0x6C

Move forward a step at a time. 🇦🇺
DFIR. GCIH, GCFA. FGC

[𝕡𝕨𝕟𝕚𝕖 @0xpwnie]

Microsoft blocked Office macros in 2022. Attackers moved to ISO files. Microsoft fixed ISO files. Attackers moved to LNK and OneNote. Microsoft closed those too. By mid-2024 attackers had landed on MSC files, the administrative console files used by IT teams to manage Windows systems. GrimResource exploits a cross-site scripting vulnerability in apds.dll that was reported in 2018 and never patched. The sample that exposed the technique was a red team payload accidentally uploaded to VirusTotal by a blue team analyst who picked it up during an assessment. When it first landed on VirusTotal on June 6 2024, zero antivirus engines flagged it.

[YungBinary @YungBinary]

New blog is out! Digging into TAG-150’s evolving tradecraft across #DinDoor, #DenoRAT, and #NightshadeC2.

We break down the infection chain from ClickFix/MSI → AI-generated PowerShell → DinDoor → DenoRAT, which ultimately executes NightshadeC2 in memory via a Python loader that invokes reflective PE injection shellcode.

https://t.co/c9DM0BALZC

[0x6C @dwizel]

I've been trying this but I never follow up. Good to know. Thanks

[KZ | OneXTH @OneXTH_]

Raiden tech vs Homelander (works with Reptile, Li mei and various other characters too)
@WhitsFGC

[KZ | OneXTH @OneXTH_]

Raiden tech vs Homelander (works with Reptile, Li mei and various other characters too)
@WhitsFGC

[Anthropic @AnthropicAI]

We’ve received notice that the Department of Commerce has lifted export controls on Claude Fable 5 and Mythos 5.

We'll begin restoring access tomorrow, and will share an update soon.

We’re grateful to our users for their patience, and to everyone who worked with us on redeploying the models.

[0x6C @dwizel]

@ErosNectar How fast is your shipping internationally?

[0x6C @dwizel]

@livingdevops Living Devops

[Elli @ellishlomo]

Microsoft Sentinel just leveled up with Sentinel Data Lake:

● Powered by Microsoft Fabric OneLake
● Native support for KQL and PySpark
● Analyze hot, archived, and long-term logs (no rehydration)
● Break free from ingestion based SIEM cost models

This changes how we do security at scale

https://t.co/WRN7hCtPfd

[Joe G @EastEndJoe]

Dumbass of the week!

[0x6C @dwizel]

@DearS_o_n Learning this the hard way

[0x6C @dwizel]

@Steph3nSims Let's goooo

[Georgy Kucherin @kucher1n]

A few weeks ago, I was responding to a cybersecurity incident - $500,000 have been stolen from a #blockchain developer. The infected operating system was freshly installed, and the victim was vigilant about cybersecurity. How could this happen? New supply chain attack? [1/6]

[0x6C @dwizel]

@kucher1n From a mitigation perspective, how does one detect/defend against this? I work with a lot of developers

[0x6C @dwizel]

@_josehelps @Huntio Thank you

[0x6C @dwizel]

@ruffydfire The jokes write themselves ahead of time

[0x6C @dwizel]

@SuperSmada Accountability is the main issue mixed with lack morals and thuggery from top to bottom. Mind you citizens are not excluded, they're also part of the problem

[0x6C @dwizel]

@SEI_CMU Tried to read this article but your website is down for maintenance. When will it be back up?

[0x6C @dwizel]

@vline_seymour You don't bloody say. And you're just letting us know. There's lots of people sitting here at Donnybrook waiting on a train.

[0x6C @dwizel]

@MKJavierMK @noobde When all you do is zone. Just keep quiet