Qix maintainer npmjs.com/~qix got hacked, an all of his repos published within last 24hrs should be considered as compromised. number of downloads 1.6B - ansi-styles 1.5B - debug 1.3B - chalk 1.2B -supports-color 1.1B @ReversingLabs secure.software/
#defcon33 day two.This is so much bigger than BH. and much cooler! Bummer that physical badges are falling appart for many people.
@DreamHost live #phish with open dir hxxps://rebrand. ly/edf230 credentials pilling up.
Interesting phish today. Twitter redirect.
hXXPs://t[.]co/8yZwXQ121C ->
hxxps://saveonleads[.]ru/no[.]html
to blob:hxxps://pub-a0cceeb38f874be49bbdbc368c662718[.]r2[.]dev/0cef247e-3861-4196-98b7-53441718d768
interesting part., by using #blobURIs voids scans
what an honour to see Bruce Schneiner in person here at RSAC. Although talk was AI driven this really reaonated “ Blockchain is the most useles thing ever.” No one opposed.
1
95
Incrrdible day 1 @RSAConference #rsac 42000 attendees. wow!! Look forward to meetup with researchers having access to our platform!
#sarcoma ransomware offering rogue employees to take active role in infiltration and cut in extortion! sample SHA1 6b249c9bffd3698a3033a4110e387a711c488154
@banthisguy9349 open dir expert!
New blog post: Removing Traces of RMM Tools
dfir.ch/posts/cleanup_script…
In this short blog post, we examine a ‘cleaner’ script found in an open directory.
or instead use #Reversinglabs retro yara. daily quota on RL eg Monthly on VT. reversinglabs.com/blog/level…
#VirusTotal just got back to us confirming that #Retrohunt quota is now counted on a per rule basis instead of per job WITHOUT ANY UPDATE OR NOTICES TO ITS CUSTOMERS. This is insane.
#threatintel #infosec
A friend of mine just lost 500EUR via this -> Deutche post DHL #phish lure for CVV and card data. Still active hxxps://dhl.de.t2ra2k1f4d9y4a1vf49de.org Any ideas on what service they use as a merchant to transfer funds? @JAMESWT_MHT @James_inthe_box @cocaman @certbund
another #fakeCOVIDcert; Issued to a same fake name, different country (PL), vaccine etc. notbefore/notafter timestamps seem not to be indicative on Issuance of DGC. github.com/eu-digital-green-… could help to pin point compromised cert country.@MZ_GOV_PL @ordre_medecins
Recent misused Covid certificate; All fields, are aligned and consistent with EU Digital COVID Certificates schema. Although issuer/nation/ content can't be verified, there is a chance that validity (1635199742) from 3 days ago points to newly issued cert and was somehow misused.
@VK_Intel @JAMESWT_MHT Confirmed by Slovenian Cert that majority of signed malware samples missused Certs from SLO small and micro companies.
Našli smo računalniške viruse, ki so jih digitalno podpisala slovenska podjetja: cert.si/virusi-s-podpisi-slo… #malware
Shout-out @MalwareUtkonos of @ReversingLabs for a great walkthrough on the topic of Ransomware and data exfiltration. An hour well spent! abstract;blog.reversinglabs.com/blog/…
@ReversingLabs pivoting on multiple IOC points via advanced search!
#MerryChristmas Amazing way to spend Sunday. No sign of Covid, no sign of people. Croatia #Brijuni
1
3