SecuritySnacks<p>DomainTools Investigations (DTI) shares its latest analysis: “Phishing Campaign Targets Defense and Aerospace Firms Linked to Ukraine Conflict.” </p><p>The infrastructure comprises a small number of mail servers, each supporting a set of domains designed to spoof that of a specific organization. These domains currently host webmail login pages likely intended to harvest credentials from targeted entities.</p><p>🔹The phishing infrastructure targets defense and aerospace entities linked to the Ukraine conflict.<br>🔹Infrastructure comprises a small number of mail servers supporting domains designed to spoof specific organizations.<br>🔹Likely intended to harvest credentials from targeted entities.<br>🔹Motivated by cyber espionage, focusing on intelligence related to the Ukraine/Russia conflict.</p><p>Stay informed and help us combat these threats - read the full article and join the discussion. </p><p><a href="https://dti.domaintools.com/phishing-campaign-targets-defense-and-aerospace-firms-linked-to-ukraine-conflict/?utm_source=Mastodon&utm_medium=Social&utm_campaign=PhishingInfra-UAConflict" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">dti.domaintools.com/phishing-c</span><span class="invisible">ampaign-targets-defense-and-aerospace-firms-linked-to-ukraine-conflict/?utm_source=Mastodon&utm_medium=Social&utm_campaign=PhishingInfra-UAConflict</span></a> </p><p><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/Ukraine" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Ukraine</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntelligence</span></a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Phishing</span></a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSec</span></a> <a href="https://infosec.exchange/tags/CyberEspionage" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberEspionage</span></a></p>
Recent searches
No recent searches
Search options
Only available when logged in.
pawb.fun is one of the many independent Mastodon servers you can use to participate in the fediverse.
This instance aimed at any and all within the furry fandom, though anyone is welcome! We're friendly towards members of the LGBTQ+ community and aiming to offer a safe space for our users.
Administered by:
Server stats:
297active users
pawb.fun: About · Status · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.3.6+glitch
#threatintelligence
2 posts · 2 participants · 0 posts today
CTI.FYI<p>🚨New ransom group blog post!🚨</p><p>Group name: ransomhub<br>Post title: cisd.org<br>Info: <a href="https://cti.fyi/groups/ransomhub.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">cti.fyi/groups/ransomhub.html</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ransomware</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a></p>
SecuritySnacks<p>Dive into DomainTools Investigations’ latest analysis: "The Domain Registrars Powering Russian Disinformation: A Deep Dive into Tactics and Trends."</p><p>Russian state-sponsored actors are leveraging low-cost, privacy-protected, and anonymous domain services to launch sophisticated disinformation campaigns.</p><p>Key Highlights:<br>🔸Fake news portals mimicking legitimate media<br>🔸Typosquatting and homoglyph attacks<br>🔸Bulletproof hosting and Fast Flux networks<br>🔸Preferred registrars<br>🔸Emerging trends in domain registration tactics</p><p>Stay informed and help us combat these threats - read the full article and join the discussion: <a href="https://dti.domaintools.com/domain-registrars-powering-russian-disinformation/?utm_source=Mastodon&utm_medium=Social&utm_campaign=disinformation" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">dti.domaintools.com/domain-reg</span><span class="invisible">istrars-powering-russian-disinformation/?utm_source=Mastodon&utm_medium=Social&utm_campaign=disinformation</span></a></p><p><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/Disinformation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Disinformation</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntelligence</span></a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Infosec</span></a> <a href="https://infosec.exchange/tags/CyberThreats" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberThreats</span></a></p>
Christoffer S.<p>I just published the source code for my very naive <a href="https://swecyb.com/tags/Python" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Python</span></a> implementation for generating a node network based on MITRE Intrusion Sets and Techniques. It will output linked <a href="https://swecyb.com/tags/Markdown" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Markdown</span></a> files linking intrusion sets to their used techniques.</p><p>Perhaps someone finds it useful or interesting to experiment with.</p><p>Source code: <a href="https://github.com/cstromblad/markdown_node" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/cstromblad/markdown</span><span class="invisible">_node</span></a></p><p>I hinted at this in a thread started by <span class="h-card" translate="no"><a href="https://mastodon.social/@Viss" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>Viss</span></a></span> where he asked for input on a few very likely malicious domains. Me <span class="h-card" translate="no"><a href="https://mastodon.social/@Viss" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>Viss</span></a></span> <span class="h-card" translate="no"><a href="https://infosec.exchange/@cR0w" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>cR0w</span></a></span> <span class="h-card" translate="no"><a href="https://masto.deoan.org/@neurovagrant" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>neurovagrant</span></a></span> and others did some OSINT fun work with a couple of the original domains.