_guzzy

Minimal speculation

[_guzzy @cbh_security]

@malmoeb @hackerkartellet Hi Stephan,
I know its been a while since this was posted, but found it through Asger, and wanted to share that i've dug a but more into the tool and described the functionality here: https://t.co/luG2MYPsey

[_guzzy @cbh_security]

Faced GetScreen on a recent engagement, not much to find on it, decided to put some time documenting it. https://t.co/luG2MYPsey

[DHH @dhh]

Best advice you can now give Danish entrepreneurs is to leave the country before anything gets off the ground. Danes better hope Novo never falters.

[_guzzy @cbh_security]

During an active ransomware case, we observed a threat actor silently install CodeMeter Runtime 8.20 from a user's temp directory and abuse it for local privilege escalation (CVE-2025-47809). Haven't seen this before, pretty neat.

https://t.co/wxEAyjD3KM

[_guzzy @cbh_security]

@cemaxecuter What did you use to publish to ATAK?

[_guzzy @cbh_security]

@_Gendy_ @IntCyberDigest Do we have any sources on this?

[SpecterOps @SpecterOps]

Credential Guard was supposed to end credential dumping. It didn't.

@bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.

Read for more ⤵️ https://t.co/mYPHg1mTKj

[_guzzy @cbh_security]

🧪 Microsoft has just rolled out a new addition to their logs, called Linkable token identifiers, which will help with tracing user sessions across most of their M365 services.

https://t.co/cN5N8QuvSJ

[_guzzy @cbh_security]

https://t.co/YB56GE74jA

[_guzzy @cbh_security]

My 5 cents on the FileFix POC

https://t.co/cNf4boqGDv

[_guzzy @cbh_security]

Source: https://t.co/8R4NvVQvN8

[_guzzy @cbh_security]

Was responding to a customer noticing outbound RDP connections originating from their DCs. After a few hours we noticed that MS Defender for Identity was present on the DCs, which we started digging further into, and found this in their documentation. Is this common knowledge?

[_guzzy @cbh_security]

@ForcepointSec also made a nice article about this campaign: XWorm Malware Targets United Kingdom’s Hospitality Sector- Forcepoint

[_guzzy @cbh_security]

Interesting phishing campaign delivering XWorm RAT.

Infection chain:
Phishing email --> User redirected to fake https://t.co/tlvImjSPlZ site --> Tricked to go through CAPTCHA with opening Win +R and pasting their clipboard --> Leads to mshta.exe downloading XWorm RAT
#xworm

[_guzzy @cbh_security]

The TA was also utilizing NtSetValueKey native API to create a hidden auto run key for persistence. This is throws an error when displayed in regedit or Velociraptor. But opening with registry explorer reveals the key.

[_guzzy @cbh_security]

@vxunderground @HackerStick3rs stickers wuhu

[Jens Myrup Pedersen @jens_myrup]

Vi har forsøgt at fortælle historen om finalen til De Danske Cybermesterskaber på 2 minutter! @Cybersikkerhed @Industriensfond

[_guzzy @cbh_security]

@paulglavin @lkarlslund Jeeez! I feel way to naive 😂