Grace (@euphoricfall) header
Grace (@euphoricfall) profile picture

Grace

@euphoricfall

Cofounder @pulsedive cybersecurity #threatintel | watercolorist | hyperserious board gamer | still borrows books from the public library

 NYC
Joined August 2019
  • Tweets1.3K
  • Following1.3K
  • Followers992
225Media
Photo by Grace (@euphoricfall)Photo by Grace (@euphoricfall)Photo by Grace (@euphoricfall)Photo by Grace (@euphoricfall)Photo by Grace (@euphoricfall)Photo by Grace (@euphoricfall)Photo by Grace (@euphoricfall)Photo by Grace (@euphoricfall)Photo by Grace (@euphoricfall)Photo by Grace (@euphoricfall)
🤓 I was recently quoted in the latest @feedly blog by @euphoricfall on ASN hunting! Check it out, it is a great piece that covers some techniques that are often overlooked by threat intelligence analysts! 👇 feedly.com/ti-essentials/pos…
Image from Thomas Roccia 🤘 (@fr0gger_)
7
22
2,385
Exploitation attempts for #React2Shell (CVE-2025-55182) have been widespread over the last week. Three resources that outline exploitation are: greynoise.io/blog/cve-2025-5… esentire.com/security-adviso… huntress.com/blog/peerblight… Recommendation: Deploy patches as soon as possible
CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation...

CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation...

GreyNoise is already seeing opportunistic, largely automated exploitation attempts consistent with the newly disclosed React Server Components (RSC) “Flight” protocol RCE—often referred to publicly...

greynoise.io
2
3
414
We analyzed the malicious code in the recent "second coming" of Shai-Hulud. blog.pulsedive.com/return-of…
Return of Shai-Hulud: The “Second Coming” of the NPM Supply Chain Compromise

Return of Shai-Hulud: The “Second Coming” of the NPM Supply Chain Compromise

This blog walks through the malicious code present in the second iteration of the Shai-Hulud compromise.

blog.pulsedive.com
3
5
245
We'll be back . See you soon.
Image from Pulsedive Threat Intelligence (@pulsedive)
2
4
269
A technical analysis reveals that the Kimsuky threat group utilizes a JavaScript dropper to exfiltrate data from compromised systems, utilizing network IOCs and establishing persistence via Windows scheduled tasks. #CyberSecurity #MalwareAnalysis blog.pulsedive.com/dissectin…
Dissecting the Infection Chain: Technical Analysis of the Kimsuky JavaScript Dropper

Dissecting the Infection Chain: Technical Analysis of the Kimsuky JavaScript Dropper

This blog analyzes a Kimsuky sample, how the dropper downloads additional stages, and network traffic observed within the infection chain.

blog.pulsedive.com
3
10
829
3 weeks.
Image from Pulsedive Threat Intelligence (@pulsedive)
2
2
338
Community Resource Share: @CuratedIntel's CTI Research Guide curatedintel.org/2024/10/the… Start with this guide if you're finding it difficult to consistently and appropriately perform intelligence collection for your stakeholders.
1
3
322
We released Pulsedive 6.3 this week to Pulsedive Community. This scanning infrastructure update benefits all users and customers with better data enrichment and performance. Details below
Image from Pulsedive Threat Intelligence (@pulsedive)
2
3
3
372
Oh, so you track ransomware tools? OK, name every one. Me:
Image from Will (@BushidoToken)
8
128
5
683
82,428
PSA from the @CuratedIntel Community to the CTI industry — watch out for cybercrime groups seeking access to your vendor platforms ⚠️
Image from Will (@BushidoToken)
27
76
21,034
CrowdStrike BSOD Outage: What We Know blog.pulsedive.com/crowdstri…
Pulsedive Blog | CrowdStrike BSOD Outage: What We Know

Pulsedive Blog | CrowdStrike BSOD Outage: What We Know

What we know about the CrowdStrike BSOD outage.

