Eric Gonzalez

Incident Response, Digital Forensics, and Security Analysis. Tweets are my own.

[Eric Gonzalez @EricBori]

@brettshavers I'd love to hear about it.

[Eric Gonzalez @EricBori]

@HackingDave I was going to buy that new Ninja one. I'll take a look at this one too.

[BlackRoomSec @blackroomsec]

IT IS HERE! The 666 pg Dynamic Incident Response book from SANS/Joshua Wright @joswr1ght which was announced earlier this year!

https://t.co/ezzjAWKqMd

Thank you SO MUCH, Joshua!

[Unit 42 @Unit42_Intel]

Our investigation into the compromise of Notepad++ reveals new C2 infrastructure. Unit 42 also witnessed two chains of infection: a Chrysalis backdoor and through a Cobalt Strike beacon. These discoveries are vital for defense. Read our detailed analysis. https://t.co/UsXN8wF7ZY

[Binary Defense @Binary_Defense]

Attackers rely on encryption, anonymity, and crypto to hide.
Defenders rely on expertise, patience, and pressure.
Our Co-Founder and Chief Hacking Officer @HackingDave joined CNN to explain how modern cyber operations work, and why even well planned attacks leave cracks.

[Binary Defense @Binary_Defense]

Some attacker behavior is noise.
Some changes everything.

In this TIDE clip, @_Dwyer_ explains Threat-Informed Detection Engineering and why it centers on identifying the point where an attack turns into real damage.

That distinction matters.

Learn more about TIDE here: https://t.co/8sQ2aOy617

[Mehmet Ergene @Cyb3rMonk]

Awesome tool for #DFIR folks working with MDE.

https://t.co/RyNPdWGSp6

[Eric Gonzalez @EricBori]

@Mohsin_o2 Honest question, is that helicopter wrapped in phantom black paint?

[Eric Gonzalez @EricBori]

@HustleBitch_ Cashing in on overtime prior to the holidays

[International Cyber Digest @IntCyberDigest]

‼️🇮🇱 Smartphones worldwide were silently infected with Israeli malware via malicious ads

Simply viewing their ads was enough to get infected.

Surveillance company Intellexa gained full access to cameras, microphones, chat apps, emails, GPS locations, photos, files, and browsing activity.

[Eric Gonzalez @EricBori]

@akafaceUS Pokemon cards lol

[Florian Roth ⚡️ @cyb3rops]

One compromised Microsoft Entra account - full tenant takeover.
And you’re left with what Microsoft gives you as logs. That’s your entire investigation surface.

It used to be different.
Attackers had to break into a DMZ service, move laterally into the internal network, or pull off a rare browser exploit. Domain admins often didn’t have internet access, and even if they did, they didn’t use their admin accounts for browsing. You had to escalate privileges.

Now all they need is an access token.

When a compromise happened, you had everything: files, logs, memory, disks, network captures - the full picture.
Now it’s just cloud logs.

Things have changed, but not for the better.

That said, the article shared by Mandiant here is excellent. It gives practical guidance on how to secure high-privilege accounts in Entra envs.

[blackorbird @blackorbird]

Malware spreading via WhatsApp with multi-vector persistence & sophisticated C&C.

Investigation shows the consistent use of Portuguese, which suggest the threat actor’s focus on Brazil.

The most sophisticated aspect of the backdoor is its email-based C&C infrastructure. Rather than relying on traditional HTTP-based communication, the malware leverages IMAP connections to terra.]com[.br email accounts using hardcoded email credentials to connect to the email account and retrieve commands. 

https://t.co/KOZrPvNrvT

[DFIR Training @DFIRTraining]

TERABYTES OF FORENSIC TEST IMAGES
HUNDREDS OF CTFs
https://t.co/dsUPfRNMxH #DFIR #CTF

[LETHAL FORENSICS @LETHAL_DFIR]

Microsoft-Analyzer-Suite v1.7.0 released today! This update includes a new PowerShell script for analyzing Microsoft Service Principal Sign-In Logs.🚀

Check out the changelog for more information. Happy M365/Azure Threat Hunting!

#M365 #Azure #EntraID #BEC #DFIR #Microsoft #Security #CloudIncidentResponse

https://t.co/YirJjxJhhP

[Mandiant (part of Google Cloud) @Mandiant]

North Korea threat actor UNC5342 is using EtherHiding, the first time we have observed a nation-state use this technique. 🚨

The TTP is being used in a social engineering campaign that leads to cryptocurrency heists and espionage.

Read the blog post: https://t.co/JGnXcAQfoQ

[BleepingComputer @BleepinComputer]

🚨Researchers map a campaign that escalated from a Python infostealer to full PureRAT backdoor.

Join @HuntressLabs’ Tradecraft Tuesday for technical walkthroughs, malware trends, and live IOC guidance on the latest campaigns.

➡️ https://t.co/ldOW3hpEzH
#cybersecurity #sponsored

[Blue Team News @blueteamsec1]

SonicWall: Firewall configs stolen for all cloud backup customers https://t.co/Zr5cZ3lxpG #Security #Cloud

[BleepingComputer @BleepinComputer]

Train for Azure certifications with this 9-course bundle for $30
https://t.co/QOPHcjtzoP

https://t.co/QOPHcjtzoP

[John Hammond @_JohnHammond]

oH DEAR GOD THAT IS TOMORROW

HUNTRESS CTF STARTS TOMORROW

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
https://t.co/dmC5VFf5W5