Olivia
Online
CryptoInsane
@CryptoInsane
Threat Intelligence | Analyst/Researcher | #Malware | #Reverse | #OSINT | #Programmer | #Cryptographer | Physicist & Mathematician | π΅οΈββοΈπ¦Ύπ΅πͺ
Lima - PerΓΊ
Joined September 2015
162 Following
13K Followers
3.8K Posts
Β Pinned Tweet
US Cyber Operations Group π΅οΈπΊπΈ Vs π΅οΈπ·πΊ Russia's Cyber Operations Group
π¨ Threat Intelligence Alert | China's CVERC warns about new "Silver Fox" (ιΆη) trojan variant πΎ
On May 21, 2026, China's National Computer Virus Emergency Response Center (CVERC) released an advisory regarding a new wave of the "Silver Fox" trojan family (also tracked as YΓ³u ShΓ© / ζΈΈθ, Valley Thief, UTG-Q-1000, and SwimSnake), specifically targeting Windows users in China.
π£ Attack vector β HR-themed social engineering Threat actors leverage highly persuasive corporate-context filenames, including:
π€"Internal investigation results"
π€"Quarterly disciplinary violation list"
π€"Personnel notification information"
π€"Layoff list and compensation plan"
The payloads are disguised as shortcuts, folders, recycle bin icons, or PDF documents, distributed primarily through WeChat, QQ, DingTalk, Feishu, and email.
βοΈ Observed TTPs
πΉ Persistence & DLL sideloading: payloads dropped in C:\Program Files\Internet Explorer\, abusing a legitimate binary (installer.exe) to sideload the malicious log.dll.
πΉ C2 communications: HTTP traffic over port 8880, with endpoints such as /getinstall64.
πΉ Primary target profile: HR personnel in medium-to-large organizations.
π¨ Potential massive data breach β Lockheed Martinπ‘οΈ
A reported 375 TB of data allegedly linked to Lockheed Martin has surfaced on a βThreat Marketβ, now in a sale phase.
π Leaked data breakdown:
β’ π₯ Confidential videos β 68 TB
β’ πΌοΈ Confidential images β 24 TB
β’ π οΈ Unfinished projects β 31 TB
β’ π Completed projects β 42 TB
β’ π» Executable files β 18 TB
β’ π Blueprint files β 27 TB
β’ π₯ Office CCTV backups β 55 TB
β’ π» Source code β 9 TB
β’ π₯ Personnel information β 6 TB
β’ π Defense contracts β 5 TB
β’ π§ Email backups β 8 TB
β’ π°οΈ F-35 Block 4 β 21 TB
β’ π‘οΈ Defense systems β 14 TB
β’ π¬ R&D β 16 TB
β’ π§ͺ Technical & Debugging β 7 TB
β’ βοΈ Engineering Systems β 11 TB
β’ π Operations data β 7 TB
β’ π Security & access β 6 TB
π All data appears encrypted and access-locked, suggesting attackers may be selling access or decryption keys.
π Key insights:
β’ π¦ The structured organization suggests prolonged access or a staged exfiltration.
β’ β οΈ The nature of the data implies a potential geopolitical impact if legitimate.
β’ π§ References to advanced projects may aim to increase perceived value.
β’ β There is a possibility of exaggeration or fraud, which is common in underground markets.
π¨ New phishing campaign exploits Cisco domains to bypass security filters
The threat intelligence team at Outpost24 just documented a sophisticated attack that shows how attackers are taking phishing to the next level.
How does it work?
π§ It starts with an email impersonating JP Morgan, inserted into what looks like an existing thread. The email passes DMARC thanks to legitimate DKIM signatures via Amazon SES.
π The "Review Document" link points to https://t.co/v9BivuXshi β a trusted domain no one would block.
π From there, the victim bounces through Nylas (a legitimate email API platform), then through a compromised server in India, next through a domain originally registered in 2017 with residual reputation, and finally lands on the real phishing page protected by Cloudflare.
