Mario Samolis

Incident Responder, memory forensics, malware analysis.

[Microsoft Threat Intelligence @MsftSecIntel]

Attackers are targeting open-source software ecosystems at scale, using coordinated and repeatable approaches that take advantage of dependency chains and maintainer trust models to distribute malicious packages across widely used registries. https://t.co/Gh6lgCtIHM

The use of AI is reducing barriers to entry, enabling high‑volume package creation and faster iteration of malicious code. At the same time, shifts in coding patterns and tooling behaviors can provide defenders with signals to better identify and track adversary activity.

These campaigns increasingly focus on the software supply chain itself, targeting the tools, libraries, and pipelines used to build and distribute applications. As a result, a single compromised component can propagate across complex dependency trees and significantly expand impact.

Learn more from Microsoft Security’s Allie Luhrs and Mario Samolis from their talk at this year’s Blue Hat USA on the Microsoft Threat Intelligence Podcast, hosted by Sherrod DeGrippo.

[Prof. Feynman @ProfFeynman]

If you're not having fun, you're not learning. There's a pleasure in finding things out.

[Microsoft BlueHat @MSFTBlueHat]

🎤 BlueHat speaker announcement

Mario Samolis and Allie Luhrs, Senior Security Analysts, Microsoft, are taking the stage at BlueHat with a deep dive into one of today’s most persistent supply chain threats.

Their research analyzes more than 1,300 npm packages tied to DPRK-linked activity, including FAMOUS CHOLLIMA and the Contagious Interview campaign. What stands out is not just the scale, but how structured these operations are: weekday release cycles, repeated payload reuse, and a sophisticated C2 infrastructure that leverages trusted hosting platforms to evade detection.

In this session, they’ll share:
➤What this activity looks like over time
➤How to spot patterns others might miss
➤How their attribution model distinguishes malicious from benign packages with a strong margin

#BlueHat

[Mario Samolis @MarioSamolis]

@lazarusholic @runpanther

[Mario Samolis @MarioSamolis]

@marryevan999 Nano

[Mario Samolis @MarioSamolis]

@Zephyr_hg NEWS

[Mario Samolis @MarioSamolis]

@RussianPanda9xx Looks like a modern version of the "American Gothic" painting

[Prof. Feynman @ProfFeynman]

If you are a Student, open this it's important 👇

[Mario Samolis @MarioSamolis]

@sapirxfed Got that look of determination going on.

[Mario Samolis @MarioSamolis]

@xtremepentest #

[Prof. Feynman @ProfFeynman]

You're under no obligation to remain the same person you were a year ago, a month ago, or even a day ago. You are here to create yourself, continuously.

[Florian Hansemann @CyberWarship]

Defense Evasion Series Part 1 AMSI Bypass

#redteam #pentest #infosec
https://t.co/Ofvn8EJ7Tz

[Mario Samolis @MarioSamolis]

@SecShoggoth I'm sure it is one of the boxes full of random cables/cords that we all have just sitting in closet somewhere.

[Mario Samolis @MarioSamolis]

@SecShoggoth @BSidesROC I feel that way every time I go back through a case. It seems like there is always more information to find or understand no matter how much analysis you already did.

[Mario Samolis @MarioSamolis]

@DFIRmadness @Ell_o_Punk Completely agree here. The trick is to not let your stress overpower your ability to perform. Just be yourself and your will do fine.

[Mario Samolis @MarioSamolis]

@Ell_o_Punk Congratulations. The first one is always the best. Great feeling of accomplishment.

[Mario Samolis @MarioSamolis]

@SecShoggoth @tazwake Not sure if they still do it, but they have a virtual queue that opens up at 9am and if your quick enough you can snag a spot. I would have the queue all ready setup with my family and once 9am hit I would queue up immediately.

[Mario Samolis @MarioSamolis]

@DFIRmadness As far as I am aware, Microsoft pushed out a fix for it earlier this month.

[SANS.edu Internet Storm Center @sans_isc]

seeing some ssh usernames that attempt to exploit #log4shell #log4j

[Mario Samolis @MarioSamolis]

@SecShoggoth Yes please