</p><p>It was this thread: <a href="https://mastodon.social/@Viss/114145122623079635" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">mastodon.social/@Viss/11414512</span><span class="invisible">2623079635</span></a></p><p>Now I posted a picture of a node network rendered in Obsidian and I hinted that perhaps Obsidian could be used as a poor mans version of performing threat intelligence work.</p><p><a href="https://swecyb.com/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://swecyb.com/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntelligence</span></a> <a href="https://swecyb.com/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a> <a href="https://swecyb.com/tags/Obsidian" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Obsidian</span></a></p>
CTI.FYI<p>🚨New ransom group blog posts!🚨</p><p>Group name: arcusmedia<br>Post title: HYPERNOVA TELECOM<br>Info: <a href="https://cti.fyi/groups/arcusmedia.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">cti.fyi/groups/arcusmedia.html</span><span class="invisible"></span></a></p><p>Group name: arcusmedia<br>Post title: HYPONAMIRU<br>Info: <a href="https://cti.fyi/groups/arcusmedia.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">cti.fyi/groups/arcusmedia.html</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ransomware</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a></p>
Infoblox Threat Intel<p>While everyone is enjoying Carnival in Brazil, threat actors are still out there trying to lure people into their traps. We have found a cluster of lookalikes to the Brazilian DMV office (DETRAN in Portuguese). We observed at least two instances where they were impersonating the DMV office for the Brazilian states of Paraná and Maranhão.<br> <br>The actor(s) create domains with the same label, but on several different TLDs (mostly highly abused). Here are some examples of what they look like.<br> <br>consultes-seu-debitos2025.<space|site|shop|cloud><br>debitos-sp-2025.<club|com|lat|net|online|store|xyz><br>de3trasn2025.<click|fun|life|online|xyz><br>departamentodetran2025.<click|icu|lat><br>detran2025.<click|icu|lat|sbs><br>l1cenciamento-detran2025.<click|icu|lat|sbs><br> <br><a href="https://infosec.exchange/tags/lookalikes" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>lookalikes</span></a> <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dns</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybercrime</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infoblox</span></a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infobloxthreatintel</span></a><br> <br><a href="https://urlscan.io/result/802374b7-6c8b-433b-b6e0-32561f74b7d3/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">urlscan.io/result/802374b7-6c8</span><span class="invisible">b-433b-b6e0-32561f74b7d3/</span></a><br><a href="https://urlscan.io/result/721b12bb-d5fe-4c7e-b2b5-724e07aa22e0/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">urlscan.io/result/721b12bb-d5f</span><span class="invisible">e-4c7e-b2b5-724e07aa22e0/</span></a></p>
grey<p>For some reason people are sharing llm garbage instead of the real chat logs for black basta. Here are the real logs and the telegram channel they're being shared in: https://t[.]me/shopotbasta/21</p><p>CTI is a team sport. Not a secret boys club. Sharing is caring. <a href="https://infosec.exchange/tags/CTI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CTI</span></a> <a href="https://infosec.exchange/tags/GAYINT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GAYINT</span></a> <a href="https://infosec.exchange/tags/CTIFORALL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CTIFORALL</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/BlackBasta" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>BlackBasta</span></a> <a href="https://infosec.exchange/tags/Ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Ransomware</span></a> <a href="https://infosec.exchange/tags/Leak" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Leak</span></a></p>
CTI.FYI<p>🚨New ransom group blog post!🚨</p><p>Group name: flocker<br>Post title: Eservices.gov.zm<br>Info: <a href="https://cti.fyi/groups/flocker.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">cti.fyi/groups/flocker.html</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ransomware</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a></p>
