Animalware

Reverse engineer, hardware developer and Amiga fan boy

[Animalware @ReEnElec]

@elasticseclabs But your example shows two executables 54 and 57/77 on VT. Doesn't feel to impressive by your agentic SOC to detect this....

[Tino aka Paladin316 @Paladin3161]

I just open-sourced SPARK (Powered by BYO-SECAI) — an analyst-driven platform for turning Research → Intel → Hunt → Detection

Built to treat analyst research as first-class intelligence and carry it all the way into hunts and detections. https://t.co/K7H2Oz9C8y
#ThreatHunting

[Andrew Oliveau @AndrewOliveau]

🔥Introducing a new Red Team tool - SessionHop: https://t.co/oU2R60ayPD

SessionHop utilizes the IHxHelpPaneServer COM object to hijack specified user sessions. This session hijacking technique is an alternative to remote process injection or dumping LSASS. Kudos to @tiraniddo for first discovering this years ago.

Blue Team tip: Look for unusual child processes spawning from HelpPane.exe

[Animalware @ReEnElec]

@Maks_NAFO_FELLA I'm so tired of the orange man. Probably should start a botnet doing desinformation just like Russia and start fighting fire with fire.

[Mandiant (part of Google Cloud) @Mandiant]

One compromised Microsoft Entra ID or Azure account can lead to a full tenant takeover.

Our new framework ranks roles by risk and adds strong MFA + secure admin workstations to protect the most critical accounts.

Read the whitepaper: https://t.co/9NMapg6mVj

[Thomas Roccia 🤘 @fr0gger_]

Awesome new threat report from Google Threat Intel Group documenting how threat actors are leveraging Gemini. A lot of information and actionable avalable in the report! Great work 👌

https://t.co/0ktEQbUhmq

[Animalware @ReEnElec]

@NVIDIAGeForce GeForce Day

[Animalware @ReEnElec]

@UK_Daniel_Card How do you define edge?

[Animalware @ReEnElec]

@fr0gger_ A Russian driving license? Why?

[Animalware @ReEnElec]

@alexalbert__ Opus breaks, output around 80% of an answer. Then it reverts everything and still charge for the non existing answer.

[Animalware @ReEnElec]

@WarMonitor3 Probably a new scam coin...

[Florian Roth ⚡️ @cyb3rops]

We’re seeing a clear trend: attackers are bypassing the endpoint entirely. Not just avoiding traditional EDR-monitored systems by pivoting to embedded and edge devices, but now also operating purely in the cloud. No shell, no malware, no persistence on the endpoint. Just an OAuth token and full access to whatever’s in the victim’s Microsoft 365, Google Workspace, or AWS console.

It’s a complete inversion of how things used to be. The endpoint, once the weakest link, is now usually the most monitored, most policy-enforced part of the infrastructure. You’ve got EDRs, SIEM integration, automation, threat hunting - the full stack. But attackers don’t need to touch it anymore.

Instead, they go after the new soft spots:

- Cloud platforms, where logging is limited, expensive, or off by default
- Network devices and appliances, which are practically blind spots - obscure OSes, no EDRs, hard to monitor, hard to forensicate.
- Embedded systems and IoT junk that no one really knows how to secure, but that sit in critical network paths.

Cloud especially is a mess:

- Logging tiers cost extra and the good stuff is behind paywalls.
- Detection content is lacking, both from vendors and the community.
- You don’t get memory dumps or full control like you do on endpoints.
- You’re at the mercy of the provider when it comes to visibility and response.

And that’s the shift: attackers aren’t hacking computers anymore. They’re hacking trust relationships, identities, and APIs. The whole idea of detection and response needs to evolve with that. Otherwise, we’re securing the hell out of endpoints while attackers happily fish through mailboxes and cloud shares from halfway across the planet.

[Animalware @ReEnElec]

@VP Not an honor to have you there!

[Animalware @ReEnElec]

@WhiteHouse Dump, pump and Trump day?

[Protect Kamala Harris ✊ @DisavowTrump20]

🚨NEW: Elon Musk has called Senator Mark Kelly (D-AZ) a “traitor” after visiting Ukraine this weekend. Kelly is a 25-year U.S. Navy pilot veteran and retired astronaut.

RETWEET if you stand with @CaptMarkKelly against Elon Musk’s unpatriotic attacks!

[Tom Dörr @tom_doerr]

A specialized build of `curl` that mimics the behavior of browsers like Chrome,Firefox, and Safari to avoid anti-bot measures in web scraping and automated HTTP requests

[Matcluck @doopsec]

Just released SCCMHound! A BloodHound collector for SCCM. SCCMHound allows both attackers and defenders to construct BloodHound datasets using the vast
amount of information that is stored/retrievable through SCCM. Feel free to take it for a spin!

https://t.co/3J1IjEfDmO

[Animalware @ReEnElec]

@abuse_ch Awesome! Have been looking for this!

[Simplicio Sam L. @marsomx_]

onedrive.exe (phoneactivate.exe #lolbin) side-loads tampered sppc.dll which in turn loads onedrive.dll and decrypts it with RC4 systemfunction033 and hardcoded key. The decrypted payload appears to be related to #havoc (h/t @embee_research @elasticseclabs) with the mentioned C2.

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Erik and @jonasl’s Network Fingerprinting talk is now online. It covers #JA4 and #JARM by @4A4133, @lcamtuf’s #p0f and @xnih’s Satori.
Thanks to @netnod for having us!
https://t.co/qrt9s7rz4b