Alex. Turing (@TuringAlex) profile picture

Alex. Turing

@TuringAlex

Kernel Developer | Security REsearcher | Basketball Fan {Botconf | VirusBulletin | Kaspersky SAS} Speaker Current: @Xlab_qax EX: @360Netlab @Kaspersky AKA 渣兔

blog.xlab.qianxin.com
Joined December 2014
  • Tweets314
  • Following389
  • Followers1.4K
第一次见BBC上讨论php😂，黑客们的狂欢🙀
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
7
278
🚨Find an interesting 0 detaction #miner on a hacked website — so far it's only mined one #XMR, but the worker name "arina-a100-2-model-server" suggests an #A100-equipped machine might have been compromised? By the way, who is the "Bl4ckSh33P"?🤔#OSINT Happy hunting 🍷@Xlab_qax
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
3
576
🚨"self-propagating #miner #worm, blockchain C2 + bootstrap failover." 🤔 Everything is self-explanatory🤣，Is this attacker just lazy or what? Not even obfuscating? #ioc 📸http[:]//104.194.140.150:8080/54ac4810b1d01207/ca06059d5d3d81d2[.]sh 📸 Happy hunting 🍷@Xlab_qax
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
1
2
23
1,884
🚨In a span of just 24 hours, #Harvard International Review @HarvardIR hit with code injections from two separate threat actors, both used for #ClickFix attacks.😅 It's absolutely wild. #Harvard #IOC Happy hunting 🍷@Xlab_qax
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
1
6
939
🚨写写简单的威胁快讯，刷一刷KPI也挺开心😂。 By the way, are there any #Telegram experts who can uncover the real identity of 0xWR?🤔 Happy hunting 🍷@Xlab_qax
Xlab (@Xlab_qax) profile pictureXlab@Xlab_qaxMay 11
A mysterious hacker group known as #Mr_Rot13, which has operated covertly for six years, is exploiting critical cPanel vulnerabilities to deploy backdoor malware. blog.xlab.qianxin.com/mr_rot…
Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment

Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment

Background CVE-2026-41940 is a high-severity unauthenticated authentication bypass vulnerability affecting cPanel & WHM. This product is widely used in Linux server operations and virtual hosting...

blog.xlab.qianxin.com
798
#botnet #ioc #c2 👉 xlabslover[.]lol and the console output had us in stitches. 😂 📸"To love or hate, that is the question". 📸 By the way, @Huntio about "The xlab 2 Rivalry" part… hmm, I'm thinking "F-word xlab 2" — may be "F-word xlab too."🤣 Happy hunting 🍷@Xlab_qax
Image from Alex. Turing (@TuringAlex)
Hunt.io (@Huntio) profile pictureHunt.io
@HuntioApr 29
🚨 NEW RESEARCH: xlabs_v1 DDoS-for-Hire IoT Botnet Exposed - One Open Directory. An Entire Operation Revealed. hunt.io/blog/xlabs-v1-ddos-f… The operator built a full commercial DDoS-for-hire operation. Tiered pricing, 21 flood variants, competitor-killing routines baked in. Then left the whole toolkit on a public server with no login. Hunt.io AttackCapture tool had it indexed before they noticed. Key findings: - Botnet branded xlabs_v1, operator handle Tadashi, targeting game servers and Minecraft hosts - 21 flood variants including RakNet and OpenVPN-shaped UDP to dodge common filters - TCP/5555 observed open on 4M+ hosts in the past 180 days, any running ADB is a potential target - ChaCha20 encryption broken via known-plaintext, full nonce reuse across all 16 calls - C2, staging, distribution, and Monero cryptojacking all inside one bulletproof /24 in the Netherlands 👉 Full IOCs, MITRE mapping, and HuntSQL queries: hunt.io/blog/xlabs-v1-ddos-f…
Image from Hunt.io (@Huntio)
Image from Hunt.io (@Huntio)
Image from Hunt.io (@Huntio)
Image from Hunt.io (@Huntio)
7
22
3,537
🚨#fast16 🫡向大佬们脱帽致敬，这溯源能力太强了！ Lua brings me back to the days of analyzing Project Sauron and Godlua. For the lazy ones out there, I’ve uploaded the decrypted and preliminarily decompiled Lua payloads to VT 18735eebaa648c22d68a3a362d89dc6a. Happy hunting
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
1
15
66
8,268
🚨#APT41 Just spotted a fresh #Winnti #ELF backdoor f1403192ad7a762c235d670e13b703c3— 0 detections on VT and packed with VMProtect. 📸One of the #C2 "ai.qianxing[.]co" is clearly impersonating our company’s domain. They’re getting bold.🤣#IOC Happy hunting 🍷@Xlab_qax
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
3
34
4
128
20,461
🚨The iOS exploit kit #Coruna is a fascinating case. With XLAB #PDNS, its DGA C2s are easily exposed—we grabbed four ourselves. Stats show ~4,400+ infected IPs (or researchers) per day. Surprisingly, 98.5% of these IPs are located in China, why?🤔 Happy hunting 🍷@Xlab_qax
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
1
4
13
2,388
做了一些微小的工作，make the world a better place🫡 Happy hunting 🍷@Xlab_qax
Image from Alex. Turing (@TuringAlex)
1
9
851
🚨#Botnet In February, an invisible war broke out within #Android TV Boxes between #Bigpanzi and #Kimwolf. Bigpanzi issued the "pm uninstall" command to remove Kimwolf's APK，哈哈，果然同行是冤家😂 Happy hunting 🍷@Xlab_qax
Image from Alex. Turing (@TuringAlex)
1
8
40
5,693
🚨An interesting #ELF sample da2e396baf23de1881d06dd3377f84a6 on VT, packed by modified upx, appears to be a #PLC program for traffic light control, but why does it contain an embedded XOR code to establish a reverse shell to 173.180.247[.]200🤔? #IOC Happy hunting 🍷@Xlab_qax
Image from Alex. Turing (@TuringAlex)
Image from Alex. Turing (@TuringAlex)
2
20
92
7,075
哈哈，只做了微小的工作🤪#botnet
Image from Alex. Turing (@TuringAlex)
Xlab (@Xlab_qax) profile pictureXlab@Xlab_qaxJan 7
Here are APNIC's top three posts related to security for 2025. The first one is ours, and we're very honored.😄 blog.apnic.net/2026/01/02/th…
Image from Xlab (@Xlab_qax)
1
5
1,193
Load more