Joey Fitzpatrick

Threat Analysis Director @ Stealth Startup | USAF Veteran | views are my own

[Joey Fitzpatrick @_joeyfitz]

@BlackMatter23 It would also be nice if they added better network telemetry like MDE. Kinda crazy how bad the UI is

[SpaceX @SpaceX]

Mechazilla has caught the Super Heavy booster!

[National Crime Agency (NCA) @NCA_UK]

A leader of what was once the world’s most harmful cyber crime group has been unmasked and sanctioned by the UK, US and Australia, following an NCA-led international disruption campaign.

#Cronos @FBI @Europol

Full story ➡️ https://t.co/ECxlgOTH5E

[National Crime Agency (NCA) @NCA_UK]

After infiltrating LockBit's systems, we gathered a lot of information about their criminal activity and those who worked with them.

Including their network of 194 hackers or 'affiliates' who we'll be in touch with very soon.

Until then, we hope they have a nice day 🙂

#Cronos

[Joey Fitzpatrick @_joeyfitz]

I mean… he’s not wrong 🤷‍♂️

[Joey Fitzpatrick @_joeyfitz]

@sherrod_im Do not let anyone tell you otherwise, this is the way 🤌☕️

[John Althouse @4A4133]

All of JA4+ in Wireshark!

The JA4+ Plugin is now available!
https://t.co/QBJ98FJXnx

[Joey Fitzpatrick @_joeyfitz]

@rannahose Sorry to hear that Hanna! We currently have some detection and intelligence roles open at a stealth startup, DM me if you’re interested

[Joey Fitzpatrick @_joeyfitz]

@SwiftOnSecurity Literally no better feeling in the world when the substitute teacher wheels this in

[Joey Fitzpatrick @_joeyfitz]

👏It’s really amazing to see all of the work that the @FiligranHQ team has put into OpenCTI over the past few years and to see the community of connectors grow. If you're looking to change TIPs, check them out: https://t.co/S21rgAzWxJ

Check out our latest connector update ⤵️

[IronNet Threat Research @IronNetTR]

🎉 Our IronRadar connector for OpenCTI has been updated!

New Features:

✅Automatically creates relationships
✅Updates description with threat service + port
✅Adds multiple threat services observed on a single indicator

Trial:https://t.co/xVcdJ15kO6

➡️https://t.co/B2RRdqbewV

[IronNet Threat Research @IronNetTR]

#IronRadar has been tracking 44 indicators of #c2 🕹️infra observed internally and through public reporting leading to #ALPHV/#BlackCat #ransomware. Let's take a look at how we got here via our research below with IOCs on GitHub ⬇️

[IronNet Threat Research @IronNetTR]

📰 #IronRadar May Update

🎯 10 new detections (e.g. #Havoc: c2.http.listener)
📈 #Qakbot (+72%) #DcRat (+66%)
🕵️ Detected Black Basta & ALPHV

#threatintel

[Joey Fitzpatrick @_joeyfitz]

Really exciting to see other brands parter with @Tesla to adopt NACS and to utilize the supercharging network! The other charging networks just cannot compete. Who’s next? 🔌

[Sawyer Merritt @SawyerMerritt]

BREAKING: @Tesla CEO @elonmusk & GM CEO @mtbarra have reached an agreement for GM to adopt Tesla's North American charging standard & provide GM customers access to over 12k Tesla Superchargers across the US & Canada.

Tesla's NACS is now the main standard for Tesla, GM & Ford.

[Joey Fitzpatrick @_joeyfitz]

oof you know it's bad when you have to replace the appliance

[Keith KorbenD Wingo @KorbenD_Intel]

😳😮 #CVE-2023-2868 @cyb3rops @JAMESWT_MHT @James_inthe_box

[IronNet Threat Research @IronNetTR]

📰 #IronRadar April Update

🎯 6 new detections (e.g. sliver: c2.http.listener)
📈 Stealc (+32%) Viper (+19%)
🕵️ Detected Bl00dy Ransomware Gang

[IronNet Threat Research @IronNetTR]

#TrueBot is indeed back!

First reported by Group-IB:
https://t.co/644PcMRnCg

#IronRadar is tracking active c2.http.listener(s):
45.182.189.91:80
45.182.189.91:443
45.227.253.100:80

Silence: https://t.co/n88cqik4yE

[IronNet Threat Research @IronNetTR]

From our #IronRadar collections, let’s take a look at some of the domains recently mentioned by @Unit42 in their #RoyalRansomware post https://t.co/p02cdJYoiF such as kasperslkyupdate[.]com and kasperskyupdates[.]com

[Joey Fitzpatrick @_joeyfitz]

@TLP_R3D @jstrosch You can also pivot off of the favicon: http.favicon.hash:-61091883

[CERT Polska @CERT_Polska_en]

❗Together with the Military Counterintelligence Service we've detected an ongoing espionage campaign linked to the APT29/NOBELIUM group. We're publishing detailed technical analysis of their latest tools, mostly never publicly described before. Read more: https://t.co/IAh0eFqC6r