Alfred Alvarado

Threat Researcher @Trellix - My tweets are my own

[Alfred Alvarado @_Fritto_]

@vxunderground After Tuesday, even the calendar says WTF

[Alfred Alvarado @_Fritto_]

@RHHSHawks Does anyone have an extra ticket to tomorrow nights football game. Looking for 1or 2 tickets on Heath side.

[Trellix Advanced Research Center @TrellixARC]

ICYMI: On August 29, 2023, an FBI-led effort dismantled the Qakbot malware and botnet. Learn about the upward attack trend preceding the takedown from Daksh Kapur, @_Fritto_, and Nico Yturriaga. https://t.co/3FZ5BzVSdF

[Trellix @Trellix]

Law enforcement led a successful campaign to disrupt and dismantle Qakbot on August 29, 2023. @TrellixARC’s Daksh Kapur, @_Fritto_, and Nico Yturriaga share everything you need to know to understand the malware and botnet. Qakbot:
https://t.co/rRnm9ge5jE

[Alfred Alvarado @_Fritto_]

@notshenetworks That’s crazy, that’s not to far from me !!

[Alfred Alvarado @_Fritto_]

@cybersecmeg Have fun at Summer Camp.... maybe next year for me..

[The Information Security Collective | 501(c)3 @InfoSecTogether]

🚨 Giveaway 🚨

Do we need a reason to hold a giveaway?

We want to give away two @TCMSecurity vouchers!

(1) Practical Web Application Penetration Testing

AND

(1) Practical Ethical Hacking

All you have to do to enter is:
1️⃣ Retweet this Tweet
2️⃣ Make sure you’re following us

Winner announced tomorrow at 5:00 PM

[Alfred Alvarado @_Fritto_]

T-2: n00b pin acquired, presenting room found, n00b pin already lost 😞

[Trellix @Trellix]

Explore securing the software supply chain with VP Customer Advocacy, @TrellixARC Karine Ben-Simhon at the Moscone South 207 #RSAC Sandbox Stage. The panel will cover:

🛡️ Threat intelligence
📈 Recent trends
🧰 Mitigation strategies

Join her: https://t.co/EnI2IRMnq7

[Trellix @Trellix]

Want to mitigate the risk of being targeted w/ LOLBins? During their #RSAC session (located in Moscone South - 153), @TrellixARC researchers @tim_hux & @_Fritto_ discuss applicable threat hunting strategies & map MITRE techniques to real world examples. https://t.co/EnI2IRMnq7

[Trellix @Trellix]

Avoid being a future victim of weaponized LOLBins — join @TrellixARC security researchers @tim_hux and @_Fritto_ at #RSAC to equip yourself with relevant threat hunting tools & techniques. https://t.co/X9ZUTNALzw

[Alfred Alvarado @_Fritto_]

In an additional report today, the @Trellix Threat Intelligence Group talks CVE-2021-21974, providing data on telemetry gathered by our sensors & share information about activity targeting this 2yr old vuln that some have left unpatched.

https://t.co/OCdHaKGfl0

[Alfred Alvarado @_Fritto_]

The latest @Trellix report covers CVE-2023-0286, researchers Mark Bereza(@ROPsicle) & John Dunlap discuss the vulnerability as well as the litany of prerequisites & mitigating factors that limit its usefulness to attackers.

https://t.co/uy0ZQqsiEk

[Alfred Alvarado @_Fritto_]

VMWare identified older and outdated products that have reached end of general support are those targeted in ESXiArgs Ransomware attacks. VMWare recommends upgrading to the latest supported version and disabling the OpenSLP
service in ESXi.

https://t.co/UYezWy4d4z

[vx-underground @vxunderground]

Lockbit ransomware group has informed us they have acquired a 3rd ransomware variant.

- Lockbit Red
- Lockbit Black
- Lockbit Green

They also have modified their ESXI ransomware variant.

Yes, they actually wrote "TLP:RED" in the image.

[vx-underground @vxunderground]

HIVE ransomware group's Tor domain has been seized by EUROPOL

*No official announcement yet from United States Department of Justice or EUROPOL

[Germán Fernández @1ZRR4H]

1/ DEV-0569, current distribution via #GoogleAds.

1.- #Gozi aka #Ursnif (bot) ↓
2.- #RedLine (stealer) ↓
And if the conditions are right, possibly:
3.- #CobaltStrike (C2) ↓
4.- #Royal Ransomware 💥

(No more BatLoader in the infection chain)

[Germán Fernández @1ZRR4H]

🚨 Ongoing mass exploitation of CVE-2022-44877 (Centos Web Panel 7 Unauthenticated Remote Code Execution).

Source: 206.189.170.136 🇺🇸

Malicious Base64 payload is a reverse shell that connects to 206.189.170.136:9181

The scanning of CWP instances started around January 06th.

[Alfred Alvarado @_Fritto_]

@cyberGoatPsyOps Yucatán

[Alfred Alvarado @_Fritto_]

Hot Off The Press - The Trellix Threat Report: Fall 2022 – Insights Ransomware Tracking https://t.co/MucMlM4Nsm