Infoblox Threat Intel<p>We researched the domains involved and found that some had been registered at NiceNIC, which we recognize as a problematic registrar located in China. This connection to China aligns with the type of pig-butchering / fake crypto platform scams that we're seeing. What makes this case unique is the use of political disinformation as a lure. <br> <br>An important lesson here is how adtech is being misused to facilitate disinformation and fraud. This is a trend you're probably familiar with if you've been following our content.<br> <br>Sample of identified domains: ecno26r4jj[.]com, affiltrack5681[.]com, client[.]fx-trinity[.]com, smartbrokerreviews[.]top<br> <br><a href="https://infosec.exchange/tags/pigbutchering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pigbutchering</span></a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>scam</span></a> <a href="https://infosec.exchange/tags/disinformation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>disinformation</span></a> <a href="https://infosec.exchange/tags/canada" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>canada</span></a> <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dns</span></a> <a href="https://infosec.exchange/tags/mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mastodon</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybercrime</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infoblox</span></a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infobloxthreatintel</span></a><br>3/3</p>
The New Oil<p>A <a href="https://mastodon.thenewoil.org/tags/US" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>US</span></a> <a href="https://mastodon.thenewoil.org/tags/Treasury" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Treasury</span></a> <a href="https://mastodon.thenewoil.org/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntelligence</span></a> Analysis Designates <a href="https://mastodon.thenewoil.org/tags/DOGE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DOGE</span></a> Staff as ‘<a href="https://mastodon.thenewoil.org/tags/InsiderThreat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InsiderThreat</span></a>’</p><p><a href="https://www.wired.com/story/treasury-bfs-doge-insider-threat/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">wired.com/story/treasury-bfs-d</span><span class="invisible">oge-insider-threat/</span></a></p><p><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://mastodon.thenewoil.org/tags/politics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>politics</span></a></p>
CTI.FYI<p>🚨New ransom group blog post!🚨</p><p>Group name: handala<br>Post title: Israel Police Hacked<br>Info: <a href="https://cti.fyi/groups/handala.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">cti.fyi/groups/handala.html</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ransomware</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a></p>
Alexandre Dulaunoy<p>Vulnerability Report – January 2025</p><p>With significant improvements in gathering sightings and vulnerability information in recent weeks, vulnerability-lookup has become a great resource for automatically generating vulnerability threat landscape reports.</p><p>The tooling is open source and you can reuse it or extend to add your own sources, sighting or improve it.</p><p>We have many ideas for vulnerability-lookup project and we welcome new contributors.</p><p><a href="https://infosec.exchange/tags/cve" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cve</span></a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>opensource</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>vulnerability</span></a> <a href="https://infosec.exchange/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>vulnerabilities</span></a> <a href="https://infosec.exchange/tags/fosdem" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>fosdem</span></a> </p><p>🔗 Report <a href="https://www.vulnerability-lookup.org/2025/02/01/vulnerability-report-january-2025/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">vulnerability-lookup.org/2025/</span><span class="invisible">02/01/vulnerability-report-january-2025/</span></a><br>🔗 Open source code <a href="https://github.com/vulnerability-lookup/vulnerability-lookup" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/vulnerability-looku</span><span class="invisible">p/vulnerability-lookup</span></a><br>🔗 Online version <a href="https://vulnerability.circl.lu/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">vulnerability.circl.lu/</span><span class="invisible"></span></a><br>:github: org <a href="https://github.com/vulnerability-lookup" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/vulnerability-lookup</span><span class="invisible"></span></a></p><p>The project team will be also present at hackathon.lu (April 8th and 9th, 2025 in Luxembourg) <a href="https://hackathon.lu/projects/#vulnerability-lookup" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">hackathon.lu/projects/#vulnera</span><span class="invisible">bility-lookup</span></a></p><p><span class="h-card" translate="no"><a href="https://social.circl.lu/@circl" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>circl</span></a></span> <span class="h-card" translate="no"><a href="https://fosstodon.org/@cedric" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>cedric</span></a></span></p>
