Vitali Kremez

Ethical Hacker | Reverse Engineer | CEO @AdvIntel | Malware Course Author "Zero2Hero" / "Zero2Automated" | Former .gov Cybercrime | Threat Seeker Award

[Vitali Kremez @VK_Intel]

🎁Gift for the community: Post-#Conti #ransomware operation mindmap world. Enjoy!

[BleepingComputer @BleepinComputer]

The Week in Ransomware - October 21st 2022 - Stop the Presses - @LawrenceAbrams
https://t.co/rgk5VkKWhd

[Vitali Kremez @VK_Intel]

#Royal ransomware operation in action.

[Germán Fernández @1ZRR4H]

1/ So, site impersonating @Fortinet downloads signed MSI that uses Powershell to run #BatLoader, if the user is connected to a domain (corporate network) it deploys:

1) #Ursnif (Bot)
2) #Vidar (Stealer)
3) #Syncro RMM (C2)
4) #CobaltStrike
And possibly
5) #Ransomware 💥

[BleepingComputer @BleepinComputer]

New Royal Ransomware emerges in multi-million dollar attacks - @LawrenceAbrams
https://t.co/lO6AuID9Bo

[Vitali Kremez @VK_Intel]

Offsecurity: First time flying as a private pilot single engine land from east -> west coast of Florida.

Aircraft: Cessna 172N

IFR training and rotorcraft add-on next!

[BleepingComputer @BleepinComputer]

The Week in Ransomware - September 16th 2022 - Iranian Sanctions - @LawrenceAbrams
https://t.co/nZTvaR8MAn

[Vitali Kremez @VK_Intel]

@peterbaurichter @campuscodi Exactly that. Less need for "restorative" IR work in exfil cases

[Vitali Kremez @VK_Intel]

@campuscodi @MaD_c4t Well it is

[Vitali Kremez @VK_Intel]

🔥Breaking Blog: AdvIntel's State of #Emotet aka "#SpmTools" Displays Over Million 🌎Compromised Machines Through 2⃣0⃣2⃣2⃣
Insight:

*⃣Emotet infection chain is currently attributed to #Quantum & #BlackCat ransomware chains.

https://t.co/soPGhn6MSI

[BleepingComputer @BleepinComputer]

The Week in Ransomware - September 9th 2022 - Schools under fire - @LawrenceAbrams
https://t.co/xjxQ0QKbf2

[Vitali Kremez @VK_Intel]

@AlyssaM_InfoSec Amazing. Congratulations! I have gotten my private pilot license lately well. Finished with 60hrs on Cessna 172N.

Again, congratulations! I want to get a low-wing Cherokee too as I am not a fan of Cessna. Probably, will get after I finish IFR and helicopter PPL endorsement

[BleepingComputer @BleepinComputer]

@Ionut_Ilascu Someone is hitting Cobalt Strike servers used by former members of the Conti ransomware gang with messages urging to stop Russia's war:

“Stop the war!”
“15000+ dead Russian soldiers!”
“Be a Russian patriot!”
"Stop Putin!"

[Vitali Kremez @VK_Intel]

@SwitHak @AdvIntel @y_advintel Emotet first then Brute Ratel C4 Anatomy of Attack :)

[Vitali Kremez @VK_Intel]

📌We have observed the "Anti-Putin" messages from Cobalt Strike flooding activities mapped to ex-Conti cybercrime enterprise members.

[BleepingComputer @BleepinComputer]

Ransomware gang's Cobalt Strike servers DDoSed with anti-Russia messages - @Ionut_Ilascu
https://t.co/n2xpdEv9Hd

[Vitali Kremez @VK_Intel]

Insight:⚡️#Emotet loader-as-a-service infection metrics globally for 2022 of ~1,300,000 unique bot_ids / top targeted infected by loader (including honeypot activity). Still alive but on a general decline.

The public report is incoming.

[Vitali Kremez @VK_Intel]

@james_vinocur @campuscodi Thank you, James :) Great to see you here!

[Vitali Kremez @VK_Intel]

Callback phishing was the tactic that enabled a widespread shift in the approach to ransomware deployment. This is what made the approach so unique and effective 👇

[Vitali Kremez @VK_Intel]

⚡️2022 Trend: Call-back phishing campaigns aka "BazarCall" are the de-facto top method of getting a backdoor on the protected corporate networks.

1⃣Ransomware and extortionists want to talk to the corporate employees over ☎️.
2⃣Targets are just larger & phishing is more complex

[Vitali Kremez @VK_Intel]

@LawrenceAbrams @MsftSecIntel @demonslay335 @malwrhunterteam There are quite a few current "noname" ransomware payloads used by the related group.

The graph is missing quite a few including Diavol & BlackByte and others.

[Vitali Kremez @VK_Intel]

⚡️Timely report on the latest Cobalt Strike domain fronting technique leveraging tyk[.]io.

Many ex-Conti groups leverage this domain fronting technique for Cobalt Strike beacon resolver/traffic.

Watch out for tyk[.]io traffic.

https://t.co/Z0WxLZXbOx