Pɍịmẹ̄ ⚡♟️

Offensive Security | Defensive Security | Networking

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

Big win today!

I passed my @ISC2 (CC) exam. 🎉

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@Anyiego0 Sorry, check again.

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

Big win today!

I passed my @ISC2 (CC) exam. 🎉

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@Anyiego0 Yes you can DM.

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@Taphii_ Thanks.

Yes you can.

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@nanayiao @ISC2 Of course you will.

Amen.

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@Giwa404 This guy ehn 😂

Thanks boss

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@twill_citizen Success Ahead.

Congratulations in advance.

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@Nuele_ Yes of course.

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@soccertorey Book Car Youghurt

BUKAYO Saka

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@wildfl0w6r @Tech4DevHQ Congratulations

[Adam | Full stack developer @fullstacklover]

Websites built with PHP today 😂👇

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@kingsleyEz71789 How?

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

Do you remember when you joined X? I do! #MyXAnniversary

Omoh I don reach 4 years 😬

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

4️⃣ It is about understanding the evidence, the gaps, and how confident you should actually be.

Check the full investigation + evidence breakdown:

https://t.co/wYZdFcsw9r

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

I thought IOC analysis was mostly about collecting indicators.

This lab changed that.

I investigated a simulated threat actor campaign and started asking:

- Why these domains?
- Why this infrastructure?
- What does the pattern tell us about the actor?

@_DeejustDee

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

3️⃣ I then correlated the infrastructure with malware metadata, persistence mechanisms, TTPs, victimology and operational timing.

The combined evidence supported an APT28 attribution hypothesis at Medium Confidence.

But attribution is not just about finding a name.

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

2️⃣ The naming also appeared designed to blend malicious traffic into legitimate enterprise activity.

The IOC was no longer just an indicator. It was a clue to the actor's decisions.

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

That is where the investigation got interesting.

The domains used names like:

update, verify, check and secure

At first, they looked ordinary.

But several domains shared infrastructure characteristics, including nameservers and C2 IPs.

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@Pope__gold

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

@CyberMarquez What about you?

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

Learning SOC analysis gives you a different perspective on how attackers think.

That's an advantage when you get into ethical hacking.

Because why u go route traffic to "system-update,org"?

What do you want the SOC analyst to think?

“Oh, just another system update” 😂

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

Threat actor profiling helps organizations prioritize security spending based on the capabilities of the adversaries they actually face.

Defending against APTs may justify investments in advanced EDR solutions while stopping script kiddies might require basic security.

#cyber