Co-Founder @MalBeacon https://xitter.gq/t.co/e9YTNSPUI5 | Board Member @BSidesCHS. Tweets are mine & should be dismissed as bourbon-fueled ramblings.
Charleston, SC
Joined July 2014
- Tweets2.2K
- Following956
- Followers3.3K
- Likes5.8K
Paul Burbage retweeted
New Op Report with @proofpoint PackClient, a new C2 framework from Chinese speaking actor TA4922, detonated in a live DeceptionPro honeynet.
The RAT was just the doorman. 4.5 hours in, the operator enrolled the victim into an attacker owned ManageEngine Endpoint Central server.
Paul Burbage retweeted
New Op Report: an operator took the bait on one of our honeynets and ran the whole chain.
Phishing lure to batch script to silent ScreenConnect install, hands-on-keyboard then XLoader / FormBook.
Interactive RMM + automated stealer in one op. Not a pairing we'd seen before.
Paul Burbage retweeted
Remote Monitoring and Management (RMM) tooling is taking over the cybercrime landscape. And it keeps growing. 🤖
In partnership with DeceptionPro, we observed follow-on activity from a Bluetrait campaign in an environment built to resemble a travel company.
The result? Even more RMMs. blog.deception.pro/blog/hok-…
![[Op Report] Hands-on-Keyboard Intrusion Abusing Multiple RMMs — Deception.Pro Blog](https://pbs.twimg.com/card_img/2115191745809911809/7pm6zaht?format=jpg&name=420x420_2)
Paul Burbage retweeted
Indtroducing: What is this stealer?
A new repository that allows for you to identify Stealer malware by the system information text file format commonly included in stealer malware exfiltration.
We encourage everyone to check it out and contribute!
github.com/MalBeacon/what-is…
Paul Burbage retweeted
If you use 3CX software, I highly recommend looking for these indicators and also looking for suspicious activity from any 3CX processes. If you aren't sure if you use this software, check! reddit.com/r/crowdstrike/com…
Paul Burbage retweeted
Free tickets for the Malware & Reverse Engineering Conference 2023. This is great, and special thanks to @oceania_cyber for their generosity. DM OCSC for your free ticket. federation.edu.au/icsl @fancy_4n6 @GyledC @awsn_au @hexlax @DefenceScience @DSI_VIC @MattTett @push_pnx
As part of our sponsorship of @FedUniAustralia's Malware & Reverse Engineering Conference we are giving away free tickets for interested students and researchers ⬇️
Paul Burbage retweeted
Hacking Windows - Chapter 19: Debugging MoveFile x64, FREE hacking course using IDA Free where we learn the entirety of the Win32API and reverse engineer it. github.com/mytechnotalent/Ha…
Paul Burbage retweeted
Today we announced our strategic partnership with @CrowdStrike, which brings the power of CrowdStrike’s Falcon platform to Mandiant’s industry-leading services helping to protect customers from #cyberthreats.
Learn more. ⬇️ mndt.info/3NNAOtP
Paul Burbage retweeted
📌 Reminder if you are curious about #malware #obfuscation techniques
😺Join us tomorrow April 7 live at 1300 EST on #OALABS Twitch
👾 We will be analyzing #Emotet using #angr and symbolic execution
twitch.tv/oalabslive
Paul Burbage retweeted
#RevEng #MaleWare #IR Breaking news: @fancy_4n6 will be giving a talk at the Malware and Reverse Engineering webinar. Cryptically titled "Long story short". federation.edu.au/icsl/semin… @ComfyConAU @ItchyCube @push_pnx @hexlax @robertlayton @IqbalGondal
#RevEng #Malware Next Malware & Reverse Engineering MRE Webinar 4:00 pm 17/Feb. Great Speakers @kylieengineer, @NoushinShbb, Lu Yu. federation.edu.au/icsl/semin… @JakubKroustek @dr_watters @ComfyConAU @amp1874 @jacquiloustau @daniella_t05 @williballenthin @4n6Bexaminer @vaughanshanks
Paul Burbage retweeted
Adversary Illuminated - Operating #AgentTesla
C2: mgbless[.]in
Location: Lagos, NG
ASN: AS29465 MTN NIGERIA Communication limited
#Malware #MalBeacon
Paul Burbage retweeted
Amazing Ida plug-in and service for recovering api or process names hashed by malware released by @herrcore 🤩 #malwareanalysis
github.com/OALabs/hashdb-ida
Paul Burbage retweeted
Adversary illuminated - Operating #Pony
C2: global-popular[.]com/bin/panel/admin.php
Location: Lagos, NG
ASN: AS36873 Airtel Networks Limited
#Malware #MalBeacon
Paul Burbage retweeted
Adversary illuminated - Operating #LokiBot
C2: davidmorgann[.]com/LOLO/five/PvqDq929BSx_A_D_M1n_a.php
Location: Port Harcourt, NG
ASN: AS29465 MTN NIGERIA Communication limited
#MalBeacon #Malware
Paul Burbage retweeted
Adversary illuminated - Operating #ManaTools stealer
C2: bot.statusupdate[.]one/webpanel-muti/login.php
Location: Ashburn, US
ASN: AS213122 Hyonix LLC
#MalBeacon #Malware
Paul Burbage retweeted
Adversary illuminated - Operating #Oski stealer
C2: bctpump[.]us/login.php
Location: Lagos, NG
ASN: AS37148 Globacom Limited
#MalBeacon
