Edoardo Rosa

Security Engineer: loving cloud, red teaming, automation and learning

[Edoardo Rosa @_notdodo_]

@luc4m @BleepinComputer @securityaffairs @csirt_it @h2jazi @StopMalvertisin @WhichbufferArda @serghei @LawrenceAbrams @mayank_jee @github

[Edoardo Rosa @_notdodo_]

@malwrhunterteam @github invisibleferret stage https://t.co/EtATJIuqbd

[Edoardo Rosa @_notdodo_]

please watchout; this repo https://github].[com/TechDevNest[/]BTSwap is dropping #BeaverTail and #InvisibleFerret some IoCs:
216.173.115[.]200:1244
67.203.7[.]205:1244
45.59.163[.]55:1244
95.179.135[.]133:1244
node ~/.vscode/test.js
python3 "~/.npl"

@github @malwrhunterteam

[Edoardo Rosa @_notdodo_]

@malwrhunterteam @github yeah, I reported it on Friday but I have the repository locally and uploaded here https://t.co/dZOrZNJUU4

[Edoardo Rosa @_notdodo_]

@github @malwrhunterteam https://t.co/CIOqHLsjRx

[Edoardo Rosa @_notdodo_]

@github @malwrhunterteam https://t.co/qpGZr1qsK0

[Fabrizio Margotta @fam4r]

Ongoing spam campaign involving github repos.

Domain github-scanner[.]com puts malicious content in users clipboard upon button click and requiring for Windows payload execution

cc @malwrhunterteam

[JAMESWT @JAMESWT_WT]

#Ursnif SMB 62.173.145.]113 [.]164 #Italy
Change from exe To Vbs > Url > exe payload
Samples
https://t.co/rJxXU0KQdR
Url
http://serverlogins].com/pit.exe
Run
https://t.co/ifL644Qb19
cc @felixw3000 @58_158_177_102 @fumik0_ @sugimu_sec @bry_campbell

[Luca Bongiorni @CyberAntani]

Ok fellas... I am droppping a thread about all the cool #Hackers 🧑‍💻🥷stuff I have found around #Aliexpress...
It will keep growing with the time! #HackerArsenal

[On Rugby @onrugby_it]

La squadra rinuncia alla finale per dare il suo sostegno

https://t.co/PAwQJqCNLP

[Edoardo Rosa @_notdodo_]

@VodafoneIT Ma dato che è palese che c'è un problema non converrebbe magari prima farci sapere di cosa si tratta e darci almeno dei tempi. Giusto per evitare di fare il reboot della station inutilmente solo per far prendere tempo al supporto. https://t.co/2Zn7uvf9oA

[Edoardo Rosa @_notdodo_]

@VodafoneIT tutto ok?
Da 3 giorni provo ad andare sull'area riservata (per segnalare un disservizio ovviamente) e prima Ops! poi da oggi nemmeno il login sembra più dare soddisfazioni.

[Edoardo Rosa @_notdodo_]

@VodafoneIT Non riesco a mandarvi un DM. I dettagli sono quelli degli screenshots sopra: internet fisso andato e quello mobile a singhiozzi da giorni

[Edoardo Rosa @_notdodo_]

@JAMESWT_MHT It looked like Emotet because hijacked an old Emotet email thread (I'm no expert, sorry).

The onenote payload downloads a DLL (entry point "#7") from
http://77[.]91[.]101[.]159/it2/DQncBcJ3wbjrb1TNb7GxtPq9jM0xgNY7ew~~/6qHnEun7fuZXPvjYKuE691Q9NIiWdMM_OA~~

[Edoardo Rosa @_notdodo_]

@intigriti Hey I'm there!

[Edoardo Rosa @_notdodo_]

If you don't know what to do with the Oracle cloud free tier instance here's an idea: https://t.co/9CCrrp5uu8
If not inspired at least you have a quick way to destroy and start again!

#freetier #oracle #pulumi #k8s #k3s

[Bishop Fox @bishopfox]

A #pentesting tool for your #hacking arsenal: Use nuvola to dump + perform automatic & manual #security analysis on #AWS environments, configurations, and services via predefined, extensible and custom rules created w/ a simple #Yaml syntax. Try it today! https://t.co/Ntx09YV0WK

[Datadog, Inc. @datadoghq]

We are proud to release Datadog's first security study: "The State of AWS Security - A Look Into Real-World AWS Environments"

Read the report to learn about key mechanisms to secure AWS environments and how organizations worldwide are implementing them. https://t.co/xBiNKgdizg

[Edoardo Rosa @_notdodo_]

@gurutechit @hacker_ Lool! As you saw it's not that difficult to find IMDSv1. It's a bummer that he stopped with the exploitation inside AWS

[Pierluigi Paganini - Security Affairs @securityaffairs]

#NUVOLA: the new #Cloud Security tool
https://t.co/rmYUc5Dvw4
#securityaffairs #hacking