@salmanvsf

Senior Security Researcher

Joined May 2014
  • Tweets1.1K
  • Following1.2K
  • Followers664
118Media
Salman retweeted
ニコ
@y8dectirMay 10
海外インフルエンサーからマルウェアの詐欺が来た giveawayやってるアカウントでもこんなことするのか、か、乗っ取りなのか・・・ 手口が結構複雑で、Google Sites 上の偽workspace AccessKey入力後に「証明書エラー」を装ったClickFix詐欺です、皆様気をつけましょう😵‍💫
1
3
1
18
2,509
Threat group #NoName057(16) launched a TOR platform seeking anonymous insiders to leak classified gov & military data from countries “unfriendly” to Russia. hxxp[:]op7yiekgumt7po6mjgii4uewrwjydx5vhpa6y5gv7glftmw5srbwnaid[.]onion
1
1
474
#CredentialPhishing 1. Bunch of Newly created Domains 2. Multiple layers of obfuscation CyberChef: From_Base64('A-Za-z0-9+/=',true,false) Reverse('Character') ROT13(true,true,false,13) From_Base64('A-Za-z0-9+/=',true,false) 3. Sends creds to capchk[.]org 91.]195.]240.]123
2
3
690
more replies
#smilepanel !! Looks like a rebranding of a previously known PaaS kit. Similarities in code with previously known kit. trac-labs.com/wikikit-aitm-p… blog.sekoia.io/sneaky-2fa-ex…… @gregclermont @500mk500 @ValidinLLC @anyrun_app @JAMESWT_WT
2
3
398
More Smile admin panels
1
213
Sidewinder d2829da8996be9a6e374dd6d94bbbf39 11.docx C2 internal-advisory-azerbaijan-russia-diplomatic-crisis.defence-np[.]net #Sidewinder #APT #IOC
2
2
5
6,875
titanminingcorp.]calumix.]cfd heartcareservices.]co.]uk suitezone.]suttonselect.]cyou More domains in the URLSCAN Link
221
#Metasploit cafc9d45da602fdf794421fc90375024 ab.exe 4237219a330b61e02294897eccfafcd0 test.html 9021c9c1bc08ff874db8e1677f25923c goodfile.iso c2 : 45.76.180.]12 VULTR VPS hosted in Singapore kellington-group.]com - 7days ago Impersonating Kelington Group in #Malaysia @frdfzi
1
3
575
Interesting #ClickFix Technique uses compromised legit site with obfuscated JS fetching data from BNB Chain. jmw[.]lk -> 0xf4a32588b50a59a82fbA148d436081A48d80832A#code -> mshta "remote domain" @JAMESWT_WT @anyrun_app seen before ?
5
7
25
4,179
more replies
More croci-group.]com gnbleakfinders.]com mobher.]co globalednovation.]com.]mm bmtimes.]co.]uk (INFECTED IN THE PAST) gatedllc.]com/ starsacademyislamabad[.]com cmi-tax.]com sandiegocountynotary.]com hefshibaschool[.]com pnguot.]ac.]pg (INFECTED IN THE PAST) @ValidinLLC @500mk500
1
1
1
3
5,555
energysolutions.]co.]th eattrek.]com museums.]or.]ke
2
1
3
358
Replying to @salmanvsf @JAMESWT_WT @anyrun_app
FYI : @SimbaInvest @Dignited @elementsindia1 @yorkcars
131
Replying to @salmanvsf @JAMESWT_WT @anyrun_app @sekoia_io @gregclermont @suyog41
African govt website infected as well svtp.]gov.]mw
2
1
4
295
@C3SA_UCT
2
223
Salman retweeted
yed@frdfzi16 Aug 2025
I'm sharing my note, containing little tips and checklist on how we can attribute a piece of malware or a campaign to certain threat groups. Although it does not cover all methodologies but I think it's good for beginners to learn this topic. 👍🏻 fareedfauzi.github.io/cheats…
9
53
126
8,497
Fake Court Summon Notice campaign #phishing Leverages emailjs to sends creds 20c62c9ce91acced4c317f24788a5348 Demand Notice.pdf -> Too many URL's page.title:"Our Organisation Fax Portal.xls" urlscan.io/search/#hash%3Af0…
1
294
#Lokibot Targeting Maritime industry email-> rar -> exe 9d71796ebb299dfcac7cda4925c054a7 -> b1f815218dd7002fdba3b4673000b3d0 PDA MV WOOHYUN HOPE (V.1903) ETA SINGAPORE OOA FOR MAY 2019 DISCHARGE & BUNKERING_pdf.exe @JAMESWT_WT @500mk500 @anyrun_app
4
3
12
865
@JAMESWT_WT @500mk500 @anyrun_app
1
252
Load more