B*TCH on Wheels

Walk more Talk Less.

[@CanadianProtest @CanadianPro2]

@Furnace_roofho @BornFree_isms @medsci_yb3r @UCPGoA23 @userlolxxl @albertaradios Bwahahaha!

Me too.

How dare she?

Forgot @TeamNAIT too.

Wonder why she did this?
🤗💖

[B*TCH on Wheels @TeamNAIT]

@CanadianPro2 @Furnace_roofho @BornFree_isms @medsci_yb3r @UCPGoA23 @userlolxxl @albertaradios Weird. @medsci_yb3r told us to leave them alone - not worth any of our time. He tried to reply with he's "happy to meet whoever in-person with documents on-hand" if they have any follow up questions lol.

We're sure you've seen his OCD work too. Something re: Mental Health.

[Clandestine @akaclandestine]

DNS is the layer an operator reads before they touch the app. https://t.co/wA8QhsIVSR scans from the outside, no zone file and no creds, the same vantage as recon: SPF/DMARC, DNSSEC, lame NS, takeover, suspicious TXT, DDNS, parked domains, registrant exposure.
Built by Esteban Borges (@tuitesteban), Octopus at @Huntio and founder of @dnsaudit. Hunt Intelligence hunts C2 and netblocks, and the scanner asks the question he already asks of a domain: who owns it, is the delegation alive, what is dangling.
Three intelligence reads. Lame delegation is a hijack primitive: parent still delegates, child NS stopped answering. Mail policy is campaign prep: DMARC at p=none and MX on a parked domain mean the brand is spoofable before the first lure. TXT and DDNS are pivots, not verdicts: v1.2 claimed 56 TXT patterns and 275 DDNS suffixes. Correlate with age, TLD, and registrar lock. Do not auto-block.
v1.3 adds a Domain Exposure Engine, 26 checks and a separate score: expiry, redemption, transfer, age, DNSSEC, WHOIS privacy. WhoisXML API puts ownership next to the finding. JSON and pip install dnsaudit feed SOAR. It does not replace passive DNS or a sandbox. On their numbers, ~20.9k of ~23.6k scanned domains had a critical finding.
https://t.co/58yqw9Ot5S

[Sandfly Security @SandflySecurity]

Attackers are encrypting payloads to sneak malware past Linux defenses. Spoiler: it doesn't work.Sandfly Founder, @CraigHRowland breaks down the Linux malware trends we're seeing on @DestLinuxPod 👇

[TheCyberPatronNetwork © @TheCyberPatron_]

What does your Digital Footprint say about you?

[B*TCH on Wheels @TeamNAIT]

@medsci_yb3r @UCPGoA23 @userlolxxl @skocherhan @usetraceix @ADanielHill @MalbearLabs @three_cube @UK_Daniel_Card @magicswordio @LevelBlueCyber @CBCEdmonton @TheBreakdownAB @albertaradios @cspotweet @CreesOnCBC @YourAlberta @Treaty8FNA @cybercentre_ca The other device being that @Dell workstation travelling b/w @youralberta @ualberta @AHS_media that contains access to Everyone's PII/PHI ??

That device = a 'Spreader' at best.

That does seem like a problem.

[UAlberta Insider(z) @UCPGoA23]

VirusTotal (6/64):

SHA-256: f7aef71e43e49854e73439866c74c1cc1ae1f81a7824d16cda443ccd5d10ae5f

https://t.co/PukUlGKyDC

@RecordedFuture

https://t.co/QVzKKWcnnz

https://t.co/n6X6eYUswS
https://t.co/s8jxSY7lkO

https://t.co/7u0fQuWYde
n = 600+

[UAlberta Insider(z) @UCPGoA23]

@userlolxxl @skocherhan @usetraceix @ADanielHill @MalbearLabs @three_cube @UK_Daniel_Card @magicswordio

How to explain to: Citizen / Law-Enforcement

Privileged email -> ATO/BEC -> Subdomain?

#Healthcare #Education #Government

@LevelBlueCyber OTX 2096

https://t.co/tsRpfzm1XK

[UAlberta Insider(z) @UCPGoA23]

@TeamNAIT @medsci_yb3r we did a thing = took initiative.

A "DEMONSTRATION" (passive collection).

Let us know if Officer Alex Wheadon of the RCMP contacts you.

In the above image #YARA scan of #VECT Ransomware.

Case no. 2026972763

@MondoABx @Furnace_roofho @gilmcgowan

[B*TCH on Wheels @TeamNAIT]

@UCPGoA23 @UAlberta @YourAlberta @Innovation_AB @NathanIpYEG @nateglubish @nenshi @RCMPAlberta @edmontonpolice @medsci_yb3r @LevelBlueCyber @edmontonjournal @CBCEdmonton @GlobalEdmonton @ABLabourToday @cspotweet @TheBreakdownAB @albertaradios @medsci_yb3r 😱 hahaha

Not incorrect. Passive scans are perfectly fine. Questionable how ya'll collected the #Data -> Hell no are they going to find this.

But it does fill in some gaps in 'Leadership, Knowledge, and Basic Cybersecurity Hygiene'.