π‘οΈ 6 hops through trusted infrastructure. Each link in the chain has good reputation on its own. Traditional filters don't evaluate the full chain.
π‘ Key takeaways:
β’ A known domain in the URL doesn't guarantee safety
β’ Valid DKIM signatures don't mean the sender is legitimate
β’ Phishing-resistant MFA (FIDO2/WebAuthn) is no longer optional
β’ Ongoing security awareness training remains the first line of defense
The good news: the attack was detected and unsuccessful. β
The bad news: these techniques will keep evolving. π
π Full analysis by Specops Software: https://t.co/uL7ihX1nDQ
Artificial intelligence is no longer slowly entering our professions β
it is beginning to redefine them in real time βοΈ
First it impacted visual creativity π¨, then writing βοΈ, then programming π»β¦ and now it is starting to directly influence cybersecurity π and technical decision-making.
Every new technological release does not only introduce a tool β it changes the very way work is understood.
That is why we see immediate reactions in the stock market π not because companies suddenly lose value overnight, but because the market anticipates a shift in the production model.
When the way knowledge is produced changes, the way value is produced changes as well.
However, these movements do not mean the end of professions β they mean transformation π
Technology has always followed the same pattern: tasks disappear, but more complex roles emerge.
Artificial intelligence automates execution π€
but increases the need for human judgment π§
Therefore, the right approach is not fear, but adaptation π
Stay calm, keep studying, understand the new tools, and learn how to work with them instead of resisting them π
π¨ RAMP Forum Takedown & RaaS Migration π¨
Following the FBI takedown of the RAMP cybercrime forum π΅οΈββοΈ, a progressive reconfiguration of RaaS activity across alternative underground forums has been observed.
π Notably:
π DragonForce Ransomware Cartel appears to have started operating on this forum after the RAMP takedown, actively promoting its RaaS program and recruiting affiliates.
π© The Gentlemenβs RaaS, while maintaining a presence on this forum since 2025, is expected to increase its operational activity and visibility following the RAMP shutdown and subsequent redistribution of threat actors.
This reinforces a well-established pattern:
β οΈ Takedowns do not dismantle the ecosystemβthey accelerate activity consolidation within alternative hubs.
Some actors migrate, while others scale operations within existing infrastructures.
π Key CTI monitoring indicators:
βοΈ Post-takedown activity surge
βοΈ Consolidation of alternative forums
βοΈ Adjustments in RaaS business and affiliate models
π¨ Notepad++ Supply Chain Attack β Advanced Technical Summary
Recent investigations revealed a highly sophisticated supply chain compromise impacting Notepad++ update infrastructure, enabling attackers to selectively deliver trojanized installers to targeted victims.
According to Kaspersky GReATβs deep technical analysis, this was not a single-stage incident, but a long-running, multi-phase campaign active between June and December 2025.
Key technical insights from Kaspersky:
𧬠Multiple infection chains
- At least three distinct execution chains were identified
- Each chain used different:
β οΈ C2 servers
β οΈ Domains
β οΈ File hashes
β οΈ Payloads
- Tooling and infrastructure were rotated roughly monthly to evade detection
π― Highly targeted operation
- Victims included:
π΄ Government organizations (Philippines)
π΄ Financial institutions (El Salvador)
π΄ IT service providers (Vietnam)
π΄ Individuals across multiple regions
- The campaign was selective, not mass-distributed
π οΈ Advanced malware tradecraft
Delivery of the Chrysalis backdoor/loader
- Use of NSIS-based malicious installers
- Abuse of legitimate updater process (GUP.exe)
- DLL sideloading to load malicious payloads
- Use of Cobalt Strike Beacons
- Metasploit-based payload delivery
- Frequent infrastructure rotation to bypass IOC-based detection
ποΈ Key TTPs observed
- Registry Run Key persistence
- Collection and exfiltration of:
π οΈ Process lists
π οΈ System information
π οΈ Network connections
- Use of temporary file hosting (e.g., temp[.]sh)
- Multiple previously undisclosed IoCs published by Kaspersky
β οΈ Critical defensive takeaway
- A clean scan against public IoCs does not guarantee historical non-compromise
- Earlier infection chains used completely different indicators
- This highlights the limits of static IOC-based detection for APT-level supply chain attacks
This incident reinforces that modern supply chain attacks are:
π΄ Targeted
π΄ Long-lived
π΄ Multi-stage
π΄ Designed to evade traditional detection
https://t.co/rbKufNDJby
![CryptoInsane's tweet photo. π¨ Notepad++ Supply Chain Attack β Advanced Technical Summary
Recent investigations revealed a highly sophisticated supply chain compromise impacting Notepad++ update infrastructure, enabling attackers to selectively deliver trojanized installers to targeted victims.
