Cookie Connoisseur

Ex-Unit 350: Elite cookie ops. Perfect bake temp. No ties to Unit 8200.

[Cookie Connoisseur @browsercookies]

Vendor: "We uhh, found this vulnerability you should patch"
Cookie: Wait, you forgot to mention you discovered this due to active nation-state exploitation and <actor> may had/have full access & pivoted in your network (you're fucked).

🚨 NBD, just a patch! 🚨
@aptwhatnow

[Cookie Connoisseur @browsercookies]

There are the boys.

[National Security Division, U.S. Dept of Justice @DOJNatSec]

Two U.S. Nationals Sentenced for Facilitating Fraudulent Remote Information Technology Worker Schemes to Generate Revenue for the Democratic People’s Republic of Korea

“These sentences hold accountable U.S nationals who enabled North Korea’s illicit efforts to infiltrate U.S. networks and profit on the back of U.S. companies,” said Assistant Attorney General for National Security John A. Eisenberg. “These defendants helped North Korean ‘IT workers’ masquerade as legitimate employees, compromising U.S. corporate networks and helping generate revenue for a heavily sanctioned and rogue regime. The National Security Division will continue to pursue those who, through deception and cyber-enabled fraud, threaten our national security.”

🔗: https://t.co/YyTELN2lBD

[Cookie Connoisseur @browsercookies]

@aptwhatnow

[Cookie Connoisseur @browsercookies]

👀

[Cookie Connoisseur @browsercookies]

@aptwhatnow @silascutler @campuscodi On-prem was / is most impacted. Cloud was impacted too, but they addressed that issue first.

[Cookie Connoisseur @browsercookies]

Vendor: "We uhh, found this vulnerability you should patch"
Cookie: Wait, you forgot to mention you discovered this due to active nation-state exploitation and <actor> may had/have full access & pivoted in your network (you're fucked).

🚨 NBD, just a patch! 🚨
@aptwhatnow

[Cookie Connoisseur @browsercookies]

@aptwhatnow Thats right, 🇨🇳 [++] has/have been actively exploiting a vulnerability in SC for years which gave them full access to your systems. CW has decided to omit that from this post and the prior vuln that gave access.
@aptwhatnow @silascutler @campuscodi

[Narcass3 @Narcass3]

Contrary to the quoted tweet, @sexinfochina is in fact the admin of the Chinese darknet market FreeCity. Behind the handle is Xiao He, a Chinese national who is a prolific launderer of DPRK stolen funds, supporter of DPRK IT Worker ops, and pusher of fake viagra.

[Cookie Connoisseur @browsercookies]

Check this out

💊

[Narcass3 @Narcass3]

Contrary to the quoted tweet, @sexinfochina is in fact the admin of the Chinese darknet market FreeCity. Behind the handle is Xiao He, a Chinese national who is a prolific launderer of DPRK stolen funds, supporter of DPRK IT Worker ops, and pusher of fake viagra.

[Cookie Connoisseur @browsercookies]

@TLV4d3r @aptwhatnow @SttyK @Narcass3 @blackbigswan They like it when Daddy Kim takes the whip out

[Cookie Connoisseur @browsercookies]

@TLV4d3r @aptwhatnow @SttyK @Narcass3 @blackbigswan For the love of the game ✌️. (They love it too)

[Cookie Connoisseur @browsercookies]

@SttyK @aptwhatnow @Narcass3 @blackbigswan

[Cookie Connoisseur @browsercookies]

@GLiNetWiFi DPRK facilitators be like 👁️👄👁️ 💦

@FBI Wdyt on these shipping addys?

[Cookie Connoisseur @browsercookies]

@iruletheworldmo I used AI to read this article.

[Cookie Connoisseur @browsercookies]

@tayvano_ @HackRead Hahahahahhaha

[Cookie Connoisseur @browsercookies]

@KawaiiJongUwUn @SvenDotDev @SvenDotDev

[Cookie Connoisseur @browsercookies]

@__noided @KawaiiJongUwUn @Narcass3 @aptwhatnow @blackbigswan @tanuki42_

[Cookie Connoisseur @browsercookies]

@SocketSecurity @faisalusuf @aptwhatnow @meow_mfer @Narcass3 @SttyK It is good

[780th Military Intelligence Brigade (Cyber) @780thC]

Gen Threat Labs uncover evidence of rare cross-country coordination between Russia’s Gamaredon and North Korea’s Lazarus | https://t.co/YTx4672kdz @GenThreatLabs

[Cookie Connoisseur @browsercookies]

@SttyK @aptwhatnow

[Cookie Connoisseur @browsercookies]

ICYMI - DPRK's training video on making Civil Engineering profiles to perform fraudulent CIV-E work.

#DRPK #kimhasabigfacemole @aptwhatnow

https://t.co/mSKoIdVnDS