Nguyen Anh Tu

VCS | Intelligence Center

[kernullist @kernullist]

Huge respect to api monitor. It's such a beautiful tool for windows apps but hasn't been updated for ages. wanted to keep that spirit alive so built a fresh one.
Currently tracking 30k apis. very early alpha so expect some bugs.☺️
would love your feedback and bug reports.

repo: https://t.co/HRbXj5YyuK

[Gi7w0rm @Gi7w0rm]

So @censysio just deployed the "suspicious-open-dir" label to their search engine.
So far it appears a game changer, giving very solid hit rates on finding malicious infrastructure.

So for today, this will be a thread documenting my findings using the new feature.

1/x

[/dev/ttyS0 @devttyS0]

Binwalk v3 now under active development. Faster, smarter, Rustier.

Beta testers and bug reports welcome!

https://t.co/8pnMIiPpCX

[јаmеѕ ███████ @rotarydrone]

First blog! Reversing a VPN client to hijack sessions.
https://t.co/kFDDWuSmGA

[ESET @ESET]

@ESETresearch introducing Nimfilt: The Power Tool for Reverse Engineering Nim Binaries!
Learn about the practical examples to help jump-start your journey into analyzing Nim-compiled binaries.
Stay vigilant and integrate #Nimfilt into development and security toolkit today!

[Sam Russell @samrussellnz]

Here's my writeup on building your own control flow flattening LLVM pass https://t.co/q9prg6RRVN

[Group-IB Threat Intelligence @GroupIB_TI]

The #GoldDigger family grows: Group-IB's TI Unit finds GoldPickaxe.iOS, the first #iOS #Trojan harvesting #FacialRecognition data for unauthorized bank access, targeting #APAC. It is linked to the GoldDigger family discovered last October. Learn more: https://t.co/pC4AAubb47

[Nicole @NicoleFishi19]

Unveiling APT WildCard. Emerging from SysJoker shadows, this APT now wields complex Rust malware - RustDown. Its link to Operation ElectricPowder signifies ~7 years of adaptive and persistent targeting of Israel's critical systems
🧵Technical deep-dive on WildCard [1/9]:

[Binary Wizards @BinaryWizards]

Try the ask_ida/c++ GPT [ https://t.co/2UEoY12Xoi ] for IDA SDK related questions in C/C++.

[Bill Marczak @billmarczak]

NEW: Kaspersky releases full details on how they captured the “Triangulation” (suspected US Government) exploits and iPhone spyware targeting their employees. https://t.co/Krladw07eD

[Check Point Research @_CPResearch_]

Uncovering Stayin’ Alive operation, active since at least 2021:

📞 Targets telecoms in Asia 🇰🇿🇺🇿🇻🇳🇵🇰

🛠️ Spearphishing + DLL side-loading (such as CVE-2022-23748 in Zoom)

🐱 Linked to a China-affiliated threat actor, referred as ToddyCat

👉 Read more: https://t.co/4Hz0fTYY3d

[HackGit @hack_git]

HyperDeceit

This repository contains the full source-code of the HyperDeceit project which is a library that allows you to impersonate as Hyper-V and intercept hypercalls done by the Windows kernel.

https://t.co/RkS2gLCZHN

Details:
https://t.co/TuYDENpiej

#infosec #redteam

[ESET Research @ESETresearch]

#ESETResearch discovered a campaign by the Evasive Panda APT group targeting an international NGO in China🇨🇳. The attackers hijacked the update channels of legitimate Chinese software to deliver their signature backdoor, #MgBot, to its victims. https://t.co/3h7Pmsv1Xx @0xfmz 1/7

[Binary Wizards @BinaryWizards]

Debugging with IDA: Emulating code from crash dumps - defeating VMP's obfuscated imports https://t.co/SvV2xXxVrI

[Tim Blazytko @mr_phrazer]

New blog post and updated #binaryninja plugin: "Statistical Analysis to Detect Uncommon Code" We use statistics to identify obfuscation in an #Anticheat, a mobile DRM, a #Windows kernel module & malware.

Link: https://t.co/AxDgMwgxmT

Code: https://t.co/wWPTnvSflh

[JPCERT/CC @jpcert_en]

New Blog Post: Automating Malware Analysis Operations (MAOps) ^TN
https://t.co/4EPOMiKNlR

[Steve S. @0xTriboulet]

In this writeup, we leverage @rustlang's inherent obfuscation against existing AV technologies to quickly bypass all detection on VirusTotal using unsafe code blocks.

We can even achieve 0-total detections with a standard MSFVenom payload!

Check it out
https://t.co/BZlDNaGrB1

[weak @weak1337]

Today I released Alcaztaz - an x64 binary obfuscator featuring:
- Obfuscation of immediate moves
- Control flow flattening
- Mutation / Obfuscation of certain instructions like MOV, ADD, LEA
- Anti disassembly
- Entry point obfuscation

Read more at: https://t.co/UWMkq1Mt9J

[Mandiant (part of Google Cloud) @Mandiant]

🚨 New research alert!

Mandiant has observed a new espionage operation targeting #Ukraine. We suspect this activity is being conducted by the Russian #cyberespionage group, Turla Team. Read the blog to learn more. ⬇️ https://t.co/elDZ7erMPV