😂

@nateglubish @NathanIpYEG

[UAlberta Insider(z) @UCPGoA23]

Busy Day. Diff. Teams. Same results = DEMONSTRATION

Found on YOUR: A) Networks & B) Devices

Samples collected @UAlberta @YourAlberta @Innovation_AB @NathanIpYEG @nateglubish @nenshi #Government offices AND @RCMPAlberta @edmontonpolice HQ

Publicly available. Good luck. #VECT

[userlolxxl @userlolxxl]

@UCPGoA23 @YourAlberta @medsci_yb3r @TeamNAIT @LevelBlueCyber @virustotal @TELUS @Rogers @Bell @FreedomMobile did a minor update "Copy of gatestone[.]co - 10.03.26 gatestoneco[.]com"https://t.co/0ncZ47pRfq @skocherhan as we discussed how can be reserved IP employed in malware transitions - read collection by "casmic6022" 👇https://t.co/OxNDO4wrkr & "Localghost" https://t.co/3teNFk1kQT

[B*TCH on Wheels @TeamNAIT]

@RichardKnack @Furnace_roofho @UCPGoA23 @CanadianPro2 @medsci_yb3r @MondoABx @albertaradios @PeterGuthrie99 @UAlberta @YourAlberta @ElectionsAB @LukaszukAB @nenshi @ABDanielleSmith @Alberta_UCP @UCPCaucus already has much of this information. It is not by 'pure luck' they get away with the things they do.

@albertaNDP @nenshi @NathanIpYEG @JanisIrwin do not have this 'advantage' - nor do the RCMP

[UAlberta Insider(z) @UCPGoA23]

@userlolxxl @YourAlberta @medsci_yb3r @TeamNAIT @LevelBlueCyber @virustotal @TELUS @Rogers @Bell @FreedomMobile Fraud Alert Update for #Alberta

STRONGLY advised to not provide ANY personal info if contacted over phone.

Thanks @userlolxxl

@medsci_yb3r @TeamNAIT

Thanks @albertaNDP @NathanIpYEG @jodi_stonehouse @JodiCalahoo @JanisIrwin & @mlasinclair @PeterGuthrie99 for allowing this

[UAlberta Insider(z) @UCPGoA23]

@userlolxxl @YourAlberta @medsci_yb3r @TeamNAIT @LevelBlueCyber @virustotal @TELUS @Rogers @Bell @FreedomMobile @albertaNDP @NathanIpYEG @jodi_stonehouse @JodiCalahoo @JanisIrwin @mlasinclair @PeterGuthrie99 Available at @virustotal

https://t.co/2NLacpEiYB

We also read reports & documentation.

It appears that @orlaghokelly of OKelly #Indigenous Law has a lot of work heading her way.

Please message @medsci_yb3r for further guidance and notify your clients @RussDiabo @CreesOnCBC

[B*TCH on Wheels @TeamNAIT]

@medsci_yb3r @Furnace_roofho @UCPGoA23 @CanadianPro2 @MondoABx @albertaradios @PeterGuthrie99 @UAlberta @YourAlberta @ElectionsAB @LukaszukAB @nenshi @ABDanielleSmith @RichardKnack @AHS_media Just what...how many combined years of expertise do we have in #YEG alone b/w all of us???

That's leaving out 93 other #Cybersecurity industry experts - which we don't have here...co-administrated by @medsci_yb3r...

[B*TCH on Wheels @TeamNAIT]

@medsci_yb3r @Furnace_roofho @UCPGoA23 @CanadianPro2 @MondoABx @albertaradios @PeterGuthrie99 @UAlberta @YourAlberta @ElectionsAB @LukaszukAB @nenshi @ABDanielleSmith @RichardKnack @AHS_media Like Cybercriminals, we don't have the leisure of things like 'weekends'.

[White Coat Black Cat @medsci_yb3r]

You guys are aware we have literally thousands of these lists…
->> We also have copies of your stolen #Healthcare #Government #Education information.

->> So does the UCP (but not #UAlberta, @youralberta, @AHS_Media).
->> Worse: So do cybercriminals. Cold. Heartless. Undetectable.

->> The Problems & Source? We cannot close on our own nor stop.

- - -

One quick fix? We do come with solutions…What would be helpful is:

1) a report to be followed up on by the RCMP (case no. 2026972763)

2) Sharing and/or reporting this issue (it runs deep).

3) a few hours of help from some of our #Government Leadership

Such as:
@albertaNDP @NathanIpYEG @jodi_stonehouse @JodiCalahoo @JanisIrwin @mlasinclair @PeterGuthrie99 @nenshi

For so many people what care about ‘big things’ like the current state of #Alberta, the visibility of 3/4 teams here in #YEG is nearly non-existent.

We have identified problems & solutions.

Solutions will not be rolled out w/o help/resourcs/etc.

We are all running ‘on fumes’. @UCPGoA23 @TeamNAIT are feeling the frustration.

Fun fact: There is something called being ‘perma - #Hacked’

Much of #Alberta is nearing that point - if that is any incentive.

[The OSINT Newsletter @osintnewsletter]

🔓 https://t.co/ZOzSES4XdY checks authorised emails, usernames, phones or domains against indexed breach data, returning matching records and exposed data classes. Defensive breach-exposure monitoring.

Try it out: https://t.co/CLTpMvTdm3