According to Kaspersky GReATβs deep technical analysis, this was not a single-stage incident, but a long-running, multi-phase campaign active between June and December 2025.
Key technical insights from Kaspersky:
𧬠Multiple infection chains
- At least three distinct execution chains were identified
- Each chain used different:
β οΈ C2 servers
β οΈ Domains
β οΈ File hashes
β οΈ Payloads
- Tooling and infrastructure were rotated roughly monthly to evade detection
π― Highly targeted operation
- Victims included:
π΄ Government organizations (Philippines)
π΄ Financial institutions (El Salvador)
π΄ IT service providers (Vietnam)
π΄ Individuals across multiple regions
- The campaign was selective, not mass-distributed
π οΈ Advanced malware tradecraft
Delivery of the Chrysalis backdoor/loader
- Use of NSIS-based malicious installers
- Abuse of legitimate updater process (GUP.exe)
- DLL sideloading to load malicious payloads
- Use of Cobalt Strike Beacons
- Metasploit-based payload delivery
- Frequent infrastructure rotation to bypass IOC-based detection
ποΈ Key TTPs observed
- Registry Run Key persistence
- Collection and exfiltration of:
π οΈ Process lists
π οΈ System information
π οΈ Network connections
- Use of temporary file hosting (e.g., temp[.]sh)
- Multiple previously undisclosed IoCs published by Kaspersky
β οΈ Critical defensive takeaway
- A clean scan against public IoCs does not guarantee historical non-compromise
- Earlier infection chains used completely different indicators
- This highlights the limits of static IOC-based detection for APT-level supply chain attacks
This incident reinforces that modern supply chain attacks are:
π΄ Targeted
π΄ Long-lived
π΄ Multi-stage
π΄ Designed to evade traditional detection
https://t.co/rbKufNDJby](https://pbs.twimg.com/media/HAPa6zRWkAA2Ba1.png)
π΄ A New Ransomware Threat Emerges in Underground Hacker Forums: MonoLock π¨
MonoLock is a newly emerged ransomware threat actor observed in high-profile underground hacker forums. The group presents a redesigned, multi-platform ransomware framework with a strong emphasis on operational security (OPSEC) and architectural efficiency, aiming to modernize traditional ransomware tradecraft. π§ βοΈ
MonoLock is built around a Beacon Object File (BoF)βcentric architecture, enabling fully in-memory execution, modular payload deployment, and a reduced forensic footprint while maintaining centralized control. π§¬π§
πͺ Windows Capabilities
On Windows systems, MonoLock provides a mature ransomware toolkit that includes:
- Privilege escalation without registry or LOLBin abuse οΏ½οΏ½οΏ½οΏ½
- Programmatic deletion of shadow copies and restore points π§Ή
- Anti-analysis and virtualization detection π‘οΈ
- SYSTEM-level persistence mechanisms β»οΈ
- High-speed data exfiltration π
- Selective full or partial file encryption using hybrid cryptography π
These features indicate a solid understanding of Windows internals and enterprise defenses π’π§©.
π§ Linux Capabilities
MonoLock extends its operations to Linux by offering:
- Custom ELF loaders for in-memory execution π§
- Native encryption and decryption tooling π
- Optimized thread management βοΈ
- Granular targeting via whitelist and blacklist logic π―
This reflects a deliberate focus on Linux servers and infrastructure environments βοΈπ₯οΈ.
