GoodOmens

Head of Security Operations and Yandex Cloud Detection and Response @ Yandex Cloud Protecting everything digital. Daily. Can find things. Twits are my own

[GoodOmens @SomeGoodOmens]

@craiu Costin, I advise you to return to K at least one time from my family personal experience :)
We had a really GREAT journey together! Thank you!

[SwitHak (👁) @SwitHak]

🛡️BlueTeam CheatSheet * #Log4Shell CVE-2021-44228* | Last updated: 2021-12-11 0040 UTC
↘️
https://t.co/gamCpn8AmH

[GoodOmens @SomeGoodOmens]

Some browser extensions can be really shady: https://t.co/zq6vOzcem7

[Jeff Esposito @jeffespo]

Now up at @TheSAScon #sasathome @_marklech_ & @2igosha - full story: https://t.co/dTe9wvQtI7 #MosaicRegressor

[Kris McConkey @smoothimpact]

“The world has become one giant web application.” - @k8em0 at @TheSAScon

[Costin Raiu @craiu]

Less than one hour before #sasathome @TheSAScon starts! Join us for awesome announcements, hot research and brilliant speakers! https://t.co/Z89iBdIwkb

[TheSAS2026 @TheSAScon]

f8eae6750519389e078e1eb1bcb3d708
99cd2175108d157588c04758296d1cfc
cef0feefc45e8556f31bb44fa1aecc16
7ed201fa20d25d22b291dc85ae9e5ced

[GoodOmens @SomeGoodOmens]

@TheSAScon In case someone stuck with the one right after this one - we've updated the task a bit, feel free to redownload and reanalyse the jpg file ;)

[GoodOmens @SomeGoodOmens]

Solve challenges, be fast, come to #SASatHome and win access to an awesome training: https://t.co/1ZbWsjbNbF

[TheSAS2026 @TheSAScon]

Wanna prove you are the best threat hunter? #SASatHome Mini #CTF welcomes you!
First 3⃣ winners will get full access to Hunt APTs with #Yara like a GReAT Ninja by @craiu for free.
Solve the puzzles and join us at #SASatHome to know who won!
👇👇👇Ready! Steady! GO-GO-GO! 👇👇👇

[GoodOmens @SomeGoodOmens]

https://t.co/L6EVq3lChY - agenda

[GoodOmens @SomeGoodOmens]

The #SASatHome is coming... and there is a point in agenda that sounds intriguing "A moderately big announcement" by @2igosha and @_marklech_ Believe me ;)

[Costin Raiu @craiu]

Hey all, after #yara, which training would you like to see next on https://t.co/dTMcNbOC0g ? 👇

[GoodOmens @SomeGoodOmens]

Overview of big threat actors who has Linux implants for desktop and servers: https://t.co/7yNtwBv3QU
Should be interesting for organizations users who are running Linux

[GoodOmens @SomeGoodOmens]

Tomorrow we will be showing importance of YARA, some tricks from real-life indecent analysis and how you can master it using our new training. Please come to discuss and maybe even win one ticket to the training:
https://t.co/uIYqYGEtWL

[GoodOmens @SomeGoodOmens]

Starting today our training: "Hunt APTs with yara like a GReAT Ninja" is available online on-demand!
63 videos + 200 hours of virtual lab access (20+ APT hunting exercises)
Your trainer will be mr @craiu
More info: https://t.co/1P1xROgVXj

[GoodOmens @SomeGoodOmens]

Open source can be different...

[John Lambert @JohnLaTwC]

It steals emails, mines coins, remotely loads Python modules from Github, has a dashboard, supports Windows/Linux/MacOS, is open source, and is written in #Python 🦎
🌐https://t.co/RnsUhGeyGv
🔗https://t.co/kKlPAZcKbF
��https://t.co/X92h7zhlCt

[x0rz @x0rz]

A Google search on "MjM0NzEzMzkyNjM5MzA=" reveal some of the accounts used by this mercenary APT. This is quite interesting.

[GoodOmens @SomeGoodOmens]

Tomorrow we will held one more GReAT Ideas session. A lot of things starting from cyber mercenaries, traditional APTs and some OSINT tricks. Please come tomorrow: https://t.co/2I05grevIG

[GoodOmens @SomeGoodOmens]

Very interesting research: cyber mercenaries targeting forex, fin tech , traditional investment and law firms

[Ivan Kwiatkowski @JusticeRage]

Our research on the new(?) mercenary APT DeathStalker is finally out! https://t.co/wJlDIJ1Twq
Please take a look if you're interested in Evilnum or Janicab!
(cc @securechicken)

[Boris Larin @oct0xor]

IE 11 and Windows zero-day exploits used in #PowerFall operation. Technical details: https://t.co/zthsJwRbiR