Felipe Duarte

Malware researcher, CEH, GREM, electronics geek, IoT enthusiast, programmer, drone lover and machine learning fan. Just hunting malware for fun... and profit!

[Nicolas Krassas @Dinosn]

I built an open-source library of 700+ cybersecurity skills for AI coding agents -- covers DFIR, threat hunting, cloud security, and more https://t.co/vM5SgmXCrO

[Panos Gkatziroulis 🦄 @ipurple]

Agentic-SOC-Simulation: AI-powered SOC simulation platform https://t.co/pYBhC30TEB

[0b1d1 @_0b1d1]

🚨 SOC Playbook Complete Phishing Investigation Guide 🚨

🎯 From Inbox to Incident Closure: Mastering Phishing Defense
Phishing continues to be the leading initial compromise method in modern cyber breaches

📧Comment PDF for full Guide

[Felipe Duarte @dark0pcodes]

@colCERT Campaña activa de Phishing.
Redirect: hxxps://pgsmit[.]fi/multas
Phishing: simit-pago[.]cc

Ataque inicia con un mensaje de texto que contiene el nombre de la victima.

[Felipe Duarte @dark0pcodes]

https://t.co/em4E2Fpjqp

[Felipe Duarte @dark0pcodes]

Things that you only see in malware analysis 🤯

I just unpacked Lumma Stealer, and the first sign to know I nailed it: a warning pop up!

A debug message to remind rookie attackers not to self-infect 😂

#MalwareAnalysis #Cybersecurity

[Felipe Duarte @dark0pcodes]

@threatactress Thanks for reporting. Let me check what happened.

[Felipe Duarte @dark0pcodes]

Check out! Our latest research were we exposed several tools found during an incident response involving APT41.

https://t.co/FlKdX6TNpk

[Felipe Duarte @dark0pcodes]

@JParticle0 Thanks for reporting. Let me check what happened.

[Felipe Duarte @dark0pcodes]

@Myrtus0x0 Qbot, I analyzed it so hard one time that it would be nice to validate all my conclusions with the source code.

[Felipe Duarte @dark0pcodes]

@rucko24 @1ZRR4H @malwrhunterteam Si como fake vulnerability assessment.

[Felipe Duarte @dark0pcodes]

¡Atención! 🚩 Están circulando campañas de distribución del malware Lumma Stealer, usando una técnica tan simple (y estúpida) como peligrosa. Esta campaña afecta especialmente en sitios de streaming llenos de anuncios.

[Merl @Merlax_]

#Malware RAT Operador 🇧🇷 posible Ousaban🤔

- Objetivos 🇧🇷 y posible 🇦🇷
- El panel web parece loguear la actividad al congelar el equipo de la víctima 🤦‍♂️

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

You can also leverage @virustotal Enterprise to search for potential C2s related to #LummaC2 based on the redirect page.

[Who said what? @g0njxa]

Quick changes on this reCAPTCHA malware campaign now abusing @digitalocean S3 buckets and CDN to still deliver #Lumma Stealer.

Similar behavior,
Detonation: https://t.co/mwDF6JMxjx

[Felipe Duarte @dark0pcodes]

@Hackeadonoti Jajaja si parece

[WatchingRac @RacWatchin8872]

#Lummac2
With this simple query is possible to find more Lumma C2:
https://t.co/yjMmFt4l6d
CC:
@banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev