Pinned Tweet
9 McNuggets & a McChicken burger helped us link a Russian hacker to 🇷🇺 government😅
Denis Obrezko was put on the international wanted listed by Russia, following an FBI arrest in Phuket last November.
Our independent investigation shows Obrezko has closes ties to the Moscow👇
Interesting reporting on APT28/Fancy Bear by @symantec
"Russian Espionage Group Targets Defense Firms in Two NATO Countries"
security.com/threat-intellig…
👇
Establishing persistence via creation a SSH tunnel on port 80
Using @Huntio intelligence, we can see the port 80 SSH has been active since July 7th
SSH-80-B28C99448F18AC8DC35214910E0BE900
Ctrl-Alt-Intel retweeted
A gang stole more than 1,600 logins from Western trucking companies through a phishing website. 🚛
@ctrlaltintel and @beensquatted used OSINT Industries to trace it back to Russian logistics firms.
Read how 👇
ctrlaltintel.com/research/Di…
On @Huntio OpenDir 144.172[.]118[.]80:443
⛏️ XMRig + ftrace rootkit src
🐚 PHP webshells (Magento paths)
💳 Skimmer hidden in a PNG
🦀 Rust implants posing as systemd-*
Implant C2: update[.]ssl-certificate-verify[.]com
Exfil: google-ad-analytics[.]com, gfhiko[.]xyz
⚙️ Persistence
Rootkit: klogd.ko → /etc/bL6qMsQz, loaded by /etc/init.d/bL6qMsQz + /etc/rc3.d/S55bL6qMsQz
Miner: cron */50 runs /etc/kworker/kworker (/etc/cron.d/javae, /etc/crontab) → /etc/javae/javae
Files chattr +ia, ps/top/pstree wrapped to grep out javae
More information can be found here including some source code:
portal.hunt.io/attackcapture…
Ctrl-Alt-Intel retweeted
Have I Been Squatted registered аррӏө.com.
It looks like Apple’s website address, but it’s a completely separate domain using different characters.
We registered 20 lookalike .com domains in total as part of our latest research. Here’s what we found.
1/5 ⬇️
Ctrl-Alt-Intel retweeted
Crosshair X RCE: SVG Injection via crosshair-x:// URI and Steam Workshop
Fixed in 15.5.4 by the GOAT Graham from @CenterPointG fixed on the same day on a weekend while moving house 👑
New blog: Russian and Allied Government Systems Compromised in Targeted Campaigns ❗️
Notable victims include:
- Russian Ministry of Emergency Situations
- Kyrgyz Ministry of Foreign Affairs
- Syrian Government Customs dept.
🧵👇
Case 3: A threat actor attempted to exploit Roundcube CVE-2025-49113 against Kyrgyz National Security Service (mail.gknb.gov.kg)
Other known CVEs and public POCs were used by this threat actor to target
Found via 89.124.123[.]216:8080 - @Huntio
Link to full article 👇
Interesting reporting by FIND on a OPSEC L from Armenian-linked cargo-theft threat actors deploying "GaloyanRAT" & an assortment of RMMs
500+ payloads were exposed on cloud storage, linked to targeting of carriers 🧵
