Set Abominae

[Set Abominae @Set_Abominae]

@nextronresearch @sigma_hq Seems to be an extra l in Haperlock?

[Set Abominae @Set_Abominae]

*OCD

[Set Abominae @Set_Abominae]

@cyb3rops Thanks, but missing a newline after GrandCrab? My OCS is also triggering on the missing . before APPX :)

[Set Abominae @Set_Abominae]

@cyb3rops @virustotal Thanks, nice update. btw; .CS is listed twice under form/type

[urlquery @urlquery]

Some tips for using search! :)
Part of a URL:
https://t.co/k3rlZEjyRN
Hash:
https://t.co/SEdPehrwPw
File magic:
https://t.co/5XeA2RgD07

[Set Abominae @Set_Abominae]

@cyphort Seems more like SunDown EK. Both patterns and traffic I've seen matches SunDown. RIG is not changed: https://t.co/rMyafkeGka

[Set Abominae @Set_Abominae]

@_MDL_ btw, the qisuqxizt.dyndns. biz entry on your site is nuclearpack not angler ;-)

[Set Abominae @Set_Abominae]

@_MDL_ POST to /mzfile.php = TeslaCrypt.

[Set Abominae @Set_Abominae]

@kafeine wow, what a mess.. Exploit/Payload URLs changed as well?

[Kafeine @kafeine]

Angler EK is changing its Landing URI pattern again. https://t.co/5ubzl3jXz7

[Set Abominae @Set_Abominae]

@BroadAnalysis @Techhelplistcom looks like Bedep / Adfraud

[Set Abominae @Set_Abominae]

@rubinsaifi No, I got no hits on that. Sorry.

[Set Abominae @Set_Abominae]

Angler EK seems to be changing URL pattern again: "<domain>/topic/<10 digits>-<random words separated with ->/" #angler #exploitkit

[Set Abominae @Set_Abominae]

@malware_traffic @kafeine URLs seems alot like Nuclear to me, sure it is Spartan?

[Set Abominae @Set_Abominae]

@Techhelplistcom @JAMESWT_MHT @malware_traffic Looks like Bedep Ad-Fraud / AlphaCrypt

[Set Abominae @Set_Abominae]

Last week CryptoWall decrypt domains and IPs. http://t.co/GY5qb4pHqd

[Omri Herscovici @omriher]

I've released a new tool: CapTipper - Malicious HTTP traffic explorer tool
http://t.co/pw9znVG38m

[Kafeine @kafeine]

Neutrino is back! CVE-2014-6332 embedded in a flash http://t.co/GkGaP7OIuN @TimoHirvonen @Malc0de @EKwatcher @node5

[Kafeine @kafeine]

Ooh! CVE-2014-0569 (identification by @TimoHirvonen ) fixed one week ago, is in Fiesta. (post will come later).

[Kafeine @kafeine]

CVE-2014-0556 in Nuclear Pack [+thx beeg .com for timely promoting Cryptowall's health] http://t.co/vrigjTwupA