blog.pulsedive.com
1
2
4
192
We're tracking the new DodgeBox (loader) & MoonWalk (backdoor) tools researched by the @Threatlabz team as related threat pages in our free Community Platform. DodgeBox: pulsedive.com/threat/DodgeBo… MoonWalk: pulsedive.com/threat/MoonWal… APT41: pulsedive.com/threat/APT41
Image from Pulsedive Threat Intelligence (@pulsedive)
1
3
5
300
New blog published, all about phishing kits: blog.pulsedive.com/phishing-… How do they work, what capabilities do they have, and most importantly - how can we better detect and protect against phishing kits?
Pulsedive Threat Research | Phishing Kits

Pulsedive Threat Research | Phishing Kits

Phishing kits are "as-a-service" tools that help threat actors rapidly deploy phishing pages and campaigns. This blog examines key components, how they work, helpful resources, and a dive into the...

blog.pulsedive.com
4
5
229
🔎What's going on with Latrodectus? blog.pulsedive.com/threat-re… Our latest research blog examines the distribution mechanisms, C2 traffic patterns, and key capabilities of Latrodectus loader.
Pulsedive Blog | Latrodectus Threat Research

Pulsedive Blog | Latrodectus Threat Research

This research examines the distribution mechanisms, C2 traffic patterns, and functionality of Latrodectus loader.

blog.pulsedive.com
3
3
262
Our browser add-on for Chrome, Firefox, and Edge has a new look, fresh features, and more controls with our V3 update. Free to use and enrich from our Pulsedive Community platform. blog.pulsedive.com/update-pu…
Pulsedive Update | Chrome, Firefox, Edge Add-On Update

Pulsedive Update | Chrome, Firefox, Edge Add-On Update

Pulsedive's latest V3 update to our Chrome, Firefox, and Edge add-on include new features and improved user experience.

blog.pulsedive.com
1
3
3
216
New Threat Added: Asuka Stealer Find IOCs, TTPs, news and other highlights at: pulsedive.com/threat/Asuka%2…
Image from Pulsedive Threat Intelligence (@pulsedive)
1
3
277
Newly published: a beginner-friendly CyberChef 101 Guide blog.pulsedive.com/tool-guid… We cover how it works and how you can use it for security analysis - real-world examples and resources included.
Image from Pulsedive Threat Intelligence (@pulsedive)
9
9
693
🤯 The level of sophistication of the XZ attack is very impressive! I tried to make sense of the analysis in a single page (which was quite complicated)! I hope it helps to make sense of the information out there. Please treat the information "as is" while the analysis progresses! 🧐 #infosec #xz
Image from Thomas Roccia 🤘 (@fr0gger_)
95
3,046
246
12,204
1,107,475
Pulsedive Community Threat page for Phobos Ransomware has been updated with the latest information from CISA's Joint Advisory. pulsedive.com/threat/Phobos
Image from Pulsedive Threat Intelligence (@pulsedive)
2
2
257
Hi @weebly, remember this from 2022? About ~5k #phishing pages have been created w/ weeblysite[.]com to target @bt_uk customers, and also about +10k for @ATT! 🧐 (based on @urlscanio submissions) BT urlscan.io/search/#domain%3A… AT&T urlscan.io/search/#domain%3A…
Image from Will (@BushidoToken)
Image from Will (@BushidoToken)
Image from Will (@BushidoToken)
Image from Will (@BushidoToken)
Will (@BushidoToken) profile pictureWill@BushidoToken28 Aug 2022
Hi @weebly! Noticed a BT themed #phishing campaign with ~500 unique pages over the last 6 months Some *.weeblysite[.]com regex you may want to block: bt-page-[0-9]{6} bt-mail-[0-9]{6} bt-[0-9]{6} [0-9]{6}-bt-[0-9]{6} webmail-[0-9]{5} All of them here: urlscan.io/search/#domain%3A…
5
9
52
13,565
Load more