Cystrat

Company based in Germany for #SIEM #DFIR #IncidentResponse #Consulting

[Cystrat @Cystrat_GmbH]

@d4rkm4tter Enjoy I wish you all the best

[Cystrat @Cystrat_GmbH]

@jimchang Hab ich gesehen xD

[d4rkm4tter (Mike Spicer) @d4rkm4tter]

Virtual tour of @computex_taipei, this place is crazy.. and that's only one walkway.
#Computex2024 #ApexStorage

[Cystrat @Cystrat_GmbH]

Rapid7 Observed Exploitation of Critical MOVEit Transfer Vulnerability | Rapid7 Blog https://t.co/mTCyy2ubfm

[Cystrat @Cystrat_GmbH]

@UK_Daniel_Card 1234

[Cystrat @Cystrat_GmbH]

Look at this guys!!!

[Cybersecurity and Infrastructure Security Agency @CISAgov]

🚨We released an ESXiArgs ransomware recovery script on GitHub to allow organizations to attempt recovery of virtual machines affected by the ESXiArgs ransomware attacks: https://t.co/cXpP1m03yw #StopRansomware

[Cybersecurity and Infrastructure Security Agency @CISAgov]

🚨We released an ESXiArgs ransomware recovery script on GitHub to allow organizations to attempt recovery of virtual machines affected by the ESXiArgs ransomware attacks: https://t.co/cXpP1m03yw #StopRansomware

[BleepingComputer @BleepinComputer]

CISA releases recovery script for ESXiArgs ransomware victims - @LawrenceAbrams
https://t.co/SEGn94SKem

[Ransomwaremap @ransomwaremap]

#DEU #cyberattack Einkleider Bogner Commerce GmbH von Cyberangriff betroffen. Tracked by @MatthiasNehls

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has discovered Raspberry Robin activity establishing its role in a complex, interconnected malware ecosystem that facilitates human-operated ransomware. Our latest blog details active operations and links to other malware and threat actors: https://t.co/Wm5nH3UQp9

[Florian Roth ⚡️ @cyb3rops]

New blog post: Capturing Detection Ideas to Improve Their Impact

https://t.co/j15fDRuUDY

[Florian Roth ⚡️ @cyb3rops]

Deliver a Strike by Reversing a Badger: Brute Ratel Detection and Analysis | by @splunk

https://t.co/hbyv9d2pTk

[Florian Roth ⚡️ @cyb3rops]

There are these days ... 🚬⛽️💥

[BleepingComputer @BleepinComputer]

New NullMixer dropper infects your PC with a dozen malware families - @billtoulas
https://t.co/hA9zn8W5W2

[proxylife @pr0xylife]

#Qakbot - bb - url > .zip > .iso > .lnk > .js > .cmd > .dll

wscript C:\Users\*\AppData\Local\Temp\breezily\streaking.js

cmd /c C:\Users\*\AppData\Local\Temp\breezily\Asquith.cmd

regsvr32 /s C:\Users\*\AppData\Local\Temp\breezily\torpors.dll

IOC's
https://t.co/v2q0dBvhD7

[Janggggg @testanull]

CVE-2022-36804 PoC 🧐
https://t.co/VOWswcy3Hm

[Nathan McNulty @NathanMcNulty]

If you have secrets in PowerShell scripts, at the very least, log in with the account that will be running the script and do the following:

Get-Credential | Export-CliXml -Path $env:USERPROFILE\creds.xml

In your script:

$creds = Import-CliXml -Path $env:USERPROFILE\creds.xml

[Florian Roth ⚡️ @cyb3rops]

Evading the AV by using legitimate tools — from C2 tunneling, to discovery, data encryption, exfiltration and persistence — a more and more common pattern

https://t.co/3txc9m7WWP

[Sophos X-Ops @SophosXOps]

3 attackers, 2 weeks – 1 entry point...

Lockbit, Hive, and BlackCat attack an automotive supplier in this triple #ransomware attack.

After gaining access via RDP, all three threat actors encrypted files, in an investigation complicated by event log clearing and backups.

1/17

[vx-underground @vxunderground]

Reporter @omerbenj has obtained screenshots from early versions of the infamous Pegasus android spyware.

Pegasus, developed by Israeli firm NSO group, has been used by various organizations to spy on individuals.