Aseel K

Senior Researcher @Google Mandiant

[Ivan Kwiatkowski @JusticeRage]

Kaspersky released a new blogpost today, documenting an iOS 0day + zero-click exploit used to target cybersecurity researchers. The scope and full victimology are still unknown.
https://t.co/yXC1aDwLCv

[Itay Cohen 🌱 @megabeets_]

I'm very excited to share our latest research which uncovers a malicious firmware implant for TP-Link routers, linked to Chinese state-sponsored APT group #CamaroDragon.

Read our blog @ https://t.co/yRTGWuKPXi >>

[Ivan Kwiatkowski @JusticeRage]

.@securechicken and I just released a major update on Tomiris, with some important implications for attribution. https://t.co/2sn3q8tDiJ

In it, we study the links between Turla and Tomiris again. Our assessment is that they're separate threat actors.

[The Citizen Lab @citizenlab]

NEW REPORT: SWEET QUADREAMS: A first look at #spyware vendor QuaDream’s spy tools, victims and customers.
We identified traces of suspected exploit deployed against iOS versions 14.4 and 14.4.2 and possibly other versions as zero-day vulnerability. https://t.co/u7jcxJpu9H

[Avigayil Mechtinger @AbbyMCH]

Happy to share my first blog as part of @wiz_io 🪄🧙

Cloud is complex and so it's attack surface. If you are interested in learning about #cloudforensics I recommend reading this!

https://t.co/NcbGTkPtlQ

[Runa Sandvik @runasand]

New reporting by @ronenbergman and @MarkMazzettiNYT says the U.S. government purchased a surveillance tool from NSO called Landmark. The tool allows the operator to identify someone’s location based on their phone number. https://t.co/0SoW43diaa

[Check Point Research @_CPResearch_]

Amid the crisis in Azerbaijan’s breakaway region of Nagorno-Karabakh, our new report reveals Azerbaijani political surveillance using #OxtaRAT malware:

🕵️AutoIT/JPEG polyglot file
🎯Targets activists in Azerbaijan🇦🇿 and entities in Armenia🇦🇲

Read more >>
https://t.co/qq8VU6bIyC

[Volexity @Volexity]

Learn about #malware analysis & reverse engineering with @Volexity's @r00tbsd at #DFRWSEU2023! In this workshop, use #ghidra to disassemble #ransomware, analyze encryption techniques + attempt to restore encrypted files. Conference schedule is here: https://t.co/S3GSacMrPI #dfir

[Sekoia @sekoia_io]

#Karkadann (#Candiru) domains, mostly typosquatting Azeri websites. #ThreatHunting ⤵️
checkhotel[.]net
vergisorgula[.]com
koronamiyim[.]com
opinionlimit[.]org
seffafxeber[.]com
parkdev[.]net
captivelogin[.]net
olkem[.]net

[Aseel K @CurlyCyber]

@0xfmz @CultureCrave @StephenAtHome LOL I lost all hope..

[Tufail Ahmed @7ufail]

Part 1 focuses on how the attackers leveraged this novel persistence technique via VIBs loaded with malware. These passive backdoors enabled threat actors to connect to the ESXi server and run commands on guest virtual machines through vmtoolsd.exe.
https://t.co/3RAdQ5cN0G

[Félix Aimé @felixaime]

If you want to boost your daily use of @virustotal, get pcaps, extract indicators from behaviours, open the files from Maltego, pivot from the codes to the infrastructre and vice versa. These @MaltegoHQ transforms are for you😘.

[Daniel Lunghi @thehellu]

Our latest research on Iron Tiger #APT (APT27/Emissary Panda) has been released. It discloses a supply chain attack on a chat application. Delivered malware is the infamous #HyperBro family, and a new malware family targeting Mac OS and Linux named rshell https://t.co/XbtjqvAN45

[Gen Threat Labs @GenThreatLabs]

📢We don't just use #YARA at Avast, we contribute to the community too! Our latest addition is that we are making our YARA Language Server (#YLS) #opensource https://t.co/trgFAHSB3R. Learn how you can start using it in the blog post by @KastakMatej: https://t.co/dGzPGdXnt9

[Ivan Kwiatkowski @JusticeRage]

A massive update from @securechicken on the threat actor we track as DeathStalker (its Evilnum cluster specifically): https://t.co/DBKFWu2evZ
Despite a lot of coverage on them these days, the groups remains unabashedly active.

[Ivan Kwiatkowski @JusticeRage]

New blog post about an UEFI firmware bootkit!
https://t.co/zDXWFOjf7z
Research was led by our dearly missed @_marklech_

[Félix Aimé @felixaime]

GUESS WHU?⤵️ _ _ N D _ _ _ (PS: Check your logs. 1/5)

nusantaraqurban[.]com
7aqibatmosafer[.]com
padpay[.]org
pinkbulldoginu[.]com
shopscreen[.]org
syrianinfo[.]com
mailclick[.]info
servers-mail[.]net
gerillaonline[.]net

[Itay Cohen 🌱 @megabeets_]

Two #0day exploits were used against targets in the Middle East, and led to the deployment of Candiru's #DevilsTongue spyware!

- Heap BOF in WebRTC, Chromium (CVE-2022-2294)
- LPE in a 3rd party driver

Great finding by the team @ @AvastThreatLabs!

https://t.co/03GtyS8Eno

>>

[Ivan Kwiatkowski @JusticeRage]

Today I had the great honor of delivering #PTS22's keynote on ethics in cyberwar times.

It is a continuation of the work I started at VB2019 and feels more relevant than ever today. This talk is very important to me. You can watch it here: https://t.co/BCini217aT

[Alexey Firsh @alexey_firsh]

Awesome news for all Android researchers!
@virustotal is now supporting searches by package name with "androguard_package" keyword.

Please keep in mind it affects only newly (re) analyzed files, so it will take some time.

Here is an example of default #FinSpy package name: