m4lwatch @m4lwatch

Security Researcher. Threat Hunter. C2 Observer. localhost Joined June 2019

Tweets

170
Followers

1K
Following

699
Likes

124

ambr0se @AmbroseGuise

4 years ago

Inside Trickbot, Russia’s Notorious Ransomware Gang wired.com/story/trickbot…

0 3 6 0 3

View Details

Andy Greenberg (@agreenberg at the other places) @a_greenberg

4 years ago

For weeks, observers of North Korea have noted that the country's internet seemed to be under attack, with all its websites down at times. This wasn't the work of US Cyber Command. It was a single hacker getting even after NK spies targeted him last year. wired.com/story/north-ko…

57 1K 3K 0 476

View Details

CyberGeeksTech @GeeksCyber

4 years ago

I've analyzed a Lazarus APT malware disguised as Notepad++ shell extension cybergeeks.tech/a-detailed-ana… #ReverseEngineering #infosec

0 35 95 0 15

View Details

InfoRiskToday @InfoRiskToday

5 years ago

.@Malwarebytes notes that Pakistan-linked #APT group SideCopy is targeting military and government institutions in India and Afghanistan to steal sensitive information using new lures and payload delivery mechanisms. @JustSoumik reports. bit.ly/3oMYBQ6 #ISMGNews #Infosec

0 3 3 0 2

View Details

Michele Campa @s1ckb017

5 years ago

#APT or #Phishing Email against Navy Pakistan a4c7dd0282a6a6c3242962d88e52488e3a486e29 Docx: 31481c974e12e03f7dc65669fdbc3230a6f873e0 Powershell downloads payload from: jl3.000webhostapp.]com Someone has been faster to get the downloaded payload?

4 19 42 0 6

View Details

John Opdenakker @j_opdenakker

5 years ago

What’s your favorite Linux joke? Mine is: Where do Russian Hackers store their exploits? /ussr/bin/

68 148 1K 0 44

View Details

Demai_Tech Consultants @DemaiTech

5 years ago

Every day we generate passwords,but how secure are they?Am sure you want a password you can easily remember but difficult to be discovered by unauthorized people. #CyberSecurity #AI #Ransomeware

2 8 9 0 2

View Details

Microsoft Security @msftsecurity

5 years ago

The latest activity from #NOBELIUM indicates the Russian nation-state actor is trying to gain long-term systematic access to various points in the technology supply chain and establish a mechanism for surveilling targets of interest. msft.it/6017XhTRD

3 138 216 0 26

View Details

The Record From Recorded Future News @TheRecord_Media

5 years ago

Microsoft said on Monday that a Russian state-sponsored hacking group known as Nobelium and APT29 had attacked more than 140 IT and cloud services providers, successfully breaching 14 companies therecord.media/microsoft-says…

1 29 59 0 4

View Details

m4lwatch @m4lwatch

5 years ago

#WellMess #APT29 #threatintel

m4lwatch @m4lwatch

5 years ago

Maybe new WellMess C2 111.90.147[.]248 with SSL certificate d1bcf440d6d38d8cfd854e57376a91307b07192f2f52f6b03f5735f7746e0d4c near old reported APT29 servers 111.90.146[.]143 and 111.90.150[.]176 Certificate still using CN=* but issuer Thawte Consulting cc and subject StartCom Ltd

2 9 18 0 4

0 0 2 0 1

View Details

m4lwatch @m4lwatch

5 years ago

2 9 18 0 4

View Details

m4lwatch @m4lwatch

5 years ago

I see WellMess malware on virustotal recently virustotal.com/gui/file/73d79… using known C2 103.253.41[.]82 maybe no longer used #APT29 #threatintel

0 2 1 0 2

View Details

Shadow Chaser Group @ShadowChasing1

5 years ago

Today our researchers have found botlib implant which belongs to #WellMess #APT29 group ITW:66b933a074f97f548582789a55c54258 filename:mschkdsk.exe C2:192.48.88.107

0 17 48 0 4

View Details

m4lwatch @m4lwatch

5 years ago

WellMess and WellMail malware targets COVID-19 Vaccine organization. ~ Hacking and Cybersecurity Forum #threatintel zero-dayhacking.blogspot.com/2021/05/wellme…

1 9 17 0 4

View Details

Arkbird @Arkbird_SOLG

5 years ago

#APT28 Confirm the #Zekapab attribution, continue to use the hex encoded for hiding the URL to join and strings. Have some minors modifications, this check the connectivity with only localhost this time.