William MacArthur

Director of Threat Research & Intelligence @InQuest: All views expressed are from my own brain. “Sharing is caring”

[InQuest @InQuest]

In an era of sophisticated ⚠️ cyber-attacks, 📝 documenting attack sequences is crucial for proactive🛡️ prevention.

🔗 Read our blog by @anti_Expl0it for a view on threat sequencing and its significance ➡️ https://t.co/JnLYEh3cEj

#ThreatSequencing #ThreatIntel #Cybersecurity

[InQuest @InQuest]

InQuest and @Threatlabz have analyzed #MysticStealer, a new malware family that extracts data from various sources, including web browsers and cryptocurrency wallets, through its obfuscation techniques ➡️ https://t.co/HizIFN6JSL

#Malware #CyberSecurity #Cryptocurrency

[William MacArthur @Anti_Expl0it]

This is super exciting both personally and professionally. 🦄

[InQuest @InQuest]

📣 We are honored to welcome Chief Intelligence Officer, Darren Spruell ➡️ https://t.co/tvjmAWTEa8

As a long-time collaborator in intelligence-sharing 🧠 communities, Darren has led efforts to maintain data-sharing 🤝relationships in critical industries.

#intelligence #FDR

[Pedram Amini @pedramamini]

New @InQuest blog post covering the recent rise of Microsoft OneNote as a malware carrier:

https://t.co/xv42zk97Qf

We cover the timeline, campaigns, and tools. You can find downloadable samples and YARA detection logic at:

https://t.co/TPfcXLOh5U

https://t.co/EFlERv5jcJ

[InQuest @InQuest]

The holidays are here. Be careful what gifts you open!

https://t.co/5Vzf0AtH7O

#ransomware #threatintel

[InQuest @InQuest]

📌 Watch our intro video, access our open research portal:

https://t.co/RiizgVygv3

Follow our Blog:

https://t.co/pEskgV9DF4

See our open-source work:

https://t.co/i4Bbuvag9u

Connect on LinkedIn:

https://t.co/15IwmH7xKg……

Tweets with 🤖 are InQuest Labs automation.

[InQuest @InQuest]

Some field notes on an active and successful Phishing campaign that leverages a low-detection document-based lure, to pivot through various hosting providers. Samples, IOCs, and more:

https://t.co/iaYCpTYXMV

#phishing #malware #malwareanalysis

[Pedram Amini @pedramamini]

I'm very excited to share that after countless sleepless nights we're having a break-out year at @InQuest and are looking to double in size in the near term. We're seeking senior talent in both research & development as well as sales & marketing:

https://t.co/YnS4cjl9ge

[InQuest @InQuest]

We've just added a notion of "collections" to the file corpus (DFI) of https://t.co/drAloDkYJv. Included today are files from InQuest Macro Clustering (~10k), the Enron leak (~16k), and those from the dataset used in the "Invoice #31415 attached" research paper (~15k).

[BleepingComputer @BleepinComputer]

Historic Hotel of America leads to modern malware for their guests. Why securing your inbox with more than just anti-malware engines is needed to prevent cybercrime attacks.

Sponsored by @InQuest

#cybersecurity #emotet #phishing
https://t.co/M7hsoU9UoG

[InQuest @InQuest]

Looks like #Qbot is back in action. Green Lure seen at least, where is the blue :P

https://t.co/dW59hMfu6l

5.254.118.]198
91.194.11.]15
146.70.87.]163

@James_inthe_box
@Cryptolaemus1
@Anti_Expl0it
@Autow00t

[InQuest @InQuest]

Low scoring #maldoc using @OhioHealth, protected file in the lure.

https://t.co/xJ1McLGM7D

@Anti_Expl0it
@James_inthe_box
@executemalware

[William MacArthur @Anti_Expl0it]

@pr0xylife @InQuest @LockheedMartin @linode @James_inthe_box @juanandres_gs @h2jazi Similar Files:
d1b5961f259b9af90d8c191f679b996c7321d00a17363a7639eb74fa9428b91b
2cd87dddfa6ff50e1949c6bfc2962ea96d1a6c3edaa6a0df973a7d83710ca8de
0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1
0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b

[InQuest @InQuest]

As a follow up to the previous graphic outlining threats affecting #Ukraine, here is a high level blog on observed threats. Big thanks to the #infosec community for making this possible, #SlavaUkraini

@Anti_Expl0it
@Autow00t
@juanandres_gs
@flakpaket

https://t.co/n9IKK9KXNj

[InQuest @InQuest]

Interesting Doughnut 0 VT Score for a "Test?" Doc leading to #Metasploit

https://t.co/XfKBOTb2mS

FYI: We heard some others seeing some waves of this week.

@James_inthe_box
@Anti_Expl0it
@executemalware
@Autow00t

[InQuest @InQuest]

#Hancitor run looks like using Efax Lure - Password is 44

https://t.co/npHq9NBtjn

@James_inthe_box
@Anti_Expl0it
@Cryptolaemus1

[InQuest @InQuest]

An update our previous graphic we shared on the cyber-front of the #ukraine conflict. This content was collected from various sources and collaborations within the #infosec community. Special thanks to all involved.

@Anti_Expl0it
@Autow00t
@juanandres_gs
@flakpaket

[William MacArthur @Anti_Expl0it]

<3 @feli_macarthur https://t.co/6EX0og9iyH

[InQuest @InQuest]

We are sharing this visual for tracking threat actors/groups related to the current #ukraine conflict. The content was collected from various sources within the #infosec community. Special thanks to all involved.

@Anti_Expl0it @Autow00t @juanandres_gs

[InQuest @InQuest]

This is an odd one here with extreme uri length + directory traversal flavor a+ .dotm file suffix.

AS37963 - ALIBABA (US) TECHNOLOGY. Note

https://t.co/ZJubCbd7al

@James_inthe_box @JRoosen @Anti_Expl0it @dms1899