Infoblox Threat Intel<p>Mastodon communities, be vigilant! Bad actors are creating accounts within the Fediverse and then using them to distribute malware. We identified one such case in which the threat actor had gone undetected since 2022. That Mastodon instance was one with a climate change focus. The threat actor was distributing an information stealer through their account. <br> <br>We are happy to have helped the instance owner figure out why they have been on blocklists intermittently for the last few years, but also get that particular threat out of their Mastodon instance and safe for users. <br> <br>There are undoubtedly many more of these across the Fediverse. Hopefully more awareness can get them detected and shut down faster. <br> <br>For our fellow security nerds... this was <a href="https://infosec.exchange/tags/vidar" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>vidar</span></a> malware with sha256 975932eeda7cc3feea07bc1f8576e1e73e4e001c6fe477c8df7272ee2e0ba20d <br>and a c2 IP 78[.]47[.]227[.]68 from the instance. <br>there is still at least one more Mastodon instance impacted that we are trying to reach. <br> <br><a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/stealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>stealer</span></a> <a href="https://infosec.exchange/tags/mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mastodon</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybercrime</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infoblox</span></a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infobloxthreatintel</span></a> <a href="https://infosec.exchange/tags/fakeaccounts" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>fakeaccounts</span></a> <a href="https://infosec.exchange/tags/c2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>c2</span></a></p>
ReynardSec<p>Ever seen a single QR code that can lead you to two different URLs? 🤯</p><p>Christian Walther just demoed that. He merged two QR codes in such a way that each “pixel” can be interpreted as black or white, depending on angle, focus settings, or even plain luck. Same device, same scanner - yet sometimes you get <a href="https://mstdn.social/@isziaui" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">mstdn.social/@isziaui</span><span class="invisible"></span></a>, other times it’s <a href="https://github.com/cwalther" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/cwalther</span><span class="invisible"></span></a>.</p><p>While this is currently just a wicked proof-of-concept, it’s a red flag for possible future scams</p><p>Check full thread: <a href="https://mstdn.social/@isziaui/113874436953157913" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">mstdn.social/@isziaui/11387443</span><span class="invisible">6953157913</span></a></p><p><a href="https://infosec.exchange/tags/socialengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>socialengineering</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>programming</span></a></p>
Taggart :donor:<p>A detailed, well-written, and hilarious breakdown of the details of CVE-2024-55591, one of the latest Fortinet fiascos:</p><p><a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntelligence</span></a> <a href="https://infosec.exchange/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE</span></a></p><p><a href="https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">labs.watchtowr.com/get-fortire</span><span class="invisible">kt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/</span></a></p>
Taggart :donor:<p>A fantastic meta-analysis of Telegram cybercrime channels. I suspect there is ample material in these findings to start building hunts for new threat actors, or even to collect new <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> based on common patterns in posts.</p><p><a href="https://arxiv.org/html/2409.14596v2" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">arxiv.org/html/2409.14596v2</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntelligence</span></a></p>
Taggart :donor:<p>A gentle introduction to the threat intel sharing process: <a href="https://www.infernux.no/Expanding-on-CTI/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">infernux.no/Expanding-on-CTI/</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntelligence</span></a></p>
Taggart :donor:<p>Hey hey! More <a href="https://infosec.exchange/tags/eBPF" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>eBPF</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malware</span></a> in the wild, this one targeting Juniper devices.</p><p><strong>EDIT:</strong> I don't think this is eBPF. As was pointed out in the replies, this is a BSD-based OS, which does not normally implement eBPF. Also I'm not seeing any eBPF code here. This would appear to be plain old-school BPF.</p><p><a href="https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.lumen.com/the-j-magic-sho</span><span class="invisible">w-magic-packets-and-where-to-find-them/</span></a></p><p><a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntelligence</span></a></p>
ReynardSec<p>Has anyone already encountered something like this? 🚨 </p><p>"g.co, Google's official URL shortcut (update: or Google Workspace's domain verification, see bottom), is compromised. People are actively having their Google accounts stolen."</p><p><a href="https://gist.github.com/zachlatta/f86317493654b550c689dc6509973aa4" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">gist.github.com/zachlatta/f863</span><span class="invisible">17493654b550c689dc6509973aa4</span></a></p><p><a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>phishing</span></a></p>
CTI.FYI<p>🚨New ransom group blog post!🚨</p><p>Group name: incransom<br>Post title: RETAL Baltic Films<br>Info: <a href="https://cti.fyi/groups/incransom.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">cti.fyi/groups/incransom.html</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ransomware</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cti</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a></p>
ExploreLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload