Calwarez

Director for Malicious Infrastructure Discovery @ Recorded Future | Views my own

[Lawrence_Sec @Lawrence_Sec]

In August 2025, @_whoisnt and I documented how Stark Industries evaded EU sanctions.

This week, Dutch authorities arrested two individuals and seized hundreds of servers linked to WorkTitans BV in an investigation into sanctions evasion. https://t.co/19jlirWWsY

[Lawrence_Sec @Lawrence_Sec]

New from @RecordedFuture!

@_whoisnt and I break down Threat Activity Enablers (TAEs), the often overlooked backbone of modern cyber operations.

🔗https://t.co/swOchKVPwJ

[Lawrence_Sec @Lawrence_Sec]

OMEGATECH (AS202412) is the latest installment of Threat Activity Enabler Virtualine Technologies, following their transition away from Railnet LLC.

[Calwarez @calwarez]

Huge shoutout to the team for their efforts pulling all this together!

Read the full report here: https://t.co/TMQMIIXfMk

6/6

[Calwarez @calwarez]

🧵 ICYMI: We just dropped our 2025 Malicious Infrastructure Review! Some of the highlights below👇 #Infosec #CyberThreats 1/6

[Calwarez @calwarez]

Threat actors are increasingly abusing Legitimate Internet Services (LIS) like Cloudflare, Google Drive, and Telegram to hide in plain sight. It’s a structural challenge for every network defender. 5/6

[Lawrence_Sec @Lawrence_Sec]

Noticed Microsoft Defender tagging #TheVoidStealer as #WallStealer thanks to some recent @abuse_ch uploads. Here’s the threat actor nikoniko (aka “TheVoidStl”) discussing the removal of multiple detections, including WallStealer.

[Modat @modat_magnify]

CVE-2026-25253 
⚠️ OpenClaw (Moltbot / Clawdbot) – 1-Click RCE via Token Exfiltration 

A high-severity vulnerability (CVSS 8.8) has been disclosed in OpenClaw allowing remote code execution with a single click. 

The flaw is a logic issue where the Control UI blindly trusts a gatewayUrl supplied via query string and auto-connects over WebSocket, leaking the stored gateway token to attacker-controlled infrastructure. 

By abusing cross-site WebSocket hijacking and privileged operator scopes, attackers can disable safety approvals, escape the container, and execute arbitrary commands directly on the host even when the gateway is bound to localhost only.  

Modat previously identified exposed Clawdbot/Moltbot control panels, with numbers now even higher. You can read the full blog here https://t.co/Aaq8YCPDGB  

Fixed in: v2026.1.29 
Action: Patch immediately and rotate gateway tokens. 

Modat Magnify Query: 
web.title~"Clawdbot Control" OR web.title~"OpenClaw Control" OR web.title~"Moltbot Control" 

The platform: 
https://t.co/qJfEh7giE9 

#threatintel #vulnerability #CVE202625253 #OpenClaw #Moltbot #Clawdbot #RCE #AIsecurity #infosec #ModatMagnify

[Modat @modat_magnify]

New Modat Magnify updates are live. 

• Time-based filtering 
• Unified IP detail view  
• Certificate validity filtering (expired, not yet valid, abnormal lifetimes) 
• CN wildcard & partial matching 
• Issuer Alternative Name (IAN) search 
• Empty field search with field="" 
• TLS version filtering 
• Banner hex search 
• New Tags: VPN and PQC over SSH 

Built for faster, more precise infrastructure investigations. 
 
Explore the new features inside the platform: 
https://t.co/qJfEh7giE9

[Squiblydoo @SquiblydooBlog]

Use YARA for threat hunting?
.@theidr0p created a tool for automated YARA rule creation based on the Cert Graveyard.
Automatically checks for updates to the database and generates rules.

The art is theirs. Amazing.

See link in thread for details

[Squiblydoo @SquiblydooBlog]

From 2020-2024, I tracked the SolarMarker malware, and in 2024, monitored a self-infection for months to learn their actions-on-objectives: on-device fraud.

I didn't publish the details of my months long investigation until now. Check the link the the attached comment.

[FBI Los Angeles @FBILosAngeles]

A Ukrainian national has been federally charged with participating in dozens of cyberattacks and computer intrusions against critical infrastructure and other victims around the world, in support of Russia’s geopolitical interests, the Justice Department announced today.

The two indictments against Victoria Eduardovna Dubranova, 33, a.k.a. “Vika,” a.k.a. “Tory,” a.k.a. “SovaSonya,” were unsealed today in United States District Court in Los Angeles. Dubranova was extradited to the United States earlier this year on an indictment charging her for her actions supporting CyberArmyofRussia_Reborn (CARR).

Dubranova was arraigned today on a second indictment charging her for her actions supporting NoName057(16) (NoName). Dubranova has pleaded not guilty in both cases. Dubranova pleaded not guilty today at her arraignment and a February 3, 2026 trial date was scheduled in that case.

As described in the indictments, the Russian government backed CARR and NoName by providing, among other things, financial support. CARR used this financial support to access various cybercriminal services, including subscriptions to distributed denial of service-for-hire services. NoName was a state-sanctioned project administered in part by an information technology organization established by order of the President of Russia in October 2018 that developed, along with other co-conspirators, NoName’s proprietary distributed denial of service (DDoS) program.

Details: https://t.co/9FEgalQ0l3

[Lawrence_Sec @Lawrence_Sec]

1/ @_whoisnt and @JulianVoeg introduce #GrayBravo (formerly TAG-150) #CastleLoader #MaaS https://t.co/QDTIHARSp5

[Itay Cohen 🌱 @megabeets_]

New coordinated reporting from @googlecloud, @AmnestyTech, @RecordedFuture, and @haaretzcom / @insidestory_gr, built on leaked Intellexa material and technical findings, outlines Intellexa’s exploits, corporate structure, and continued activity despite U.S. sanctions. 👇 1/

[Modat @modat_magnify]

Cyber Monday Deal 
Get 6 months of Modat Magnify Pro for just €5 total (save €355). 

Use code: MODAT2025CYBERMONDAY 
 
Try the platform. Run advanced queries. Find what others miss. 

https://t.co/0WNqTHqKre

#CyberMonday #Cybersecurity #OSINT

[Will @BushidoToken]

🆕 ICYMI: The @CuratedIntel LinkedIn account is now doing weekly roundup posts based on the member’s latest content:

Week 2. https://t.co/GRAnxn99F5

Week 1. https://t.co/qDuRgdb19P

[Lawrence_Sec @Lawrence_Sec]

1/ United States, Australia, and United Kingdom sanction Russian threat activity enabler Media Land (Yalishanda) and follow up on recent designations targeting Aeza. https://t.co/IvREWnW2QN