Maelström (meɪlstrɒm)

Hello Friend. I'm here to protect you. Be kind.

[Maelström (meɪlstrɒm) @MaelSecurity]

@xxdesmus @iHeartMalware @defcon @malwrhunterteam @JCyberSec_ @cyb3rops Damn! it's my first time in US, and first time at @defcon and i cant meet you guys :/

#sad

[Maelström (meɪlstrɒm) @MaelSecurity]

It's confirmed! I will be at the @defcon this year to meet all of you!

Who would like to catch up and grab some drinks and talk about fighting with cyber criminals? :)

@iHeartMalware, @malwrhunterteam, @xxdesmus, @JCyberSec_, @cyb3rops
? :)

#defcon

[Maelström (meɪlstrɒm) @MaelSecurity]

@iHeartMalware @defcon @malwrhunterteam @xxdesmus @JCyberSec_ @cyb3rops Naaah! I was hoping to see ya there :/

[Maelström (meɪlstrɒm) @MaelSecurity]

Hi @scribd can you point me to your security team? Thanks!

[Karsten Hahn @struppigel]

RE Tip. If you want to decrypt obfuscated .NET strings, just call them from Powershell. E.g. this is xWorm config decryption.

File: https://t.co/c2GuaZAu66

[Maelström (meɪlstrɒm) @MaelSecurity]

HAHHAHAHAHAHAHAH

pay-to-russia[.]com

[Maelström (meɪlstrɒm) @MaelSecurity]

@LisaForteUK "Our data, in the middle of the street" ;)

[Maelström (meɪlstrɒm) @MaelSecurity]

@LiEnbyy @ashleygjovik Please go and read a little bit about it. Even top groups were releasing loaders.

And loader can be distributed without content, it may be used with original code/medium

[Maelström (meɪlstrɒm) @MaelSecurity]

@Level1MGU44 @ashleygjovik Read the EULA/TOS, you cant reverse engineer it, and modify it.

[Maelström (meɪlstrɒm) @MaelSecurity]

@Level1MGU44 @ashleygjovik When you but software/movie you own one ("1") personal license, without perimssion to distribute it, multiply it and then copy it. You own the medium (cd/dvd/bd/pendrive/whatever) not the content which is intellectual property of the owner.

[Maelström (meɪlstrɒm) @MaelSecurity]

@Level1MGU44 @ashleygjovik Oh come on :) the source cracked/distributed/get paid for it and it's not it's fault? :) you are joking right?

[Maelström (meɪlstrɒm) @MaelSecurity]

@Level1MGU44 @ashleygjovik "Piracy is on the user's side" - can you elaborate on that? so the user who uses it is responsible, or the cracker/hacker who modified the code and get's paid from user to use it?

[Maelström (meɪlstrɒm) @MaelSecurity]

@Level1MGU44 @ashleygjovik Imagine stripping off copy protection and then distributing it (paid or free) - there you break the laws and intelectual property.

Movies are completly different regulations, not comparable to software

[Maelström (meɪlstrɒm) @MaelSecurity]

@Level1MGU44 @ashleygjovik I tend to disagree, there are copyrights laws, piracy is when you re/crack and then distribute it freely or paid. You don't own the code (even if you bought it, check EULA/TOS) and reversing it/cracking/distributing you are abusing intellectual property.

[Maelström (meɪlstrɒm) @MaelSecurity]

@xxdesmus @Cloudflare @CloudflareHelp yup i requested it in abuse, but if you can take it down from your service (cloudflare) that would be great :) thanks!

[Maelström (meɪlstrɒm) @MaelSecurity]

@Cloudflare @CloudflareHelp can you please take down this domain ?

bnp-partner[.]com

it's phishing for BNP Paribas Bank that is hidden behind your service. This is urgent as this website gathers people banking informations. Abuse request sent via email.

Thanks!

cc: @xxdesmus

[Maelström (meɪlstrɒm) @MaelSecurity]

Hi @Cloudflare @CloudflareHelp Can you prevent this type of mass hostname under one doman phishing spam to be created on your service?

#phishing #multiplehostnames #cloudflare

[Maelström (meɪlstrɒm) @MaelSecurity]

@urlscanio @JCyberSec_ Ah, these are Polish. I'm looking for this type of campaigns but targetting UK or IT (

[Maelström (meɪlstrɒm) @MaelSecurity]

Does anyone have #phishing samples/screens/domains from #UK and #Italy where #Inpost brand is used ?

@JCyberSec_ ?