π§ ESXi Capabilities
For virtualized environments, MonoLock delivers a dedicated ESXi variant as a standalone executable:
- Full encryption and fast decryption routines πβ‘
- Cryptographic consistency with Linux implementations π§©
This highlights an intent to target enterprise virtualization layers ποΈ.
π Zero-Panel Strategy
MonoLock adopts a Zero-Panel Strategy, avoiding public leak sites, Tor panels, and extortion portals. This approach prioritizes silence, reduced exposure, and private negotiation, significantly lowering OPSEC risks π€«π‘οΈ.
π Assessment
MonoLock represents an evolution toward low-noise, high-OPSEC ransomware operations, characterized by:
- Memory-resident, modular tooling π§
- Explicit multi-platform targeting π
- Reduced public visibility ποΈβπ¨οΈ
π§ Ongoing monitoring will be essential to evaluate MonoLockβs maturity, adoption, and long-term impact π.
@anyrun_app Thanks for the mention! π₯³πππΎ
π§¨π οΈ Weapon β undetected bot with extensive functionality π οΈπ§¨
A new Weapon project is up for sale on underground forums, presented as a platform that evolved from an initial stealer into a full-featured multifunctional bot, developed in Node.js + Rust + PowerShell. It stands out for its modular architecture, efficient communication via a single WS/WSS connection, and a hot updates system that enables instant deployment of changes and improvements. Distribution is mainly via MSI, with an alternative cmd oneliner installation, and it is managed through a modern Next.js web panel, with full proxy support and simplified deployment using Docker Compose. The key advantage of MSI is that it remains clean for an unrealistically long time; according to the creator, it has already been distributed across 30,000 installations using a single MSI.
𧩠Bot Features
π Hot updates for code and features
𧬠Additional morphing and AV recognition
βοΈ Core logic moved to a native addon
π§ Keylogger with Unicode support
π High-precision seed clipper (clipboard)
π File manager with extended capabilities
π Single WebSocket communication channel
π§ͺ Includes runPE and shellcode loaders
π Installation via MSI and cmd oneliner
π΅οΈ Stealer Features (Rust)
π¦ Developed in Rust
π¦ Compiles to EXE (DLL option planned)
𧡠No use of std::thread or TLS-dependent std components
𧱠Can operate as shellcode
π WS/WSS server communication
π Browser data collection:
Chromium (Chrome, Edge, Brave, Opera, Opera GX): passwords, cookies, payments, autofill
Gecko (Firefox): cookies
𧩠Collection of 65 browser extensions
πΌ Collection of 10 desktop wallets
π¬ Discord tokens (desktop app and browsers)
βοΈ Telegram data
π File grabber: .ssh, Documents, Downloads, Desktop
π§ Control Panel Features (Next.js)
π Campaigns with separated workspaces
π Analytics and metrics
π‘ Guard manager (proxies), Config manager, Build manager
βοΈ Uploads (file hosting)
π₯ User manager (admins only)
π Log viewer, exports, and filters
π€ Agent viewer, file manager, SOCKS, keylogger
π³ Simple deployment with Docker Compose
π¨ Cybersecurity Alert: Radiant Ransomware Group Shuts Down and Offers Free Decryption for Hospitals & Schools π
The Radiant ransomware group has issued a surprising statement announcing their full shutdown of operations and withdrawal from the dark web. This decision appears to be a direct response to the intense public condemnation generated by their attacks.
Most notably, they are attempting to "compensate" by focusing exclusively on the Health and Education sectors:
β’ Specific Offer: Radiant is providing a complete free decryptor for any Hospital π₯ or School π« that was victimized by them.
β’ Motivation: The group states that attacks on hospitals and children are "unpleasant targets" and apologizes for the damage caused.
π‘ Key Implications
1.- Reputational Impact: The Radiant case underscores how public opinion and media condemnation can influence cybercrime groups.
2.- Lingering Risk: Despite the shutdown, data stolen from non-paying victims has reportedly been sold to third parties. The risk of a data leak still persists.
π Call to Action for Victims (Hospitals/Schools)
If your Hospital or Educational Center was affected by a recent ransomware attack, it is crucial to make contact as soon as possible to try and obtain the free decryptor.
Free Decryption Contact (ONLY Hospitals/Schools): 97DF90F5B408E053465D6A3F85596DB3B2342CA47D1D944D45A0A6E654A5A33CF9D634B13981
π Transition of Weyhro Group: From Ransomware Operators to Offensive Cyber-Mercenary Services
π΅οΏ½οΏ½οΏ½ββοΈ Intelligence gathered from cybercrime underground forums indicates a strategic pivot by the threat actor known as "Weyhro." Formerly identified exclusively as a ransomware operator targeting corporate entities, the group has transitioned into a "Cyber-Mercenary" and infrastructure provider role.
π
The actor's timeline shows active ransomware operations from December 12, 2024, to August 10, 2025. Following a period of silence, the actor resurfaced on December 3, 2025, not to recruit affiliates for a RaaS scheme, but to sell a proprietary C2 framework and offer direct offensive services to other criminals.
π― Strategic Objectives
β’ πΌ Professionalization of Cybercrime: Move away from typical affiliate models to offer specialized, tiered "consulting" services (Pentesting, Intelligence, Extortion) with fixed pricing or profit-sharing models.
β’ π° Tool Monetization: Capitalize on internal development by licensing the "Weyhro C2" framework, likely battle-tested during their previous ransomware campaigns.
β’ π» Operational Evasion: Maintain a focus on stealth and anti-forensics to ensure the longevity of their tools and services in controlled corporate environments.
π οΈ Attack Tools & Methods
Weyhro C2 Framework:A modular Command and Control agent designed for stealth and persistence, offered at π΅ a significant monthly subscription. It strictly prohibits execution on CIS (Commonwealth of Independent States) machines π«π·πΊ.
Communication & Access:
π Shell: High-speed interactive reverse shell for real-time command execution β‘.
π SOCKS5: Stable resident proxy compatible with ProxyChains for lateral movement within internal networks π.
π» HVNC (Hidden VNC): Launches a covert browser session utilizing the victim's profile data (πͺ cookies, π passwords) for undetectable remote access π΅οΈββοΈ.
Credential Theft:
ποΈ Kerberos Dumper: Automates the extraction of Kerberos tickets (current or all sessions via admin) and LSASS dumps π.
Advanced Evasion:
π‘οΈ Defense Evasion: Features polymorphic code π§¬, compression π¦, AES/ChaCha20 encryption π, API Unhooking, and AMSI/ETW bypass to evade EDR detection π«ποΈ.
π Operational Services & Business Model
The group now operates a structured service menu, allowing third parties to outsource specific stages of an attack chain. The pricing reflects the level of effort and risk assumed by Weyhro:
βοΈ Pentest (Significant fixed sum):
Scope: Hacking into systems and obtaining administrative rights π.
Requirements: Just access to the target π―.
π§ Intelligence (Standard fixed sum):
Scope: OSINT gathering of company contact data (π§ emails, π± phones) and forcing communication channels π£.
Requirements: Company name or website π.
π’ Extortion (30/70 Profit Split):
Scope: Coercing companies to pay to prevent data leaks π§.
Requirements: Corporate data and ZoomInfo access π.
Split: Weyhro retains 30%, client keeps 70% π.
π₯ Compromise (70/30 Profit Split):
Scope: Full-spectrum attack execution: Pentest, data theft, system destruction π£, followed by extortion.
Requirements: Just access to the target π―.
Split: Weyhro retains 70%, client keeps 30% (reflecting the heavy operational load on Weyhro) π.
π Impact & Hypothesis
β’ ποΈ Internal Capability to Commercial Product: The release of Weyhro C2 and the specific "Compromise" service strongly suggests that the group is monetizing the exact TTPs (Tactics, Techniques, and Procedures) used during their 2024-2025 ransomware campaign. The "Compromise" service essentially allows unskilled actors to pay Weyhro to conduct a full ransomware-style attack on their behalf π€.
