Eduardo Mattos

Principal Consultant @Mandiant

[Mandiant (part of Google Cloud) @Mandiant]

M-Trends 2023 is live! Download the 14th edition of Mandiant’s unique analysis of today’s cyber threat landscape today.

https://t.co/WouGruDvxK

#MTrends #Cybersecurity

[Tyler McLellan @tylabs]

Mandiant has observed a new ALPHV (aka BlackCat ransomware) ransomware affiliate, tracked as UNC4466, target publicly exposed Veritas Backup Exec installations https://t.co/wPWfLTrO2v

[Tyler McLellan @tylabs]

In September 2022 Mandiant Managed Defense detected data staging and exfiltration at a Ukrainian organization. Digging into this incident, we discovered QUIETCANARY (aka Tunnus), a suspected Turla Team backdoor, was the source.

[Tyler McLellan @tylabs]

Mandiant Blog - Turla: A Galaxy of Opportunity https://t.co/Alh37xmdmv This is Mandiant’s first observation of suspected Turla targeting Ukrainian entities since the onset of the invasion.

[Eduardo Mattos @eduardfir]

@mgreen27 Hey Matt, the description mentioned BruteRatel instead of SystemBC :)

[Eduardo Mattos @eduardfir]

@mgreen27 @velocidex noice!

[herrcore @herrcore]

📺 New Reverse Eng Tutorial…

Vulnerable Antivirus Driver Used by #Ransomware 😱

Join us and find out how?!
#OALABS

https://t.co/s4yJWpCIDd

[Eduardo Mattos @eduardfir]

@eric_capuano Where's the @velocidex artifact for it? :)

[Eduardo Mattos @eduardfir]

@mgreen27 @malmoeb @velocidex Yeah figuring out a way to keep the yara current would be awesome. The challenge is that the original ones I rely on (from @CapeSandbox ) usually have static detections logic (they check for MZ headers for ex.) So they need to be adapted for this in memory hunting scenario

[Eduardo Mattos @eduardfir]

@k3dg3

[Tyler McLellan @tylabs]

🔥 “It is plausible that the actors behind UNC2165 operations will continue to take additional steps to distance themselves from the Evil Corp name.” - Mandiant https://t.co/bbPy7rUAdH

[Eduardo Mattos @eduardfir]

@einarssonm @cyb3rops @velocidex I made one back in CVE-2021-40444 https://t.co/EMExhdv2mH

[Eduardo Mattos @eduardfir]

@campuscodi https://t.co/ZCxf3sqw79 :)

[Zach @svch0st]

Just added an artifact to find hidden scheduled tasks that are using the evasion technique found in the Tarrask malware to the #Velociraptor Artifact Exchange. @velocidex
Get it here: https://t.co/rGkHQyVINT

[Eduardo Mattos @eduardfir]

@executemalware Are these samples uploaded anywhere? :)

[Eduardo Mattos @eduardfir]

@ffb7d579 "It sheds light on the origins of bad guys – they are definitely Slavs"
😂 Lol
Awesome article, thank you!

[Eduardo Mattos @eduardfir]

@shortxstack The VR stats on the wall 😎👌

[Eduardo Mattos @eduardfir]

@velocidex How many times during an IR engagement (typically large scale #ransomware) we have found Windows Defender quarantined a bunch of malicious tools from the threat actors along their intrusion path? Too many! This will speed up investigation and analysis

[Eduardo Mattos @eduardfir]

I've just published a small @velocidex 🦖 artifact to find, decrypt and return the original binaries from Windows Defender Quarantine folders, along with supporting info (such as PE structures) and hashes, across an entire organization in just seconds!

https://t.co/VJwCTsFiBB