João Marques

[Proton @ProtonPrivacy]

The 8th edition of the Proton Lifetime Charity Fundraiser is here!

🎟️ Enter the raffle for a chance to win 1 of 10 Lifetime plans

💜 Help us support 10 community-nominated organizations

🎁 NEW: We’re giving away an additional Lifetime plan through a social contest.

⬇️1/6

[Bryan Palma @BryanJPalma]

It’s been a busy couple of days at @Trellix, with many of our teams working through the weekend to help customers: recover from the outage, understand what went wrong at CrowdStrike, and update them on the latest adversarial intelligence.

[Bryan Palma @BryanJPalma]

Very difficult situation for many customers across the world. CrowdStrike support is overwhelmed. I have mobilized our Trellix Customer Support team to assist any CrowdStrike customers who need assistance with restoring their endpoints. #TrellixThrive #StandTogether

[Trellix Advanced Research Center @TrellixARC]

Over two years, our team analyzed & enhanced threat intelligence for Operation Morpheus. Learn about the data we shared with law enforcement to assist in the dismantling of Cobalt Strike's infrastructure from @John_Fokker, @JMarques15, & @LeandroNVelasco. https://t.co/34F2IsbZDY

[Trellix Advanced Research Center @TrellixARC]

In June, we debuted Ghidra scripts for analyzing Go-based malware. @Libranalysis, in collaboration with @pad0rka, updated the scripts to now include:
➡️ Support for Golang 1.20
➡️Support for MachO files
➡️Resolved to-do segments

Find the scripts here: https://t.co/vnnFNH8UP1

[Trellix @Trellix]

Despite takedown attempts in 2021, Emotet resurfaced, and threat actors continue to use it today. @TrellixARC’s @Adi_Cha_, @JCMarques15, and Raghav Kapoor explore its evolution and current TTPs. Read to learn more. https://t.co/VE5rMMqSuv

[Trellix Advanced Research Center @TrellixARC]

Head of Threat Intelligence @John_Fokker shares our observations on cybercriminal behavior from over a year virtually staked out in the Genesis Marketplace — these insights ultimately assisted law enforcement in the market’s takedown. Hear more. https://t.co/dh2rqYzYjl

[Trellix Advanced Research Center @TrellixARC]

Malware Analyst @Libranalysis provides a technical look at the “Read The Manual” (RTM) Locker gang, including a deep dive into their Windows ransomware executable, on the blog. https://t.co/DVGMazzeKx

[Trellix Advanced Research Center @TrellixARC]

Threat actors’ use of Microsoft OneNote to spread Qakbot marks a novel malware distribution strategy. Our researchers detail how they deobfuscated and unpacked it, and extracted its configurations. Read more. https://t.co/IpsCRI2MqK

[Trellix Advanced Research Center @TrellixARC]

@John_Fokker, @_Fritto_, @tim_hux, @Jeffrey_Sman, & @JCMarques15 shared our take on the global ESXiArgs ransomware attack, exploiting CVE-2021-21974. More: https://t.co/J14wFUMWlp

[Threatray @threatray]

Check out our newest blog post on linking and tracking UAC-0056 tooling through code reuse analysis.

https://t.co/SvtJBM4GEa

#threatintel #malware #graphiron

[Trellix Advanced Research Center @TrellixARC]

This week VMware observed ransomware actors targeting CVE-2021-21974, a remote code execution vuln allowing an attacker to exploit the OpenSLP protocol. More on the global ESXiArgs ransomware campaign on the blog. https://t.co/J14wFUMWlp

[Proton Mail @ProtonMail]

Email tracking protection is now available on the Proton Mail iOS app too!
Learn more here: https://t.co/rG7WabO5GK

[Maarten Botterman @Maarten_Bman]

“Don’t focus on flashy visualization - choose the way that fits. We are not in a casino - sometimes a simple spreadsheet may be the best visualization of data. It needs to make sense for the user.” A reality check by @John_Fokker - @TrellixARC during #cyberconf22

[Fuck You I Quit @fuckyouiquit]

Here’s her gofundme legal fund. Internet do your thing. Thanks to @priyadesai for the find.

https://t.co/U7YwdqU1uJ

[Max 'Libra' Kersten @Libranalysis]

Finished my presentation at @BlackHatEvents @ToolsWatch's Arsenal! Had an absolutrle blast presenting! DotDumper is now live, find it here: https://t.co/hVdrkyQQ84

[kanav 1 @kanavjain]

We made the unfortunate decision to let go of 20% of our team. They are extremely talented, please do not hesitate to hire them. Here's a spreadsheet with their names: C:/MyDocuments/Accenture2022/bottom_20_underperformers_v6_FINAL.xlsx

[Raj Samani @Raj_Samani]

Exploitation of Follina — A Microsoft Office Code Execution Vulnerability appears to be hitting 23 countries, details/IoCs via @TrellixLabs https://t.co/STNCBqhDTF #cybersecurity #malware H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker @JCMarques15

[VirusTotal @virustotal]

Good news for the @MISPProject's user community! Now you can export your VT Graph into a MISP event (Download as>MISP Event) including all relationships and (optionally) the VT report for all the indicators.

[Christiaan Beek @ChristiaanBeek]

and a more generic rule to cover more suspicious #lolbins being fired up by Word: https://t.co/hPytUrmkup