT in town... Relax, it’s just our Red Team doing their thing (thanks to @Defte_ technique)😅 Want to improve your detections or challenge your team? Contact us!
Expel@ExpelSecurity8 Oct 2025
⚠️ Our threat intel team just caught attackers using a clever new trick to bypass security tools: cache smuggling. Instead of downloading malware, they hide it in fake images that browsers automatically cache. Then PowerShell extracts and runs it—no web requests needed.
2
19
1
163
25,648
Replying to @banthisguy9349 @Max_Mal_ @JAMESWT_MHT @abuse_ch @RussianPanda9xx @1ZRR4H @malwrhunterteam @spamhaus @R3dHash @stdal_ @ncaproni @Gi7w0rm
Hi @banthisguy9349 👋 It is not our practice not to mention the people who helped with the writing in our reports. Can you be more specific about which cases you are referring to?
1
1
289
🧵9/📕Our report: intrinsec.com/from-espionage… #CyberWar #ThreatIntel #APT
1
1
689
🧵8/ cc🔍 @Max_Mal_ @JAMESWT_MHT @abuse_ch @RussianPanda9xx @1ZRR4H @malwrhunterteam @spamhaus @R3dHash @stdal_ @ncaproni @banthisguy9349 @Gi7w0rm
2
1
3
823
🧵7/🧩 The full picture: A vast network of Russian-aligned intrusion sets leveraging global bulletproof hosting, fake shell corps, and recycled ransomware infrastructure to target Ukraine & its allies on multiple fronts. 📉 Espionage 💣 PsyOps 🪓 Ransomware #UAC0050 #UAC0006
1
1
1
370
🧵6/🇺🇸 The U.S. Treasury sanctioned Zservers(Seychelles 🇸🇨 BPH provider) for aiding #LockBit. Same 2 officers are listed as managing this newer infra too. 🔀 IPv4 prefixes from Zservers were moved to new Russia-based or offshore networks: #AS213194 #AS61336 #AS213010
1
1
1
466
🧵5/📌 IPs from 4vps.su have been previously used by ransomware groups like: #BlackBast🦹‍♂️ #Cactus🌵 #RansomHub 🏴 👁 Impressive overlap between PsOps, espionage and ransomware infrastructure.
1
1
2
417
🧵4/ For #UAC0006: 🌐 IPs from Global Connectivity Solutions LLP (AS215540 - UK) routed through Stark Industries (AS44477) ⬅️ May be tied to 🇷🇺 Global Internet Solutions LLC (AS207713) Both serve as legal fronts for bulletproof hoster 4vps[.]su 🛡️
1
1
3
462
🧵3/ Since Jan 2025, #UAC0050 adopted NetSupport Manager for malware delivery. 🕵️‍♂️ Used Ukrainian IPs managed by: - Karina Rashkovska - Virtualine (AS215789 & AS214943) 🏢 Virtualine hosted infra via shell company Railnet LLC (in Kentucky 🇺🇸), linked to White Label Networks
1
3
1
778
🧵2/🧠 Psychological ops (#PsyOps) were key: 📩 Emails mimicking terrorist & bomb threats sent to 🇺🇦 and allies 🇨🇭🇩🇪🇵🇱🇫🇷 throughout Dec 2024. 🔎 Strong similarities with UAC-0050’s “Fire Cells Group” activities. #InfoOps #CyberThreats
1
1
2
511
🧵1/ In Jan & Feb 2025, both groups ramped up espionage & financially-motivated spam campaigns. 📌 Focus: global targets, but heavily centered on Ukraine. 🎯 Targets: - Govt entities - Defense, energy & gas sectors - Journalists - NGOs involved in the Ukraine war
1
1
1
573
🔎 [THREAD] – New analysis by Intrinsec Cyber Threat Intelligence on the latest operations by Russian-aligned intrusion sets #UAC0050 & #UAC0006📢 🔗 Our Report: intrinsec.com/wp-content/upl…
2
27
1
71
11,779
cc @R3dHash @stdal_ @ZohrBot @Jane_0sint @banthisguy9349 @Gi7w0rm @phish_report @AlexProdefence @ncaproni @Stalkphish_io
2
491
Load more