5hid

Cyber Security & Malware Analysis enthusiast

[vx-underground @vxunderground]

> get on social media
> nerds arguing about anti cheats
> nerds discuss antiviruses
> "anti viruses shouldn't be in kernel mode"

You are absolutely correct. Please have the anti-malware vendors migrate their detection engines to user-mode. Nothing bad could happen.

[NtAlertThread @ElementalX2]

New Research!

https://t.co/2U5JKUV3ce

Mustang Panda delivers @HDFC_Bank thematic campaign, while delivering another campaign targeting South Korean geopolitical entities. We found they are leaving messages for security researchers posting IOCs at X, also mentioning @MDSecLabs !

[Reverse Engineering and More @re_and_more]

RE tip of the day: To debug a DLL in IDA, set the path to the loader (for example, rundll32) in the Application field and the path to the DLL with the name of the export function in the Parameters field. Don't forget to set the breakpoints!
#infosec #malware #reverseengineering

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

NEW BLOG: The Great VM Escape 💕

We caught threat actors deploying a VMware ESXi exploit toolkit in the wild - potentially was a zero-day developed over a year before VMware's disclosure 👀

If anyone has thoughts on it let me know, but I needed almost a full case of beer to wrap my head around this one 🍺

Full technical breakdown 👇
https://t.co/wXT9c7ytVh

[blackorbird @blackorbird]

The Art of Pivoting - Techniques for Intelligence Analysts to Discover New Relationships in a Complex World

This book explores how intelligence and cyber-security analysts can uncover hidden links between threat actor infrastructure and ongoing investigations by pivoting on both classic and unconventional indicators — many of which are often overlooked.

The material is grounded in empirical, field-tested strategies used in cyber-security, digital forensics, cyber threat intelligence, and intelligence analysis more broadly.

Our goal is to provide analysts with a practical toolkit of analytical methods, supported by real-world examples, to enhance investigative workflows without locking them into a single mindset, strict model, or overly rigid technical strategy.

Instead, the book encourages creative exploration, data-driven reasoning, and the use of diverse data points — from traditional IOCs to subtle metadata traces — as part of a flexible and repeatable analytical process.
#threathunting
https://t.co/IiXTV6p2yY

[Greg Linares (Laughing Mantis) @Laughing_Mantis]

Shoutout to Sandworm aka APT28 and Unit 74455 for implementing my exact Cordyceps backdoor plugin system for Outlook that I wrote in 2017.

Right down to the email triggering mechanism, command system and injection.

https://t.co/vjc6yVCnIL

[vx-underground @vxunderground]

The entire AV, EDR, and SOC industry is a SCAM.

Has your organization been a victim of ransomware? Start the computer in DEBUG MODE. DUH.

Then simply delete the malware. It's as simple as that.

[vx-underground @vxunderground]

In a truly brilliant move, employees from DigitalMint and Sygnia, responsible for handling ransomware negotiations, were indicted for performing ransomware attacks under ALPHV ransomware group.

- Kevin Tyler Martin, ransomware negotiator from DigitalMint
- Ryan Clifford Goldberg, Digital Forensics and Incident Response manager from Sygnia
- Unnamed co-conspirator-1

The motive, per court documents, were the individuals were motivated to "get out of debt".

All 3 men began performing ransomware attacks in May, 2023 and continued performing ransomware attacks until on or around April, 2025. The attacks stopped when the United States Federal Bureau of Investigation approached Ryan Clifford Goldberg regarding the ransomware attacks.

Unsurprisingly, Mr. Goldberg initially denied having any knowledge of the ransomware attacks. However, he cracked during the interview and placed the blame on the currently unnamed co-conspirator. He stated he was recruited by him.

After the interview concluded, Mr. Goldberg and his wife purchased 1-way tickets to France (???). Unsurprisingly (again), he has been detained in France because he is not a citizen of France and France doesn't give a fuck about a non-citizen.

Mr. Kevin Tyler Martin, currently residing in Texas, spoke in 2024 at a technology conference where he spoke about his experiences defending ransomware attacks and handling negotiations.

Both Mr. Goldberg and Mr. Martin have been charged with:
- Violation of the Hobbs Act (18 U.S.C. § 1951) x2
- Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030 (x1)

Under max penalty of law, Mr. Goldberg and Mr. Martin could face as long as 50 years in prison.

[International Cyber Digest @IntCyberDigest]

‼️ Meet Ryan Clifford Goldberg, a Digital Forensics and Incident Response manager at Sygnia, he is one of three insiders accused of cybercrimes. He allegedly conducted cyberattacks using ALPHV BlackCat ransomware.

Goldberg and two other insiders ran ransomware operations since 2023 while employed at cybersecurity firms. After an FBI visit, Goldberg confessed. He now faces up to 50 years in prison.

[S3cur3Th1sSh1t @ShitSecure]

If you're wondering about the attack surface for @TwoSevenOneT's recent publications with PPL spawnage - I let AI write a hacky scanner to see which processes can be spawned as PPL process with a good list of results 🙂

https://t.co/6UMdJHWR6y

[pfiatde @pfiatde]

If you place a dll in a protected folder it will get executed? *mild shock* ... How can this get a CVE? This is a Proxy dll.

[Tijme Gommers @tijme]

Exciting times. I'm publishing Dittobytes today after presenting it at @OrangeCon_nl !

Dittobytes is a true metamorphic cross-compiler aimed at evasion. Use Dittobytes to compile your malware. Each compilation produces unique, functional shellcode.

https://t.co/761G96JDF1

[5hid @5hid_]

Fighting malware to the death ⚔️ @MalFuzzer 's book is arrived!! 🔥

[ESET Research @ESETresearch]

#ESETResearch has discovered the first known AI-powered ransomware, which we named #PromptLock. The PromptLock malware uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly, which it then executes 1/6

[Phrack Zine @phrack]

Phrack turns 40.
The digital drop is live.
Download it. Archive it. Pass it on.
💾 https://t.co/JbEbf6xoVQ
#phrackat40 #phrack72

[ESET Research @ESETresearch]

#ESETresearch has discovered a zero-day vulnerability in WinRAR, exploited in the wild by Russia-aligned #RomCom @dmnsch @cherepanov74
https://t.co/DjAaBJJa5O 1/7

[5hid @5hid_]

I just supported @MalwareVillage on buy me a coffee! 🎉
Love @LambdaMamba Malmons!!

You can buy them a coffee here
https://t.co/2ZMBaAkTWK

[5hid @5hid_]

- lets summon something - @vxunderground

[5hid @5hid_]

Dissect Packed Malware 101

What under the hood:
- 🔬 The anatomy of packed malware;
- ✅ Key indicators to identify packed samples;
- 🔓 Step-by-step examples of manual unpacking;

Read the full blog post here: https://t.co/J51Y4gLExZ

#MalwareAnalysis #ReverseEngineering

[5hid @5hid_]

@vxunderground