Chaplin

[InfoGuard Labs @InfoGuard_Labs]

New blog post is live: a deep dive into the BravoX ransomware group — covering their TTPs across the attack chain, from initial access to exfiltration and impact, with a closer look at their tooling and notably their negotiation approach.
https://t.co/6z2sMWIsQV

[Chaplin @ChaplinSec]

@InfoGuard_Labs 😎

[InfoGuard Labs @InfoGuard_Labs]

In this blog post, we share our research on the #VIPERTUNNEL Python backdoor found during a DragonForce Ransomware Incident. We'll examine infrastructure hunting, its code, and how its obfuscation has evolved (spoiler: it changed a lot).
https://t.co/Adu0aeKnTG

[BSidesFrankfurt @BSidesFRA]

Cracking Compromised Edge Devices

Join Evgen Blohm and Marius Genheimer from SECUINFRA Falcon Team for a deep dive into forensic investigations of compromised edge devices from Cisco, Fortinet, Citrix, and Ivanti. Discover the exploits used, the motives of nation-state and cybercriminal attackers, and creative techniques for analyzing these complex appliances. Gain practical tips to investigate and secure your network equipment in this eye-opening session!

https://t.co/eqD9xFIioD

[BSidesFrankfurt @BSidesFRA]

BREAKING! Save the date!

Workshops at BSidesFrankfurt on Thu, August 28, 2025.

First come, first serve. Details soon - block your calendar Thu+Fri!

[BSidesFrankfurt @BSidesFRA]

Exciting News! The date and location for the next BSidesFrankfurt are officially set! Mark your calendars:

Friday, August 29, 2025, at Campus Westend, Goethe University.

Stay tuned for ticket sales and further updates. In the meantime, revisit past recordings and help spread the word!

We’re also looking for sponsors - a great opportunity to support the cybersecurity community and gain valuable exposure. If you're interested, reach out to us!

Recordings (updated monthly): https://t.co/EZYr5XjFtX

[SECUINFRA FALCON TEAM @SI_FalconTeam]

🚨Malware distributed via Steam

Fancy a bit of after work gaming? Beware of infostealer malware distributed via the Steam store!

Using @steamdb we managed to visually identify a very suspicious file in the game files. Luckily, we managed to retrieve a sample for analysis, which will follow in this thread.

[BSidesFrankfurt @BSidesFRA]

This year's #BSidesFrankfurt is bigger and better, now at University Campus Frankfurt. Join us for insightful tracks, international keynotes, and a special kids' track with hands-on hacking courses. Interested in inspiring young minds? We're seeking volunteer teachers!

[Chaplin @ChaplinSec]

@vxunderground @InvictusIR

[SECUINFRA FALCON TEAM @SI_FalconTeam]

Great catch @StopMalvertisin #APT29🎣! We created a #Yara hunting rule to look for similar SVGs and found this sample:

test.svg
MD5: 5d327af805d36036c79cca2a027c1168
First seen: 2023-06-10

Uses a b64 encoded payload called test[.]zip, contains a legit procexp64.exe.
1/2🧵

[Chaplin @ChaplinSec]

@Volexity @volatility @tlansec @attrc Are also going to stream the sessions?

[SECUINFRA FALCON TEAM @SI_FalconTeam]

📰 #ESXiArgs #Ransomware is currently affecting more than 2000 #ESXi #Hypervisors around the world. In our lastest blog post we detail the analysis of the #malware artifacts, new #Yara rules to detect it and recommendations to keep your systems safe.
➡️ https://t.co/APl3Kmdqfi

[SECUINFRA FALCON TEAM @SI_FalconTeam]

Picking up where we left off yesterday: We created two #Yara rules for the #Magniber #Ransomware delivery method. You can find them in our GitHub Repository and on @abuse_ch Yaraify ⬇️ Have a nice weekend and happy hunting ��

https://t.co/O3cxL7Gp2K

https://t.co/lzFEUZfR76

[Alessandro Di Carlo @samaritan_o]

Great research! Keep this path in mind if you're having trouble finding evidence of execution:

"C:\Windows\appcompat\pca”

New Windows 11 Pro (22H2) Evidence of Execution Artifact! https://t.co/x9kcmxbelG

[SECUINFRA FALCON TEAM @SI_FalconTeam]

We analyzed a recent #Bitter #APT attack from their active campaign against Bangladesh featuring Microsoft Office exploitation, their #ZxxZ 2nd stage #backdoor and a previously undocumented #espionage tool we call #AlmondRAT.
You can read our report here: https://t.co/fhL1qa6EE6

[Chaplin @ChaplinSec]

@c3rb3ru5d3d53c @malwrhunterteam @Myrtus0x0 @f0wlsec

[Nathan McNulty @NathanMcNulty]

This is super cool!

Idea 💡

Sign up for Defender for Endpoint trial:
https://t.co/JLCzPYvjd1

Azure credits:
https://t.co/Q8vXBvY9Em

Set up Streaming API to a Storage account:
https://t.co/zTkRwrVnhv

Generate data with Atomic Red Team and similar. For 30d, expect ~1GB/device.

[Malwrologist @DissectMalware]

Puzzled why a yara rule did or didn't match?

Let me introduce https://t.co/cY3G5MeOk6, a web-based #yara #debugger!

With #YaraDbg, you can see the:
1⃣ evaluation steps
2⃣ matched strings
3⃣ relationship among the rules

[James @jamesspi]

If you're using @elastic agent with the @osquery manager integration, remember that you can run @yararules on demand, or schedule them, or both!

[SECUINFRA FALCON TEAM @SI_FalconTeam]

🚨N-W0rm Analysis Part 2 is now online 🚨

#nw0rm YARA: https://t.co/Dd7XtkWgPg

Article Part 1: https://t.co/5e9gilkqDt

Article Part 2: https://t.co/JWmZVpNxLj

#DFIR #Malware #infosec #CyberSecurity #YARA #100DaysofYARA