AdamTheAnalyst

Cyber Threat Intelligence Specialist & STIX Evangelist - Tweets about #ThreatIntelligence #Malware #Ransomware #ThreatHunting #FINCrime ~ pronouns:He/Him

[Socket @SocketSecurity]

🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.​io.

Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems.

TrapDoor targets #crypto, #DeFi, AI, and security developers, stealing wallets, SSH keys, cloud credentials, GitHub tokens, browser data, env vars, and API keys.

Socket detected releases with a median detection time of 5 minutes, 27 seconds. The fastest detection occurred 58 seconds after publication.

[Hunter @HunterMapping]

🚨Alert🚨 CVE-2026-1731 (CVSS 9.9): Remote code execution in Remote Support (RS)
and Privileged Remote Access (PRA)
📊 2.5M+ Services are found on the https://t.co/g3tSyh1Boc yearly.
🔗Hunter
Link:https://t.co/aqFhp2xMa5
👇Query
HUNTER : https://t.co/yFFcJwegJK="BeyondTrust Privileged Remote Access"||https://t.co/yFFcJwegJK="BeyondTrust Remote Support"
📰Refer:https://t.co/NjbbLJ5hNp
#hunterhow #infosec #infosecurity #OSINT #Vulnerability

[Cyber Security News @The_Cyber_News]

⚠️ Cloudflare Zero-Day Vulnerability Enables Any Host Access Bypassing Protections

Source: https://t.co/BBJAp1bRZq

A critical zero-day vulnerability in Cloudflare's Web Application Firewall (WAF) allowed attackers to bypass security controls and directly access protected origin servers through a certificate validation path.

The requests targeting the /.well-known/acme-challenge/ directory could reach origins even when customer-configured WAF rules explicitly blocked all other traffic.

The vulnerability was detected while reviewing applications where WAF configurations blocked global access and permitted only specific sources.

#CybersecurityNews #vulnerabilitynews

[Steven Lim @0x534c]

From LNK to PlugX: Tracking UNC6384’s Zero-Day Abuse Chain

https://t.co/lbvbIpST2g

Chinese threat actor UNC6384 is actively exploiting a newly disclosed Windows LNK zero-day vulnerability (ZDI-CAN-25373) to target European diplomats with PlugX malware via Canon DLL sideloading, as reported by Arctic Wolf Labs. The initial stage involves a malicious LNK file embedded in EU/NATO-themed spearphishing emails—making early detection of shortcut file execution a critical warning signal. I’ve authored a Microsoft Defender XDR detection rule to catch this abuse chain and help teams stay ahead.🤝

#Cybersecurity #ZeroDay #ZDICAN25373

[Steven Lim @0x534c]

Proactive detection for UNC6040 (aka ShinyHunters)

https://t.co/QlsjzTluRM

Google's Threat Intelligence Group outlines security strategies to defend against UNC6040, a financially motivated threat actor using voice phishing (vishing) to compromise Salesforce environments. The attackers trick users into approving malicious connected apps, enabling data theft. The blog provides proactive hardening measures, logging protocols, and detection techniques to protect SaaS platforms, especially Salesforce. Below is a Seninel KQL detection for UNC6040 built based on GTIG report.

https://t.co/tm0lX0At6w

#Cybersecurity #UNC6040 #ShinyHunters

[Steven Lim @0x534c]

🚨 SpyVPN Alert
https://t.co/xaMZl7BcVC, a Chrome extension with 100K+ installs & a “Verified” badge, was caught secretly capturing screens & sending data to its servers.
https://t.co/Q4BEu68faT

I built a KQL to track screenshot activity via MDE—great for spotting suspicious apps.
https://t.co/7oSQgDSwqX

#CyberSecurity #DataExfiltration #MDE #KQL

[ACE Responder @ACEResponder]

Windows lateral movement quick reference

#ThreatHunting #DFIR

[Steven Lim @0x534c]

