Yury Polozov

Cybersecurity, IT, threat assessments. Sr. Cyber Security Analyst. Tweets are my own (personal) opinions, not endorsed.

[Yury Polozov @cyberyp]

At least one malicious Facebook profile similar to the NodeStealer 2.1 #malvertising campaign reported by Bitdefender is still online. #CyberSecurity

[BostonSecurityMeetup @securitymeetup]

Boston Security September 2023 Meetup RSVPs are live.
https://t.co/k7Avcq3sb3

[Yury Polozov @cyberyp]

certain Snake built-in commands that will terminate the Snake application and overwrite its vital components without affecting any legitimate computer operation, applications, or files. Targets: Media, Defense, #NATO #cybersecurity https://t.co/rXW4UXR6Zl

[Yury Polozov @cyberyp]

#FBI Ordered Russian Malware to Self-Destruct. The Malware Obliged.
Active since 2004, the Snake (Uroburos) malware is used by Turla (Uroburos, Venomous Bear) that is attributed to Center 16 of the Federal Security Service of the #Russian Federation (#FSB). ->

[Yury Polozov @cyberyp]

30 days following May 4, 2023. They developed the #PERSEUS remote search technique for probing and Snake C2 impersonation. PERSEUS sends a Snake-HTTP or a Snake-TCP transmissions and the type of response confirms if the target is #compromised by Snake. Then PERSEUS can send ->

[Yury Polozov @cyberyp]

@TrendMicroRSRCH Great data, but is it Whisper or Whisker? You have it both ways in the IoC section: "Backdoor.Win64.WHISPERSPY.A WhiskerSpy"

[Yury Polozov @cyberyp]

@SCMagazine @WithSecure Great report! Could you advice on two YARAs having the same name, lazarus_dtrack_unpacked, the second one actually for Acres?

[Anomali @Anomali]

It's time to tap the large reservoir of talent with analytical skills to help tackle the #cybersecurity talent shortage. https://t.co/GjcKmb8mCd by @Anomali's @Circuitous__ via @DarkReading #talentshortage

[Yury Polozov @cyberyp]

.@BlackBerry: "Russian sentence that somewhat cryptically translates to: “I drive SS into Dark.”" --> It likely translates to "I feed CC [credit card data] into Dark." https://t.co/OY8tzBESQ4

[Yury Polozov @cyberyp]

1/2> Great research on DCRat, but I would suggest alternative translation from Russian. "likely they’re bragging about stealing data from Russia, the UK" -> not the UK, they wrote about targeting Russian speakers in Ukraine.
https://t.co/pkXoBuwFZZ -->

[Ismael Valenzuela @aboutsecurity]

Prices are rising, but you can still find bargains in the world of Russian #crimeware. Read our latest blog on #DCRat, a homemade but effective tool for opening backdoors on a budget, from our @BlackBerry Threat Research & Intelligence Team https://t.co/jDQNMUs1bb #DarkCrystal

[Yury Polozov @cyberyp]

@vxunderground I’d say LNK!

[Cryptolaemus @Cryptolaemus1]

🚨#Emotet Update🚨 - Looks like Ivan laid an egg for easter and has been busy. As of about 14:00UTC today 2022/04/18 - Emotet on Epoch 4 has switched over to using 64-bit loaders and stealer modules. Previously everything was 32-bit except for occasional loader shenanigans. 1/x

[Yury Polozov @cyberyp]

Nigerian princes are replaced by #Russian oligarchs! #scam #fraud #419

[Yury Polozov @cyberyp]

Strange #smishing spam message: when opened in sandboxes this nyxk2[.]xyz...(no longer working) opened #Russian State TV domains 1tv[.]ru and 1tv[.]com

[Bill Demirkapi @BillDemirkapi]

Interesting note. The "chrisro[.]fun" domain is registered to "SYKES LATIN AMERICA" and in this screenshot below we can see some tool in the taskbar named "SYKES Secur...".

[Raphael Satter @razhael]

But what proved key in the end was the Bitly short link @oxana_tinko uploaded along with the malicious accoounts-google URL.

It tied back to a hyperactive bitly user who was creating tons of shortlinks — all of them pointing to similar phishing sites.

[Yury Polozov @cyberyp]

New #smishing scam targeting #NewHampshire cell owners, judging by the code, a similar template was used against New York. Don't fall for it, not an official website, phishing for your social security and other information. #covidscam
#IoCs: doh-dmv[.]com, registered to a gmail

[Anomali @Anomali]

The latest from Anomali Cyber Watch: Equation Group’s Post-Exploitation Framework, Decentralized Finance (DeFi) Protocol Exploited, Third #Log4j Vulnerability, and More. #Equation #Cybersecurity #Cybercrime #threatintelligence #Exploit https://t.co/ViGuA1aVAG