β’ πΊοΈ Attribution & Origin: The strict "No-CIS" restriction on the C2 tool reaffirms the likelihood of the operators being based in Russia or Eastern Europe. The naming convention remains ambiguous; it is unclear if "Weyhro" was initially a project name that became the group's alias, or vice versa, but the brand is now being leveraged to sell high-end cybercriminal services π΄ββ οΈ.
@RussianPanda9xx It appears that the Weyhro group, which was initially focused on ransomware, has expanded its "business scope." They now provide a "service" kit, and I estimate that this shift has motivated them to develop a tool both for their own use and for rental to third parties π οΈπ»π΅οΈββοΈ
@RussianPanda9xx In March of this year, a ransomware called Weyhro emerged. I wonder if it is the same team π§
Integrating "NightEagle" into the US Cyber Operations Group (S32 Division) π΅οΈββοΈπΊπΈ
After months of inactivity due to my scientific research, I had this post pending. For years I have been collecting public and leaked information about APT groups, and for this research, I will rely on the data I have gathered regarding the US Cyber Operations Group, focusing specifically on the S32 Division. π΅οΈββοΈπ»
A few months ago, the NightEagle (APT-Q-95) group was exposed. I have analyzed their patterns to locate them within my S32 diagram and observe the correlations:
π 1. Operational Discipline (ROC) : In my scheme, the Remote Operations Center (ROC) coordinates real-time attacks. NightEagle fits here by operating strictly from 21:00 to 06:00 Beijing time (US West Coast business hours) and without overtime, typical behavior of a regulated military unit.
π 2. Massive Infrastructure (MIT) : The Mission Infrastructure Technologies (MIT) unit manages proxy networks and persistence. This matches NightEagle's ability to use "ultra-fast switching infrastructure" and assign unique domains per target, relying on centralized logistics.
π οΈ 3. Access Technology (ATO) : The Access Technologies & Operations (ATO) division develops covert implants. NightEagle employs precisely these elite capabilities: unknown Exchange exploit chains and undetectable in-memory malware.
π© Conclusion:I have integrated NightEagle as an execution force (Task Force) under the command of the ROC, but technologically supported by ATO and MIT. It is not an isolated actor, but part of a larger gear in the S32.
Hi friends! ππ
Iβve been MIA for 7 months because I was fully focused on an academic project Iβm really excited aboutβ¦ I just finished my first scientific paper! ππ
Itβs been an intense journey of math, strange patterns, and a lot of code while diving deeper into cryptography.
Iβm now checking if my universityβs scientific journal is the right place to publish it, so the title and details stay secret for now π€«.
Iβm officially back! Thanks for sticking around. β¨
@elonmuskTN The best number is 23 because it is formed by the first two consecutive prime numbers, and the union of them also results in another prime.
Headline: π¨ Major Data Privacy Enforcement in China: 70 Mobile Apps Cited for Violations.
China's National Computer Virus Emergency Response Center (CVERC) has officially notified 70 mobile applications for illegal and improper collection and use of personal information.
This detection effort, conducted between September 1 and September 28, 2025, is part of a broader high-level "2025 Personal Information Protection Special Action" involving multiple state ministries (CAC, MIIT, MPS, SAMR) aimed at enforcing the Cybersecurity Law and the Personal Information Protection Law (PIPL).
π Key Insights & Major Violations Detected:
The report identifies 12 distinct categories of compliance failures across the 70 apps. The most significant issues include:
π‘οΈ Critical Security Gaps: The largest category (34 apps) failed to implement necessary security measures like encryption or de-identification of data.
π Privacy Policy Failures: Many apps had inadequate policies that didn't clearly state the scope of collection, were difficult to access, or failed to prompt users approriately upon first launch.
π Consent Issues: Significant hurdles for users trying to withdraw consent, or apps collecting data before obtaining consent.
π Unauthorized Sharing: Sharing data with third parties (via SDKs/plugins) without separate consent or anonymization.
