David Rushmer

Cybersecurity Researcher, Security Nut and Excessive Coffee Drinker
#ThreatResearch

[David Rushmer @_DavidRushmer]

My father died before just before Christmas and the Internet was in his name. @EE created an account for my mum and gave her 14 days to cancel her contract. She did within the 14 days and was told that there wouldn't be any further charges. So why @EE are you referring her to a debt collection company when she did everything you asked of her and is no longer a customer?

[RevEng.ai @RevEng_AI]

From nearly 1k applications, we are pleased to say that @RevEng_AI has been selected as one of 53 AI startups joining the first ever @GoogleStartups Gemini Founders Forum cohort; and we couldn't be more thrilled.

Find out more by going here:
https://t.co/Z6lkOCgBx6

[David Rushmer @_DavidRushmer]

@Laughing_Mantis This is bonkers!

[David Rushmer @_DavidRushmer]

@vxunderground @infrawatch_app Hell yea @infrawatch_app !

[vx-underground @vxunderground]

@infrawatch_app More information (worth reading): https://t.co/omisrRozv3

[vx-underground @vxunderground]

August 14th we posted this and mocked, sayiny it was probably North Korea. Some people (for reasons I don't understand) said it was probably safe (it's not)

Thankfully, @infrawatch_app went way out there way to investigate the company mentioned in the Reddit post (DSLRoot) and much more

The tl;dr:
- Guy in Belarus owns the company
- Owner travels between Minsk and Moscow
- He pays you $250/month to plug in devices
- He connects to it with Remote Desktop Software
- He sells network access to your home to other people
- Advertises on BlackHatWorld
- Random people use your residential IP for ???

[RevEng.ai @RevEng_AI]

🚨 New blog post from @RevEng_AI! 🚨

https://t.co/WzKBRridX7

We continue exploring the KorPlug malware family, focusing on its complex second-stage execution.

This analysis outlines methods to bypass advanced obfuscation and extract key intelligence.

#revengai #malwareanalysis #cybersecurity #threatintelligence #KorPlug

[RevEng.ai @RevEng_AI]

Check Out https://t.co/pqQMUEbmYH's latest writeup on KorPlug

Unmasking KorPlug: Journey into a Chinese Cyberattack - Part 1
https://t.co/os1v2xzRLD

[RevEng.ai @RevEng_AI]

📣 We're hosting a CTF Event in Washington DC 📣

Join us on the 12th of May for the inaugural https://t.co/pqQMUEbmYH CTF at the stunning Sands Capital building. Experience a sneak peek into https://t.co/pqQMUEbmYH's cutting-edge AI platform.

https://t.co/iUjvLKHx81

[RevEng.ai @RevEng_AI]

During continued analysis of #LummaStealer @RevEng_AI uncovered an ongoing campaign using stealthy DLL hijacking tactics, different from the previously documented ClickFix method.
Read our latest findings here: https://t.co/NdJdlz0RhW
#CyberSecurity #ThreatIntel #MalwareAnalysis

[David Rushmer @_DavidRushmer]

With LummaStealer reCAPTCHA'ing people's attention, @RevEng_AI wanted to share research conducted around this particular malware.

If you enjoy part 1, remember to keep an eye out for part 2.

If anyone would like to see a demo of https://t.co/9zjXrkdZjL you can always just follow this link here to register your interest - https://t.co/rSCRJ0F5Ae

https://t.co/0ZFh5IF4RX

#cyber #cybersecurity #ai #malware #infosec

[David Rushmer @_DavidRushmer]

🚨 New CVE Alert: CVE-2024-41498 🚨

You probably won't find anything on this CVE yet because it's brand new! 🆕 Discovered by Daniele Linguaglossa at https://t.co/9zjXrkdZjL, the details are just emerging.

Be among the first to read about it 👉 https://t.co/dz84I6PvV8

#infosec #cybersecurity #vulnerability #CVE #AI #AICybersecurity

[David Rushmer @_DavidRushmer]

If you're using Ivanti Avalanche, now is the time to update because 𝟲.𝟰.𝟯 addressed quite a bit.

𝗖𝗩𝗘-𝟮𝟬𝟮𝟰-𝟮𝟳𝟵𝟴𝟰 a Path Traversal Vulnerability was added to the list this morning.

Although personally I would be more concerned with 𝗖𝗩𝗘-𝟮𝟬𝟮𝟰-𝟮𝟰𝟵𝟵𝟲 published on the 18th - "A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to execute arbitrary commands."

There are more but it'll be faster if you just go 𝐏𝐀𝐓𝐂𝐇 :D

[David Rushmer @_DavidRushmer]

Trying to pay @O2 money for an account I never setup because they've decimated my credit score, and they keep hanging up. 8 hours on the phone and 3 trips to the store all for £45 that I had to find out about through Experian... great work @O2

[Blackpoint Cyber @BlackpointUS]

@BlackpointUS is honored to celebrate and empower women in tech today, and every day. #internationalwomensday #womenintech #diversity #blackpoint #blackpointcyber #MSP #channel

[N$🌟 @__nav1n_]

Bypassing WAF by adding multiple slashes to gain SSI/ Path traversal. This is my 2nd successful shot in the dark attempt.

Payload: GET /assets/css///////../../../../../../../../etc/passwd #BugBounty

[David Rushmer @_DavidRushmer]

@RedSenseIntel @4D435A Nothing like some good news going into the weekend!

[RedSense @RedSenseIntel]

Today, RedSense can confirm that #ALPHV aka #BlackCat ransomware gang’s site has been taken down by law enforcement @4D435A

[Adversary Pursuit Group @blackpoint_APG]

Cisco Talos exposes a critical flaw in WPS Office 11.2.0.11537, allowing remote code execution through a malformed Excel file (CVE-2023-31275). Use caution when opening unknown files, which could lead to potential system compromise. https://t.co/OS2MBRPaEz