🚨 CVE-2025-8088: WinRAR Zero-Day Used to Deploy RomCom Backdoors

ESET has identified spearphishing campaigns leveraging malicious RAR attachments to exploit CVE-2025-8088—a WinRAR zero-day vulnerability. This technique delivers RomCom backdoors, attributed to threat actor Storm-0978 (aka Tropical Scorpius / UNC2596).

https://t.co/daMXLc64nn

To support fellow Defenders, I’ve crafted a KQL detection to surface indicators of this exploitation. It’s designed to help identify Storm-0978 activity until your infrastructure team rolls out the necessary patch.

https://t.co/8Pyya29H0L

#Cybersecurity #WinRaRZeroDay #Storm0978

[BleepingComputer @BleepinComputer]

Amazon AI coding agent hacked to inject data wiping commands - @billtoulas
https://t.co/L1b7qgdQM7

https://t.co/L1b7qgdQM7

[Microsoft Threat Intelligence @MsftSecIntel]

Customer guidance for SharePoint vulnerability CVE-2025-53770

[André Baptista @0xacb]

DMARC can reveal more domains associated with a target.

https://t.co/IOZqvIUCEX<target-domain> allows you to find domains using the same DMARC record. Check it out 👇

There's also a python tool: https://t.co/MgbyS42HSn

[SANS DFIR @sansforensics]

🔥 The NEW #CTI Cheat Sheet by @likethecoins & Rebekah Brown is now available!

Packed w/ frameworks & methodologies this guide simplifies threat modeling, tackles cognitive biases, & sharpens your analysis.

📥 Download your FREE copy: https://t.co/Y6HoB8N55S

#ThreatIntel #DFIR

[tuckner @tuckner]

CyberHaven malicious extension (24.10.4) details 🧵

A new content script was added to the extension manifest which runs at the start of every webpage

[Christopher Stanley @cstanley]

Cyberhaven breach reported. Employee phished and pushed malicious chrome extension.

Command and Control:
149.28.124.84
cyberhavenext[.]pro

File Hashes:
content.js AC5CC8BCC05AC27A8F189134C2E3300863B317FB

worker.js 0B871BDEE9D8302A48D6D6511228CAF67A08EC60

[Adam Chester 🏴‍☠️ @_xpn_]

This hack is brilliant, APT28 hopping into a target environment over wifi by compromising neighbouring companies and finding a dual-homed host within range.

https://t.co/mGWU5Hdwi6

And yet... they got caught doing this!

[AdamTheAnalyst @AdamTheAnalyst]

Shout out to all the Windows tech's going round deleting C-00000291*.sys on critical systems this morning. #ThoughtsAndPrayers

[AdamTheAnalyst @AdamTheAnalyst]

@RobelCampbell Potential Distro Infra:

https://t.co/imFo2KDiHa

https://t.co/OKvHCgHSWm

[Julien Hoez @JulienHoez]

A Chinese military training site in China's Inner Mongolia region is an exact replica of the road network near Taiwan's Presidential Palace.

Make no mistake: China fully plans to invade Taiwan in a geopolitical play that will unbalance the region.

[Florian Roth ⚡️ @cyb3rops]

I have created a YARA rule to detect binaries that are signed with a potentially compromised AnyDesk signing certificate

(if the PE header info isn't AnyDesk -> other binaries signed with the compromised cert)

#100DaysOfYARA #AnyDesk
https://t.co/W42dTSWj0K

[Germán Fernández @1ZRR4H]

🚩 This is worrying and continues to increase, multiple threat actors, including ransomware operators and initial access brokers, are abusing the @GoogleAds service, but at a higher level. Attackers manage to show the original domain (URL) in the malicious ads, which is eventually displayed to thousands of potential victims on Google's main results page.

Three recent examples, thanks to Intel from Colin Cowie (Sophos) and Jérôme Segura (Malwarebytes) 👏

1.- #Pikabot (I think this is new 👀)
▪ https://t.co/lfQGVaYU3T
▪ https://t.co/9rbnbeqLbP

2.- #BatLoader
▪ https://t.co/N5fmR7HOaw

3.- #FakeBat + Hunting Panel:
▪ https://t.co/CU7E0k6uPT

🚨 DON'T TRUST Ads, be cautious, investigate, confirm.