PhysicalDrive0 (@PhysicalDrive0) header
PhysicalDrive0 (@PhysicalDrive0) profile picture

PhysicalDrive0

@PhysicalDrive0

Malware Hunter / I've already taken the red pill!

 Down The Wrong Rabbit Hole
Joined November 2010
  • Tweets22.9K
  • Following916
  • Followers15.7K
422Media
Photo by PhysicalDrive0 (@PhysicalDrive0)Photo by PhysicalDrive0 (@PhysicalDrive0)Photo by PhysicalDrive0 (@PhysicalDrive0)Photo by PhysicalDrive0 (@PhysicalDrive0)Photo by PhysicalDrive0 (@PhysicalDrive0)Photo by PhysicalDrive0 (@PhysicalDrive0)Photo by PhysicalDrive0 (@PhysicalDrive0)Photo by PhysicalDrive0 (@PhysicalDrive0)Photo by PhysicalDrive0 (@PhysicalDrive0)Photo by PhysicalDrive0 (@PhysicalDrive0)
PhysicalDrive0 retweeted
Anton Ivanov (@antonivanovm) profile picture
Anton Ivanov@antonivanovm15 Apr 2019
We found one more #zeroday exploit that was used in APT. securelist.com/new-win32k-ze…
Image from Anton Ivanov (@antonivanovm)
3
189
6
364
PhysicalDrive0 retweeted
Ajax (@commial) profile picture
Ajax@commial8 Apr 2019
Now, Sibyl can be called from @GHIDRA_RE (github.com/cea-sec/Sibyl/pul…) or use it headless for function address discovering (github.com/cea-sec/Sibyl/pul…) :)
Image from Ajax (@commial)
Image from Ajax (@commial)
4
57
117
PhysicalDrive0 retweeted
Souhail Hammou (@Dark_Puzzle) profile picture
Souhail Hammou
@Dark_Puzzle6 Apr 2019
Circumventing Windows Defender ATP's user-mode APC Injection sensor from Kernel-mode : rce4fun.blogspot.com/2019/04…
Image from Souhail Hammou (@Dark_Puzzle)
1
92
1
205
Microsoft fixed a Windows 0day (CVE-2019-0808) in Patch Tuesday. Our team constructed the POC and reproduced the vulnerability triggering process. Click here to read more: blogs.360.cn/post/RootCause_…
179
283
PhysicalDrive0 retweeted
Anton Ivanov (@antonivanovm) profile picture
Anton Ivanov@antonivanovm13 Mar 2019
One more #zeroday exploit was used in APT attack. securelist.com/cve-2019-0797…
Image from Anton Ivanov (@antonivanovm)
1
120
2
208
PhysicalDrive0 retweeted
Chaouki Bekrar (@cBekrar) profile picture
Chaouki Bekrar@cBekrar6 Mar 2019
Google discovered a Chrome RCE #0day in the wild (CVE-2019-5786). Reportedly, a full chain with a sandbox escape: chromereleases.googleblog.co… In 2019, I expect epic 0days to be found in the wild: Android, iOS, Windows, Office, virtualization, and more. Stay safe and enjoy the show.
Stable Channel Update for Desktop

Stable Channel Update for Desktop

The stable channel has been updated to 72.0.3626.121 for Windows, Mac, and Linux,   which will roll out over the coming days/weeks. Secur...

chromereleases.googleblog.com
5
132
7
205
PhysicalDrive0 retweeted
Vitali Kremez (@VK_Intel) profile picture
Vitali Kremez@VK_Intel9 Feb 2019
2019-02-08: #ExileRAT Group: "CVE-2017-8759" altered toolkit "get_robin.py" server thread w/ local logging { SHELLCODE1 = 'sc.dat' as JScript | LOG_FILE = 'robins.log' } h/t @PhysicalDrive0 Original Research 👍 -> xitter.gq/TalosSecurity/status/1…
Image from Vitali Kremez (@VK_Intel)
Cisco Talos Intelligence Group (@TalosSecurity) profile pictureCisco Talos Intelligence Group
@TalosSecurity4 Feb 2019
We recently observed a malware campaign delivering malicious PowerPoints using a mailing list run by the Central Tibetan Administration. Given the nature of this malware, it's likely designed for espionage purposes. #ExileRAT #LuckyCat cs.co/6016ERz94
Image from Cisco Talos Intelligence Group (@TalosSecurity)
1
22
1
42
PhysicalDrive0 retweeted
alex (@insertScript) profile picture
alex@insertScript1 Feb 2019
CVE-2018-16858 - My writeup about a RCE vulnerability via macro execution in Libreoffice: insert-script.blogspot.com/2…
6
141
3
260
Version 1.1 of BinCAT, our static binary code analyzer for reversers, was just released, with long awaited AMD64 support and huge performance improvements. Get it there: github.com/airbus-seclab/bin…
Image from Airbus Security Lab (@AirbusSecLab)
1
144
1
264
PhysicalDrive0 retweeted
RedDrip Team (@RedDrip7) profile picture
RedDrip Team@RedDrip719 Jan 2019
#CVE-2018-8453 deep analysis, from Use After Free to arbitrary memory read/write by 360 Threat Intelligence Center, a follow up of vulnerability being used by #FruityArmor group targeting the Middle East. ti.360.net/blog/articles/cve… the video：video.twimg.com/tweet_video/…
1
79
2
149
Patch for CVE-2018-8653 Scripting Engine Memory Corruption Vulnerability is out: portal.msrc.microsoft.com/en… Spotted in the wild by @_clem1.
2
31
2
38
An APT actor leverages #0day vulnerability in the Win7-Win10 Kernel Transaction Manager driver (CVE-2018-8611) to elevate privileges securelist.com/zero-day-in-w… portal.msrc.microsoft.com/en…
Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)

Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)

In October 2018, our AEP systems detected an attempt to exploit a vulnerability in the Microsoft Windows. Further analysis led us to uncover a zero-day vulnerability in ntoskrnl.exe.

securelist.com
56
75
PhysicalDrive0 retweeted
Michael.Gorelik (@smgoreli) profile picture
Michael.Gorelik
@smgoreli5 Dec 2018
CVE-2018-15982 PoC (Excel pop-up calculator and swf to be played in IE) github.com/smgorelik/Windows… just modified the end result of the cmd.exe
GitHub - smgorelik/Windows-RCE-exploits: The exploit samples database is a repository for **RCE**...

GitHub - smgorelik/Windows-RCE-exploits: The exploit samples database is a repository for **RCE**...

The exploit samples database is a repository for **RCE** (remote code execution) exploits and Proof-of-Concepts for **WINDOWS**, the samples are uploaded for education purposes for red and blue tea...

github.com
131
3
217
PhysicalDrive0 retweeted
SNDBOX (@SNDBOXCOM) profile picture
SNDBOX@SNDBOXCOM5 Dec 2018
Aaaaand... WE ARE LIVE. Register now for free! app.sndbox.com/register
6
16
1
31
The Ukrainian CERT warns of #Gamaredon’s #Pterodo malware distributed by e-mail Impersonating gov.ua [1]. We’ve preformed initial investigation of the indicators and found likely related infrastructure. Some overlap with previous publications [2] [3].
Image from ClearSky Cyber Security (@ClearskySec)
1
47
4
70
PhysicalDrive0 retweeted
Securelist (@Securelist) profile picture
Securelist
@Securelist14 Nov 2018
Kaspersky Lab technologies find another #zeroday vulnerability (CVE-2018-8589), this time targeting 32-bit versions of Windows 7 and Windows Server 2008. Now patched, it was being actively used against targets in the Middle-East. securelist.com/a-new-exploit…
A new exploit for zero-day vulnerability CVE-2018-8589

A new exploit for zero-day vulnerability CVE-2018-8589

Yesterday, Microsoft published its security bulletin, which patches a vulnerability discovered by our technologies. We reported it to Microsoft on October 17, 2018. The company confirmed the vulner...

securelist.com
31
31
Today, we publish our research about GreyEnergy, successor to BlackEnergy: Blog: welivesecurity.com/2018/10/1… Whitepaper: welivesecurity.com/wp-conten… IoCs: github.com/eset/malware-ioc/…

GreyEnergy: Updated arsenal of one of the most dangerous threat actors

ESET research reveals a successor to the infamous BlackEnergy APT group targeting critical infrastructure, quite possibly in preparation for damaging attacks

welivesecurity.com
1
146
3
197
PhysicalDrive0 retweeted
Costin Raiu (@craiu) profile picture
Costin Raiu
@craiu16 Oct 2018
Here’s our report on #octopusapt - a Russian speaking threat actor active in Central Asia securelist.com/octopus-infes…
Octopus-infested seas of Central Asia

Octopus-infested seas of Central Asia

For the last two years we have been monitoring a Russian-language cyberespionage actor that focuses on Central Asian users. We named the actor DustSquad and have provided reports on four of their...

securelist.com
2
37
1
44
PhysicalDrive0 retweeted
Costin Raiu (@craiu) profile picture
Costin Raiu
@craiu10 Oct 2018
New zero day exploit ItW caught by Kaspersky technologies - securelist.com/cve-2018-8453… likely used by #FruityArmor APT
Zero-day exploit (CVE-2018-8453) used in targeted attacks | Securelist

Zero-day exploit (CVE-2018-8453) used in targeted attacks | Securelist

Yesterday, Microsoft published their security bulletin, which patches CVE-2018-8453, among others. It is a vulnerability in win32k.sys discovered by Kaspersky Lab in August.

securelist.com
4
105
2
137
PhysicalDrive0 retweeted
Alex Matrosov (@matrosov) profile picture
Alex Matrosov
@matrosov8 Oct 2018
Lojax rootkit inspired me to write a blogpost about possible dual-use of common BIOS update tools with signed drivers (tested on Win10 1809) medium.com/@matrosov/dangero…
4
243
9
375
Load more