We uncover badness.
India
Joined November 2014
- Tweets131
- Following48
- Followers60
- Likes133
Pinned Tweet
Our security researchers have uncovered a phishing website & Android app targeting HDFC Bank customers
For a deep dive into the phishing website and android app, as well as the modus operandi, read our full report -
shreshtait.com/blog/2022/09/…
#phishing #hdfcbank #bfsi
Shreshta retweeted
Our team is growing, and we’re looking for passionate individuals to join us across multiple roles.
Learn more and apply here: shreshtait.com/careers
Know someone who'd be a great fit? Feel free to share or tag them below!
#Hiring #Careers #Belagavi #CyberSecurity
Our team is growing, and we’re looking for passionate individuals to join us across multiple roles.
Learn more and apply here: shreshtait.com/careers
Know someone who'd be a great fit? Feel free to share or tag them below!
#Hiring #Careers #Belagavi #CyberSecurity
Our latest report uncovers how scammers are exploiting the Tesla brand in large-scale crypto & investment scams — from fake trading platforms to cloned websites.
Full report 👉 shreshtait.com/blog/2025/05/…
#pigbutchering #romancebaiting #crypto #investment #scams
As folks in my network know, we've (@shreshtait) been tracking large-scale scams like pig-butchering, romance baiting, and crypto/investment fraud.
One curious pattern: the Tesla brand is being misused extensively.
🧵👇
Shreshta retweeted
Sometimes it's fascinating to see how some domain names constantly rotate the IP addresses and the network infrastructure they point to.
Here's a quick look at one such domain over time 👇
FYI, this is not fast flux.
#DNS #threatintelligence
Shreshta retweeted
I’m watching the news this week with growing concern. If you find yourself suddenly unemployed and think you might be a good fit for Maltego’s Product and Tech team, ping me. We have some roles open (maltego.com/careers/) and others in the planning stages.
Shreshta retweeted
Stopping C2 communications in human-operated ransomware through network protection - Microsoft Security Blog
microsoft.com/en-us/security…
Emotet is back!
#Emotet
Less than 24 months ago, our botnet report stated, "Spamhaus Malware Lab experts deem that it’s
highly likely that Emotet will come back into circulation." And here it is.
Currently, our researchers are seeing new botnet C&Cs being pushed. #Emotet #Back #ThreatIntel
Shreshta retweeted
Seeing an influx of suspicious domain names (domain shadowing attack) which appear to impersonate gitlab/github
Most are pointing at AS57724(DDOS-GUARD, RU).
We looked hard, couldn’t find one.
.top tops the charts for badness! #dnsabuse
Shreshta retweeted
The presentations from the 10th EU ATT&CK Community Workshop are online now: attack-community.org/event/. @MITREattack @circl_lu @CERTEU @digihash @AksPedro
Shreshta retweeted
Everything begins with a DNS query. The good stuff and the badness (there are a few exception cases).
Enabling and monitoring the DNS logs is an excellent step towards network security monitoring (NSM).
Shreshta retweeted
2/ This HTTP request can now be used very well for an alert.
Or better, collect and monitor all your DNS logs, because a DNS request will still go out if the Advanced IP Scanner is run without an installation (portable version).
An excellent opportunity for detection.
Shreshta retweeted
👉It’s official! We launched Protective DNS as part of our mission to enhance the federal government’s cyber defenses. Learn more here: go.dhs.gov/Z53
Our security researchers using SDINET - our threat intelligence platform, have detected and identified another phishing domain – links-circleci[.]com, which is part of the phishing campaign.
Detailed report - shreshtait.com/blog/2022/09/…
#dns #phishing #GitHub #SDINET #shreshtait
Shreshta retweeted
A good starting point would be to check the DNS logs/SIEM if any of the domain names were queried for in the network.
Aside from the domain names mentioned in the blog, also check for the domain name links-circleci[.]com
That one showed up in our data @shreshtait
GitHub has learned of a phishing campaign targeting GitHub users by impersonating CircleCI to harvest user credentials and two-factor codes. Read more about our response and how to protect your accounts from phishing attacks. github.blog/2022-09-21-secur…
