botlabsDev

[botlabsDev @botlabsDev]

@viql Wow looks nice. What tool did you use to extract the yara rules? I had to write one on my own for decent extractions.

https://t.co/8ulF82tjlW

[botlabsDev @botlabsDev]

Awesome team! Can recommend to check it out!

[DCSO CyTec @DCSO_CyTec]

Goooood morning everyone!

Our team is looking for another Senior Technical Threat Researcher!
So, check out our blog! Tell your friends and ping us if you awesome and interested!

Check it out:
https://t.co/WPou4iFP7D

[botlabsDev @botlabsDev]

@akaclandestine Check out https://t.co/30qzUoI3YU

[botlabsDev @botlabsDev]

@vxunderground Did you consider not doing give aways and instead donating small peaches of it to security related community projects or tools?

[botlabsDev @botlabsDev]

@NinjaParanoid Thanks for the rule. As feedback I would like to address the fact, that altering via "any of ($hash*)" will generate a bunch of FP as you can see on my test run against the VT Goodware corpus.

[botlabsDev @botlabsDev]

@4ndur1n @DEATHCon2024

[ioc.one @ioc_one_]

#ProgressUpdate The project now uses a staging system🥳. This prevents me from debugging in production and can be considered an invest into stability!

The cat likes it!
#ioc_one #cti

[botlabsDev @botlabsDev]

Ready for the day.
@pivot_con #pivotcon24

[DCSO CyTec @DCSO_CyTec]

The recent #XZBackdoor caused a lot of agitation in the Open Source Community.

Today we publish a #ComprehensiveOverview what happened and how to check your system for affection.

Read more at https://t.co/jdkOHGaXs3

#DCSO #DRIF #Cyber

[botlabsDev @botlabsDev]

@0gtweet Would be a cool combination with the https://t.co/biK1nM0mCr database and a maps visualisation I think 😀

[botlabsDev @botlabsDev]

@adulau @fr0gger_ @MsftSecIntel @MISPProject Hey @adulau, Microsoft updated the threat actor list and now provides a json formatted version of it on github as well. Based on your commit I wrote a script which converts this data into the MISP format.

Maybe it is useful for you ;)

https://t.co/GvF7jdVm5X

[botlabsDev @botlabsDev]

I converted the new threat actor naming taxonomy from Microsoft (@MsftSecIntel) to json in case someone else needs the data in a machine readable format.

https://t.co/DNvWh56lcq

#threatintel #research #apt

[John Lambert @JohnLaTwC]

We are announcing a new taxonomy that better reflects the complex tapestry of the threat ecosystem.

Name mapping list and industry aka's:➡️ https://t.co/QHNRQekGX2

Read more:
⬇️⬇️⬇️

[botlabsDev @botlabsDev]

@jaydinbas @mstoned7

[botlabsDev @botlabsDev]

#CLT2023 Thanks for listening 😊 See you next year @clt_news

[botlabsDev @botlabsDev]

Working with @jaydinbas on our next #ShortAndMalicious post was a lot of fun as always 😁

Check it out below!
#PikaBot #iPikaBot #DCSO #CyTec

[DCSO CyTec @DCSO_CyTec]

For our first blog post 2023, we continue the #ShortAndMalicious series with fresh malware:

A brief analysis of the #PikaBot #iPikaBot #malware

https://t.co/5eL3owZwFY

[botlabsDev @botlabsDev]

Ok. Let's call it a day. The "new future" wants me to take a break.

[botlabsDev @botlabsDev]

@Gi7w0rm Adding to this: Not so fancy but still my current favorite with a low false-positive rate is #sherlock.
A fork of it is called #maigret, which comes with more false-positives but contains sometimes additional information.

https://t.co/6CLAMb93pX
https://t.co/63YfXAOpjK

[botlabsDev @botlabsDev]

@clt_news ❤️

[DCSO CyTec @DCSO_CyTec]

Check out our new blog post!

This time we analyse and follow HZ Rat. A previously undocumented malware delivered through malicious documents and self extracting archives. We tracked the campaign and identified a lot of C2 servers.

https://t.co/nwWGWGxQxn

#HZRat #DCSO #CyTec

[botlabsDev @botlabsDev]

@jaydinbas It is MAYBE related to #Sidewinder.
The domain pattern is similar to Domains mentioned in a TrendMicro report about this group
https://t.co/PhYlUycxBE