IntelOps

The internet holds vast secrets for those who know how to look

[IntelOps @IntelOpsV3]

How Threat Actors Abuse Legal Processes 🔥

A deep dive look at fraudulent subpoenas, warrants, EDR and the shinyhunters domain seizure

https://t.co/xYm1tqmBsJ

[Chris Duggan @PadelLifeUK]

🚨 UNC6671 INFRASTRUCTURE UPDATE

Two new roots observed:

🌐 myaccountsetup[.]com
🌐 assign-key[.]com

Three spoofed hostnames referencing Blakes, Halliburton and Cox Automotive

Legal, Energy and Automotive.

Tracking live. 👀

#UNC6671 @FBI

[CTI Updates @CTI__Updates]

the Patched hacking forum has been offline for an entire month. They have finally released a statement as to why.

"On September 23, a Russian drone strike on telecommunications facilities in Ukraine damaged the data center hosting our servers. We later learned that the data center holding our backups had also been damaged. Our servers and backups were with two separate hosting providers, but the attack did not affect just one provider; several hosting companies in the region were impacted.

We kept backups in three places: two separate physical devices and one cloud storage service. According to our providers, the drives are in good condition and are waiting in the queue to be copied. Thousands of drives are being recovered, which is why the process has taken so long."

[IntelOps @IntelOpsV3]

@IntCyberDigest

[maeve ~ @miaaowing]

opsec level: 4️⃣

[ɐʞsǝs @akses_0x00]

Todays internet fun is brought to you by the number 4

[IntelOps @IntelOpsV3]

🥰

[CTI Updates @CTI__Updates]

me when I see an @IntelOpsV3 tweet

[IntelOps @IntelOpsV3]

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

https://t.co/lKsNiz7lmk

[OSINT Industries @OSINTindustries]

@OSINT_Tactical Find out more about OSINT Industries training 👇
https://t.co/nBdTR7fWjH

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: A Broadcom Wi-Fi bug lets anyone in range run code on routers without the password.

Quentin Kaiser showed it on Proximus, Orange Belgium and VOO routers and estimates ~1.5M in Belgium are exposed, none patched.

The bug dates to 2010. Broadcom won't assign a CVE.

[IntelOps @IntelOpsV3]

@Coins here kitty kitty

[IntelOps @IntelOpsV3]

taking candy from babies

[CTI Updates @CTI__Updates]

bruh. the WallStreet ransomware group has listed the Girl Scouts of Eastern Massachusetts.

like come on bros...

[Chris Duggan @PadelLifeUK]

🚨 UNC6671 INFRASTRUCTURE UPDATE

Two more hostnames have appeared under myssologin[.]com:

⚖️ kelleydrye.myssologin[.]com
⚖️ willkie.myssologin[.]com

The apparent references are Kelley Drye and Willkie, expanding the cluster to four major law firms.

Tracking live. 👀

[Donncha Ó Cearbhaill @DonnchaC]

Last year, @amnesty revealed technical evidence of spyware firms like Intellexa developing tools for zero-click infection through online ads.

We warned of a dangerous new threat to civil society. Now @citizenlab has caught devices at Al Jazeera being hacked via malicious ads. 🧵

[IntelOps @IntelOpsV3]

Q29 Shifting a bit off topic:

Umbreon, this Canadian exec, and in-between Rey.

Has anyone actually important or vital (to SH) been nabbed to your knowledge?

Both SH leak sites are down (shnyhntww & espeon), and according to Krebs SH has said in response to emails that they are trying to de-escalate, why?

The FBI hack was (supposedly) for rep - what SH is doing now has destroyed that rep.
3 ‘members’ arrested, website down, seemingly no word from the leadership.
I’d like to hear your thoughts, you seem plugged in.

A29 When we're speaking of SH, it's important to acknowledge that the SH we discuss is largely SLSH.

Rey was SLSH in a sense and therefore was SH in a sense. I believe that he was likely one of if not the only orchestrater(s) in the FBIJobs hack.

If the rest of what SH is trying to deescalate, I wouldn't be surprised. Describing him as suicidal is a very apt description for this reason. The FBI hack was this complex of his at the greatest. I don't think he sees it as "destroyed reputation."

There's some glory in suicide. Perhaps he was Japanese! :-)

Perhaps this is my memorial to him.

Or, rather, a memorial to the Rey I considered a friend (and still do, he's just—as they say—no longer with us.)

[IntelOps @IntelOpsV3]

There is a interesting Q&A posted on Rey's telegram. It is not clear who is responding. There are only 54 subscribers to this channel.

⬇️⬇️⬇️I will repost them here below

The questions are posted on the board 9larp and answers posted on TG I will archive them here

[IntelOps @IntelOpsV3]

Q27 Why was rey claimed as a larp of SLSH when yuro [ already been fedded ] and rey created it together?

What happened when rey fellout with the other threat actors in SLSH?

A27 I think he was just claimed as a larp of ShinyHunters.
Not sure what happened in the fallout.

[Dominic Alvieri @AlvieriD]

“ShinyHunters” pulling ALPHV BlackCat ghosts posting a fake seizure banner.

Bro I made the one you’re using 🤡🤡🤡

[Chris Duggan @PadelLifeUK]

🚨 CURRENT SHINYHUNTERS INFRASTRUCTURE

🇺🇸 DataWagon LLC — 3 IPs
🇷🇺 PROSPERO OOO — 2 IPs

Five IPs across two providers. Tracking continues. 👀

#ShinyHunters #ThreatIntel

[IntelOps @IntelOpsV3]

Trezor allegedly hit with implants

[Kim Zetter @KimZetter]

Despite claims by Trezor today that none of its crypto devices have been compromised - unlike the devices of Ledger, its competitor - hardware hacker @joegrand says he found implants in two Trezor devices and reported this to Trezor in August. My story: https://t.co/h5EAN8S1Qk

[IntelOps @IntelOpsV3]

@KimZetter @joegrand thank you

[Kim Zetter @KimZetter]

Ledger was warned last March about implants by hardware hacker @joegrand but apparently did little because no one had yet used implants to steal crypto. That changed last wk with the heist of hundreds of accounts. There is evidence stolen seeds were sent to servers in Hong Kong