Danny 🌻

Security Researcher @ Lumen, black coffee connoisseur, dog lover, follower of sea turtles, SHU 13, my thoughts are my own. (he/him)

[Danny 🌻 @dadamitis]

My job today is beach.

[Danny 🌻 @dadamitis]

Happy tortured poets society day to everyone!!!

[Danny 🌻 @dadamitis]

@greglesnewich @JasonAtwell14 @sj94356 I will also acknowledge that myself and @sj94356 are avid swifties. So threat intelligence is really just something we do in between albums drops to pass the time #mastermind

[John Althouse @4A4133]

Pivoting on the JDY C2 proxy cert hash in https://t.co/C2j3umgWeI shows an IP, 45.76.67.43, that was not listed in Lumen's IOC list. Though it looks like it was only active for 2 days and has since been recycled back into Vultr.

[Danny 🌻 @dadamitis]

@BlackLotusLabs If you enjoy our blog, I would also recommend checking out Spur’s write up from the other prospective https://t.co/0MaNeQ6kxT

[David Maynor @Dave_Maynor]

https://t.co/CGKjxVFmPH I am happy to be an advisor, aka Keeper of Secrets to @ThreatHunter_AI and working with @whiskeyhacker. Watch for great things to come.

[LABScon 2026 @labscon_io]

#LABScon23 is here!

Sep 20-23, 2023 in Scottsdale, Arizona

Head to https://t.co/q1msQScycV for all the details!

[David Maynor @Dave_Maynor]

https://t.co/HYyKDnSiWu the base for a repo for low power tracker research. Expect more to be added. Great research sponsored by @cybraryIT! #flipperzero #ble #airtag

[SentinelLabs @LabsSentinel]

soon.

[SentinelLabs @LabsSentinel]

New Research -- "Tainted Love" APT Operation

✴️Targeting Middle East telecom.
✴️ Likely connected to a Chinese groups in the nexus of Gallium and APT41.

Full Report: https://t.co/SWnqTXiAKk

By @milenkowski @juanandres_gs @joeychen @QTrust

[Danny 🌻 @dadamitis]

@tinfoil_globe That was a typo, working up updating it now. Thank you!

[Danny 🌻 @dadamitis]

Today we’re releasing research on brand new activity cluster we’re calling Hiatus. This actor has an affinity for target routers, to gather pcap and use as covert infrastructure.

[Danny 🌻 @dadamitis]

Side note: I didn’t actually create this meme. Someone else on the internet did, so I just reposted it because it made me chuckle.

[Danny 🌻 @dadamitis]

New blog dropping at 10am this morning , check it out here https://t.co/vjEt7I9Zvu

[Danny 🌻 @dadamitis]

To get all the details check out the blog here https://t.co/qfuUaK9Qgl with IOCs found here https://t.co/eDby8NLFfg

[Danny 🌻 @dadamitis]

Oh and one more thing that caught my eye, when we looked at the embedded config file the malware identified itself as version 1.5. So while this latest campaign goes back to July 2022. This activity cluster almost certainly preceded that date.

[Danny 🌻 @dadamitis]

Setting up an account on the elephant app, hit me up there [email protected]. Don’t worry I’ll continue to provide the same threat intel, salty comments, and spicy memes as before.