🐣 (@sysgoblin) header
🐣 (@sysgoblin) profile picture

🐣

@sysgoblin

principal threat researcher and professional pleb

 🗿
rm-rf.lol
Joined January 2016
  • Tweets762
  • Following513
  • Followers790
157Media
Photo by 🐣 (@sysgoblin)Photo by 🐣 (@sysgoblin)Photo by 🐣 (@sysgoblin)Photo by 🐣 (@sysgoblin)Photo by 🐣 (@sysgoblin)Photo by 🐣 (@sysgoblin)Photo by 🐣 (@sysgoblin)Photo by 🐣 (@sysgoblin)Photo by 🐣 (@sysgoblin)Photo by 🐣 (@sysgoblin)
the world is ending and im out here buyin crocs
dear Jesus, please give my fence the strength to remain rigid and upright #StormEunice
1
1
1
ffs jesus
Image from 🐣 (@sysgoblin)
4
1
the lord hath claimed another panel. they were taken too soon 🙏
Sad that I got beat to posting about this publicly after looking at it on and off since October, but there are a lot of great details in here about a previously unknown botnet written in Go! Here are some screenshots (including the operator's desktop) I had as well!
Image from Stephan (@FirehaK@infosec.exchange) (@_FirehaK)
Image from Stephan (@FirehaK@infosec.exchange) (@_FirehaK)
Image from Stephan (@FirehaK@infosec.exchange) (@_FirehaK)
Image from Stephan (@FirehaK@infosec.exchange) (@_FirehaK)
sysopfb (@sysopfb) profile picturesysopfb@sysopfb14 Feb 2022
Following up on @Intel471Inc recentl report on PrivateLoader we also found another loader being leveraged - Calls itself "Anubis" Loader and is written in GoLang medium.com/walmartglobaltech…
PrivateLoader to Anubis Loader

PrivateLoader to Anubis Loader

By: Jason Reaves and Joshua Platt

medium.com
2
8
A few hours ago, a promising token called $YEAR was airdropped. It was set up as a "year in review" of your Ethereum transaction history. Less than an hour ago, this turned into a painful experience for buyers of the token. Here's how $YEAR pulled the rug in under 6 hours🧵 1/
454
2,032
1,038
5,984
🐣 retweeted
FBI (@FBI) profile picture
FBI
@FBI24 Dec 2016
Happy holidays from the #FBI
Image from FBI (@FBI)
2,129
51,462
12,658
85,160
Replying to @removed_use
If this ever happens to you or anybody you know, there’s an option in that alert to view more details which tells you to bring the AirTag close or to bring it to the police
Image from kd's modern strife 🇵🇸 (@modern_kd)
Image from kd's modern strife 🇵🇸 (@modern_kd)
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
14
374
12
1,537
well i mean just fuck everything at this point right
This quoted post is unavailable.
Try viewing anyway · View on X
1
1
log4getaboutit 🤌
1
1
2
just pushed a quick update to emulate apache/elastic, process query params, and accept POST data with a fake login form. have at it! 🍯
🐣 (@sysgoblin) profile picture🐣@sysgoblin13 Dec 2021
here take this 🤲🍯 #log4shell #log4j github.com/sysgoblin/log4she…
GitHub - sysgoblin/log4shell-honeypot: Log4j honeypot to capture payloads within HTTP headers,...

GitHub - sysgoblin/log4shell-honeypot: Log4j honeypot to capture payloads within HTTP headers,...

Log4j honeypot to capture payloads within HTTP headers, query parameters and POST requests. - sysgoblin/log4shell-honeypot

github.com
2
I promised I would write a report covering my phishing research in 2021. That report is now live: steved3.io/data/Phishing-202… Shout out to @AmandaFGoedde for helping me edit, as well as @ninoseki for making Miteru, and @urlscanio for creating an awesome tool to help defenders.
Image from Steve Ragan ⚠️ (@SteveD3)
11
82
8
210
here take this 🤲🍯 #log4shell #log4j github.com/sysgoblin/log4she…
GitHub - sysgoblin/log4shell-honeypot: Log4j honeypot to capture payloads within HTTP headers,...

GitHub - sysgoblin/log4shell-honeypot: Log4j honeypot to capture payloads within HTTP headers,...

Log4j honeypot to capture payloads within HTTP headers, query parameters and POST requests. - sysgoblin/log4shell-honeypot

github.com
2
1
11
#log4j thread Detection Ideas + Yara by @cyb3rops - gist.github.com/Neo23x0/e4c8… Hashes for vulnerable LOG4J versions by @mubix - github.com/mubix/CVE-2021-44… SIGMA by @SOC_Prime - tdm.socprime.com/tdm/info/XY… tdm.socprime.com/tdm/info/4S… Payloads list by @GreyNoiseIO - gist.github.com/nathanqthai/…
Log4j RCE CVE-2021-44228 Exploitation Detection

Log4j RCE CVE-2021-44228 Exploitation Detection

Log4j RCE CVE-2021-44228 Exploitation Detection. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com
3
174
5
367
rip everyone #log4shell youtu.be/EwwtGN_d8Is
infinite realm of incomprehensible suffering

infinite realm of incomprehensible suffering

👹

youtube.com
How can you identify the plane, location, and mission commander in this image? With the intelligence cycle and a little automation! This @quiztime challenge from @fiete_stegers is the hardest one I've tried so far. New #geolocation blog post: nixintel.info/osint/planes-a…
Image from Nixintel (@nixintel)
Image from Nixintel (@nixintel)
Image from Nixintel (@nixintel)
Image from Nixintel (@nixintel)
7
39
14
133
🐣 retweeted
MG (@_MG_) profile picture
MG
@_MG_12 Nov 2021
Hey... did anyone notice that PAN 0day was fixed in a version that was released over a year ago? Guess it wasn't easy to notice under all the loud opinions about ethics. 🤣
Image from MG (@_MG_)
11
34
15
190
finally, i can retire
Image from 🐣 (@sysgoblin)
1
4
Sci-Fi Author: In my book I invented the Torment Nexus as a cautionary tale Tech Company: At long last, we have created the Torment Nexus from classic sci-fi novel Don't Create The Torment Nexus
303
30,561
2,824
115,298
Load more