πΆ Minors' Data at Risk: Several apps mishandled the data of minors under 14, lacking specific rules or guardian consent.
π« No Policy at All: 9 apps were found operating with absolutely no privacy policy.
π Enforcement Outcome: Besides listing the current 70 offenders, CVERC noted that 28 apps identified in a previous report failed to rectify issues upon re-testing and have been removed from app distribution platforms.
π°οΈ Cyberattack Attributed to the NSA Against Chinaβs National Time Service Center (NTSC) π¨π³
Chinaβs cybersecurity authorities released a detailed technical report accusing the U.S. National Security Agency (NSA) of conducting a long-term cyber-espionage campaign against the National Time Service Center (NTSC).
The operation allegedly began in March 2022 with mobile-based espionage and extended until mid-2024, targeting Chinaβs high-precision timing and navigation infrastructure.
π― Strategic Objectives
β’ Achieve persistent access and long-term surveillance within NTSCβs internal networks.
β’ Exfiltrate credentials and system configurations to maintain covert control.
β’ Prepare offensive capabilities against high-precision timing and navigation systems, critical for national infrastructure. π°οΈ
π οΈ Attack Tools & Methods
Initial access: Exploitation of a foreign SMS service vulnerability to spy on 10+ NTSC employees and steal mobile data (contacts, messages, photos, location). π±
β Stolen credentials were later used for remote logins (80+ sessions) from anonymous nodes during 2023. π
Three main malware families identified:
1.- eHome_0cx β persistence & initial control (auto-start via DLL hijacking).
2.- Back_Eleven β encrypted tunneling, traffic redirection, and C2 communication.
3.- New_Dsz_Implant β modular data-theft framework (25 plug-ins for system discovery and file access). βοΈ
Combined use achieved four-layer encryption (RSA + AES + TLS + local loopback), making network traffic nearly impossible to detect or decrypt. π
Several attacks involved remote antivirus shutdowns, in-memory execution, and simulation of user behavior to evade EDR detection. π§©π‘οΈ
π Command-and-Control Infrastructure
Over 40 C2 servers traced across the U.S., Europe, and Asia, showing a globally distributed relay network to conceal attribution. π
β οΈ Impact & Risk
The attackers reached deep internal systems such as authentication servers and firewalls, posing a severe threat to national infrastructure that depends on synchronized timing β both civilian and military. β±οΈπ₯
Last Seen Users on Sotwe
tobrut mulus
Seen from Indonesia
Bulge & Freeballing π
Seen from Turkey
ALΔ° TΓRK
Seen from Oman
Rose
Seen from United States
δΉι’ζ§γγͺγͺγ³γ«γοΌζ·±ε³οΌ
Seen from Japan
Porn Sudan
Seen from Egypt
Enes
Seen from Turkey
Her Telden Porno
Seen from Turkey
sub foot boy.
Seen from Netherlands
Jade
Seen from Netherlands
Trends for you
Most Popular Users
Elon Musk
@elonmusk
240.2M followers
Barack Obama
@barackobama
119.3M followers
Donald J. Trump
@realdonaldtrump
111.6M followers
Cristiano Ronaldo
@cristiano
109.2M followers
Narendra Modi
@narendramodi
106.9M followers
Rihanna
@rihanna
97.3M followers
NASA
@nasa
92.1M followers
Justin Bieber
@justinbieber
90.6M followers
KATY PERRY
@katyperry
86.9M followers
Taylor Swift
@taylorswift13
80.8M followers
Lady Gaga
@ladygaga
72.3M followers
Kim Kardashian
@kimkardashian
69.4M followers
Virat Kohli
@imvkohli
68.7M followers
YouTube
@youtube
68.6M followers
Bill Gates
@billgates
63.5M followers
The Ellen Show
@theellenshow
62.5M followers
CNN
@cnn
61.9M followers
Neymar Jr
@neymarjr
61.3M followers
X
@x
60.9M followers
Selena Gomez
@selenagomez
60M followers
β¨
β
π«