ICSNick

Time to leave this platform. If you like to contact me professionally, find me on LinkedIn.

[ICSNick @IcsNick]

Time to leave this platform. If you like to contact me professionally, find me on LinkedIn

[ICSNick @IcsNick]

@RusEmbSwe @MID_RF https://t.co/dWKj0WLxUL

[ICSNick @IcsNick]

@vxunderground @cr0nym 🙋🙋🙋🙋

[ICSNick @IcsNick]

@vxunderground @PentesterLab Yes please

[ICSNick @IcsNick]

@vxunderground @1336_0ff_by_0ne Buffer overflow please

[ICSNick @IcsNick]

@vxunderground @AlteredSecurity Sound awesome

[ICSNick @IcsNick]

@BuschEbba Sverige exporterar mer än dubbelt så mycket el jämfört med Finland men betalar mellan 16 till 32 gånger så mycket. Avsaknad av kärnkraft torde då vara den mindre delen av problemet utan hur prismodellen är konstruerad är systemfelet. Vart är självkritiken som högsta ansvarig?

[ICSNick @IcsNick]

@vxunderground @cyberwarfarelab

[ICSNick @IcsNick]

Hope to see you virtual there!

[SANS DFIR @sansforensics]

Join us at #CTISummit when @IcsNick and Mattias Wåhlén will discuss:

🦗 The rise of Cicada 3301 #ransomware
🔗 Links to the notorious BlackCat group
🔍 TTPs and infrastructure uncovered

➡️ Learn More & Save Your Spot: https://t.co/lHG68IgpY0

#ThreatIntel #CTI #MalwareAnalysis

[ICSNick @IcsNick]

Did a 10 minute lightning talk at @SEC_T_org analyzing the an ESXi ransomware from the new group Cicada 3301 and how we see links to the debunked RaaS BlackCat.
https://t.co/HI16XAQpT0

[ICSNick @IcsNick]

I am glad and humble that @BleepinComputer picked up the analysis I did with @WahlenPMattias regarding Cicada 3301 ransomware and possible connections to AlphV/BlackCat.

[BleepingComputer @BleepinComputer]

Cicada3301 ransomware’s Linux encryptor targets VMware ESXi systems - @billtoulas
https://t.co/RZ9hibsOEP

https://t.co/RZ9hibsOEP

[ICSNick @IcsNick]

@WahlenPMattias and I we have done a deep dive into the new ransomware Cicada3301, including some possible connections to both ALPHV and the Brutus botnet.

https://t.co/vE3rogZyCW

[ICSNick @IcsNick]

@micahk Would the show be called Between two Couches?

[ICSNick @IcsNick]

@jamieantisocial Go Jira Go!

[ICSNick @IcsNick]

CrowdStrike pushes the ultimate security update. All computers become unhackable.

[ICSNick @IcsNick]

@rj_chap @a_olsson - On the proxy server we have Logscale or OMS agent to pushes it to either CrowdStrike or Sentinel

[ICSNick @IcsNick]

@rj_chap @a_olsson We have solved it like this.
- Turn on audit log in ESXi
- Configure it to send the syslog to a proxy server
- In the proxy server we have built a filter that matches on log files or key words that we are interested in (the logs are very verbose)

[ICSNick @IcsNick]

So LockBit = Booger Toilet Sniffer
BlackBasta = Lumpy Toilet Head
Play Ransomware = Doofus Gizzard Tush

So @SwiftOnSecurity @GossiTheDog @rj_chap @TheDFIRReport @thegrugq @BushidoToken @cyb3rops as being CTI though leaders. Are you with me on silly mission?

[ICSNick @IcsNick]

So, Threat Intel community. I think we should change the way we name threat actors, from sound as villains to a more appropriate convention showing their true colors. My suggestion is that we turn to Captain Underpants “Professor
Poopypants name change-o-chart 2000”

[ICSNick @IcsNick]

@rj_chap @TheQueenofELF Anytime. Would love to!

[ICSNick @IcsNick]

Anders Olsson’s and my talk from Security Fest.
Get insights how VMware/ESXi ransomware works, how to recover, how to do incident response and how to protect for it. Also how Captain Underpants can assist in Threat Intelligence.
https://t.co/CRXTMIMQpe

#Truesec