Georges Bossert

Hacking and building stuff. Focused on #CTI, Intrusion Detection, #SIEM, #SOAR, Indicator Sharing, Protocol Reverse Engineering and ML @sekoia_fr @sekoia_io

[Félix Aimé @felixaime]

Proud to share a new report written by my teammate Coline on the 🇨🇳 cyber threat "A three beats waltz: The ecosystem behind Chinese state-sponsored cyber threats" ➡️ Read it here: https://t.co/RwyEutjzDJ

[Sekoia @sekoia_io]

Since mid-2023, the Sekoia #TDR team has investigated an infrastructure which controls compromised edge devices transformed into Operational Relay Boxes (#ORBs) used to support operations of multiple 🇨🇳 intrusion sets.

Check out the full report ⤵️

https://t.co/2YVw3x3vJP

[Elastic Security Labs @elasticseclabs]

#ElasticSecurityLabs is exposing Banshee Stealer — a brand new macOS infostealer with ties to browsers and cryptocurrency. This MaaS collects an immense amount of data, but you can get the details and protections here: https://t.co/kthMoyRVG4

#malware #cryptocurrency #macos

[The Citizen Lab @citizenlab]

🚨 NEW REPORT by @citizenlab in collaboration with @accessnow, @DeptFirst, Arjuna Team and https://t.co/JjT4QPjgGi uncovers a sophisticated and highly-personalized #phishing campaign targeting civil society members in the US and Europe, including Russian opposition in exile, NGOs, and media outlets.

Report led by @jsrailton & @PDXbek with @edok_lotosov and @RonDeibert:

https://t.co/D2W8g2Qz3y

[Kennedy @run2obtain]

🔔 Emulating and Detecting Scattered Spider-like Attacks 🔔

@cyber_mitigant recently collaborated with @sekoia_io on a blog article articulating the practical implementation of a Threat-Informed Defense strategy on @awscloud infrastructure.

🌟 We leveraged the Mitigant Cloud Attack Emulation to implement several @MITREattack techniques used by the Scattered Spider threat actor. Then, the Sekoia SOC platform detected these attacks via a combination of Cyber Threat Intelligence and XDR.

✨ The article walks you through the interplay of cloud attack, threat detection, alert fine-tuning, CTI usage etc, illustrating the critical thinking process and practical efforts imperative to tackling the evolving threat landscape.

✅ Several lessons for cloudy defenders are highlighted, including the importance of adversary emulation for threat detection and response, leveraging CTI to enhance contextual detection accuracy, important AWS Cloudtrail event names, and strategies for fine-tuning alerts to overcome alert fatigue.

💥 For more details, check out the blog article 👉 https://t.co/kVqGIQXfCj

#threatdetection #threatanalysis #cyberthreatintelligence #cloudsecurity #awssecurity #cisos #securityoperations #cloudsecurity #detectionengineering #mitreattack

[SSTIC @sstic]

Le PDF des actes (recueil des articles) du SSTIC 2024 est en ligne : https://t.co/cmZcpGDfhA

#sstic #sstic2024

[Félix Aimé @felixaime]

Securing the #Olympic Games and evaluating associated threats has become a trending topic recently. Don't forget to read the @sekoia_io TDR analysis... published six months ago 🙃 https://t.co/z888mBT0pP

[Sekoia @sekoia_io]

We are proud to announce that Sekoia #TDR team contributed to the joint international law enforcement operation #OperationEndgame, targeting the notorious botnets #IcedID, #Smokeloader, #SystemBC and #Pikabot

https://t.co/06MMzOzuxh

[SSTIC @sstic]

Challenge update: Exceptionnellement cette année, le classement qualité considèrera des solutions incomplètes allant au moins jusqu'à la résolution du chapitre 3 (inclus). La description de solutions pour les chapitres 4 et 5 sera pris en compte favorablement.

[crep1x @crep1x]

Latest ACR Stealer C2 domains:
trxh.]xyz
trxh.]xyz
trxq.]xyz
trxu.]xyz

Stealer configuration on the URL "/ujs/9adbbdfd-2661-43e4-8280-7f9a9698f912"

Deobfuscation:
- base64
- XOR {38 35 32 31 34 39 37 32 33 00}

Configuration: https://t.co/cjSg04cLW2

https://t.co/RoWRSVF9Hd

[Sekoia @sekoia_io]

Our latest blog post provides an introduction to #AWS detection engineering. We present the main log sources #CloudTrail #FlowLogs #GuardDuty for AWS, as well as some relevant events that defenders could use to detect attackers

https://t.co/toqpcnsn74

[SSTIC @sstic]

Toutes les places de l'édition 2024 ont été vendues. Merci pour votre fidélité !

#sstic #sstic2024

[SSTIC @sstic]

Il ne reste plus beaucoup de places pour SSTIC 2024. Si vous voulez venir, pensez à prendre votre place rapidement:

https://t.co/TfJZ7RNpM2

#sstic #sstic2024

[SSTIC @sstic]

La billetterie de sstic ouvrira jeudi 11 avril à 10h. Retrouvez les informations utiles sur https://t.co/kFSgrS6UsE #sstic2024

[SSTIC @sstic]

Le programme de SSTIC 2024 est en ligne : https://t.co/q5JABKJSZm
Les inscriptions devraient ouvrir la semaine prochaine, nous allons donner plus de détails très prochainement.

[SSTIC @sstic]

La billetterie de #SSTIC 2024 ouvrira dans les prochains jours. Retrouvez toutes les informations préparatoires pour que tout se passe dans les meilleures conditions:

https://t.co/kFSgrS6UsE

#sstic2024

[SSTIC @sstic]

The SSTIC challenge 2024 is now opened and english friendly! You can find it here : https://t.co/rQT7iLwttY! Good luck!

[SSTIC @sstic]

Le challenge 2024 ouvrira le vendredi 29 mars à 16h00, heure de Paris

[CERT Orange Cyberdefense @CERTCyberdef]

🤝For the last months, our World Watch team collaborated with @sekoia_io TDR team to investigate and demystify Residential Proxies #RESIP and highlight their systemic growth and the transparency issues surrounding their sourcing ⤵️
https://t.co/KwJAx4RIYE

#cti @orangecyberdef

[SSTIC @sstic]

Les https://t.co/4fOpxulbj1.s de soumissions #SSTIC devraient avoir reçu leurs mails d'acceptation ou de refus.

Regardez dans vos spams si vous ne le trouvez pas :)

Merci à tou.te.s !

Nous communiquerons prochainement sur le challenge, le programme et la billetterie.