extr

Security Engineer

[extr @e3xtr]

RCE Succeeded on IE 11! :b

[Gonjeshke Darande @GonjeshkeDarand]

Time's up - full source code linked below.

ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.
بازمانده دارایی های شما در نوبیتکس هم اکنون در معرض دید و خطر هستند

But before that, lets meet Nobitex from the inside:

Exchange Deployment (1/8)

[Bitcoin News @BitcoinNewsCom]

NEW: 🇮🇷 Iranian crypto exchange Nobitex was exploited for $81.7M, including Bitcoin that was permanently burned.

🇮🇱 Pro-Israel hacker group Predatory Sparrow claims responsibility and vows to release Nobitex’s source code and internal data within 24 hours, warning remaining assets are at risk.

[The Hacker News @TheHackersNews]

🚨 WARNING: Another Chrome zero-day exploited in the wild.

Google just patched CVE-2025-5419 — a high-severity V8 engine flaw found by its own Threat Analysis Group.

Attackers are already using it via malicious HTML pages.

Update Chrome NOW | Read: https://t.co/OgAGwctPpI

[su18 @K_MnO4_]

博客好久没更新了，发一篇笔记

Postgresql JDBC Attack and Stuff

https://t.co/TPetbSKrv9

[Asian Cyber Security Challenge (ACSC) @acsc_asia]

🚨 Asian Cyber Security Challenge (ACSC) is back!
🗓️ Aug 16 (Sat) 12:00 – Aug 17 (Sun) 12:00 JST
🌏 Hosted by 5 non-ASEAN ICC countries (Team ASEAN launched!)
🎮 Open to all, but finalists must be nationals of those 5.
📜 Selection rules coming soon!

🔗 https://t.co/CBvVR0NI4o

[HaxRob @haxrob]

Newer variants of the #BPFDoor has an interesting modification made that avoids detections looking for processes with raw sockets. The kernel reports SOCK_DGRAM rather then rather loud "SOCK_RAW". Here we have a sample found in the recent SKT telco breach. (1/20)

[L0Psec @L0Psec]

Yes, appears to be another DPRK sample. C2 passed as an arg to this binary. Leverages CURL API's. Executes data written to /Users/Shared/.<random> with popen(). Imported function calls aren't resolved at first, requires following jumps to clean up and rename.

[The Hacker News @TheHackersNews]

🚨 Massive new risk for data systems!

CVE-2025-30065 | Apache Parquet Java lib flaw (CVSS 10.0) lets attackers execute arbitrary code via poisoned files.

If your pipelines touch untrusted Parquet files, patch NOW.

Read: https://t.co/eDM2YrFEIY

[Stephen Fewer @stephenfewer]

We now have a @metasploit exploit in the pull queue for that Oracle Access Manager vuln, CVE-2021-35587. You can check it out here: https://t.co/awXwpTq2wr

[cts🌸 @gf_256]

In 2020, I solved a gnarly reverse engineering challenge in PlaidCTF. Only 9 teams solved.

It's a huge pile of Typescript. Everything is named after a fish.

The catch? There's no code, only types. How do they perform computation using just the type system?

(Spoiler: Circuits!)

[JangPro @JangPr0]

#APT #DPRK

a87c663dea792121b6a17b8e605159116e30434f2c67b8be0b198ba8229d2a3d

Decoy: 가상자산 사업자 자금세탁방지 감독 방향.hwp

hxxps://yellowstone-marketing[.]com/wp-includes/js/inc/get.php
hxxps://yellowstone-marketing[.]com/wp-includes/js/src/upload.php

[Sekoia @sekoia_io]

🇰🇵 Sekoia #TDR team investigated a malicious campaign that employs fake job interview websites to deliver backdoors on Windows and macOS - #GolangGhost using #ClickFix tactic. Dubbed #ClickFake Interview, this campaign has been attributed to #Lazarus APT

https://t.co/4MWmTdXnAI

[extr @e3xtr]

@austinkim_n ㅁㅊ

[extr @e3xtr]

@austinkim_n 뜻이 있는 뭔가가 아니라 그냥 어쩔티비아님?

[ᕕ( ᐛ )ᕗ(feat.전국하남자협회) @yes_mumung]

울 먼지가 안쓰는 장난감
동생이 친구네 고양이 줬는데
그 고양이는 그 장난감이 너무너무 좋대
그래서 사진보내줬는데 개귀여움

[cts🌸 @gf_256]

I made a plugin for HxD that's helpful for CTF players. Now you can copy as string, Python array, or base64. Finally, no more cyberchef for base64<->hex. Download it here https://t.co/nT2uR76Z4I

[KEENLAB @keen_lab]

KeenLab released the latest 5G security research demo : https://t.co/IuWdBRYYPt

[kmkz @kmkz_security]

Attack and Defense Around #PowerShell Event Logging: from V2 to V6 (and PWSH that increase your attack surface) - both #BlueTeam and #RedTeam point of views :)
https://t.co/Yh625X2rNc

+ #Microsoft #Security Security Advisory #CVE-2018-8415: https://t.co/DRJkpIyRk1

[0xdf @0xdf_]

It was after I solved Remote originally that RoguePotato was released by @decoder_it and @splinter_code. I realized too late last week that Remote was a good target, hence the follow up post. I'll also look at how @ippsec ran it and why that worked.

https://t.co/MLYAuNYC14

[extr @e3xtr]

File and file meta information acquisition using PowerShell in Live Response environment
https://t.co/nBFjM4Pwpe