Empowering you to take on today's toughest threats.
Joined January 2022
- Tweets405
- Following111
- Followers2.8K
- Likes278
Pinned Tweet
Learn how to reverse engineer malware: training.invokere.com/course…
YouTube: youtube.com/@InvokeReversing
Twitch: twitch.tv/invokereversing
Mastodon: infosec.exchange/@invokereve…
GitHub: github.com/invoke-re
Come hang out for some Rust reversing in IDA. Potentially a new loader? 🕵️♂️ twitch.tv/InvokeReversing
We're also seeing fake "RDP OfficeX Manager" and "PLClean Master" as a part of the same campaign. IOCs (including 2FA apps):
052a2258a185f4c858326ff1a5754b2c4c2bf680c12ebf30a3c2b2b9c1af8f68
0bcf272d8f22fa30d327d7c0233b7eae7d50df1ebd95472aae59aef19c8e23bf
1b2432c99b877ac71a37d505ca7165f8d46cb4fc9a98762d54c529c7aef26d71
73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed
e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3
C2s:
get[.]calo44[.]net
ftp[.]mawar180[.]org
pub[.]futsalbandung[.]org
Analysts @HuntressLabs have been seeing an uptick of malicious MFA apps from the Microsoft Store the last few days. In some cases, they're being delivered via tech support scams through Teams, in others via malvertizing.
We've been digging into it, and hopefully we'll have more info soon.
We've uploaded our live stream from late September where we explored Detection Engineering with Yara using Assemblyline, CAPEv2, bindiff and mquery. We go over packer detection, unpacked file detection and writing dependable rules that will outlast changes by the malware author and recompilations. Enjoy!
Invoke RE retweeted
It was an honour to speak with Pablo on the debut episode of the Polo Cyber podcast. We spoke about my early beginnings, career, reverse engineering, malware analysis and Invoke RE. Hope you enjoy it!
New Polo Cyber YouTube channel is up! First video with @InvokeReversing founder and former colleague of mine @JershMagersh
youtu.be/g9MIGhR318k
Invoke RE retweeted
New Polo Cyber YouTube channel is up! First video with @InvokeReversing founder and former colleague of mine @JershMagersh
youtu.be/g9MIGhR318k
We are now seeing version 4.3.8-alpha2 of ACRStealer: 64773e9b66825e3e3d653b730f2994eac6635d8166707d076371bb2ff2f7f434
C2: sync[.]canyonmere[.]cc
Botnet: f1575b64-8492-4e8b-b102-4d26e8c70371
🦠ACRStealer remains under active development, with new versions appearing almost weekly. The latest variant by identified by ThreatLabz is 4.3.7-alpha2.
IOCS are listed below.
SHA256 hash:
769d06b54576c6beab2d33c7d4c05b679156c051652a843d6cc61de2cc9c58f9
CNCs:
https://stream[.]echovale[.]cc
https://145[.]249.109.147
DDR: https://telegra[.]ph/C-Introduction-08-21
Come hang out while we do some detection engineering with Yara! twitch.tv/InvokeReversing
Join us at 1PM EST today for a special Friday stream on detection engineering! twitch.tv/InvokeReversing
Join us at 2PM EST today to look at a mystery Golang sample pulling a BYOVD driver from GitHub 🕵️♂️ twitch.tv/invokereversing
Check out our new blog on breaking Efimer's infection chain with Frida: invokere.com/posts/2026/09/b… it includes details of follow-on payloads, using a known plaintext attack, a full extractor and detection rules.
Invoke RE retweeted
Part of Recon 2026 video have been released recon.cx/2027/en/index.html on our youtube channel youtube.com/@reconmtl we are still waiting for confirmation from our speakers to release the rest.
