Security Operations Center

A SOC protecting the grid. Bot maintained by @Alt_DataStreams. Made with love by @whlemlk

[Security Operations Center @fe_tsoc]

This account will no longer retweet any posts due to the rate limitation of the API. Thank you for your understanding.

[kubotaa @kubotaa3]

横浜銀行のフィッシングサイト情報です⚠
hxxps://nanjiezhiyao.com/
hxxps://login.hdtcdsk.buzz/

ip: 45.143.234.92 (AS23959 - Owl Limited)

#Phishing #横浜銀行

[cobaltstrikebot 🌻 @cobaltstrikebot]

144 Cobalt Strike stage 2 IP's, with 145 unique configurations, identified today. Find them here: https://t.co/4Vvbtzfels

Warning: These IP's have not been vetted, block at your own risk.

[MalwareHunterTeam @malwrhunterteam]

"Motherless banned video collection - rare stuff\.zip": fc1b3f1ac2da5b0d50fab94a0a4fcb85dbb6a6342f48faf28b5d8f7ddd373774
"ImagePreview.png": 0443be4f5ad38710f330455757ce2f633720b750d77ad0efb188d343461d2f74
🤔

[cobaltstrikebot 🌻 @cobaltstrikebot]

142 Cobalt Strike C2's identified today. Find them here: https://t.co/QG70HDJvf5

Warning: These IP's have not been vetted, block at your own risk.

[Who said what? @g0njxa]

mesoftwares[.]vip

Distribution of

C2⚙️ #Redline
94.142.138.4 🇷🇺

Download from opendir mesoftwares[]vip/data/

👇👇
https://t.co/Njm8oOIycf

[Miyuki Chikara @harugasumi]

【重要】２段階認証設定のお願い
等の件名の不審メール。
この誘導先
hxxp://rxk4li.uxuuzlejffmywdt.net/im/login.php?id=<ID>&pass=<Password>
→…→hxxp://vqvztozvfofios.jp/pc/top/?mode=1
は画面真っ白でしたが、類似フィッシング詐欺にお気を付け下さい。
#Phishing #フィッシング詐欺

[Who said what? @g0njxa]

This is from a compromised Youtube account sharing videos to distribute #Redline Stealer

Here's the analysis https://t.co/dmKGWd4HaS

Threat actors started asking for @PayPal donations, to
paypal[.]me/RuskeyMusic

Are logs business that bad u need to beg money?? 😂

[Miyuki Chikara @harugasumi]

【大和ネクスト銀行】お客様の直近の取引における重要な確認について
等の件名で、大和ネクスト銀行を騙る #フィッシングメール。
hxxps://jsdushid.com
(→…)
等 #フィッシングサイト に騙されないよう、お気を付け下さい。
本日午後投入URLs
https://t.co/cFfk7tZrnm
#Phishing #フィッシング詐欺

[Yogesh Londhe @suyog41]

Spark RAT
ITW :
https://cdn.discordapp[.]com/attachments/1094077300041068585/1094087837592334458/servicesGerencia.exe
41fa51816abea20a91900edaf46d8512
Signed with "NUTRI GENETICA RESEARCH BRASIL LTDA"
C2 : 130.185.238[.]251:7777
#SparkRAT #GoRAT #RAT #IOC

[Dominic Alvieri @AlvieriD]

Arkansas State University has been claimed by LockBit.

/astate.edu @ArkansasState

[Dominic Alvieri @AlvieriD]

Three bad posts to start the week.

St. Mary’s Catholic School, Lutheran Social Services of New York and Unity College have been posted by LockBit.

/stmarys.net

/unity.edu

/lssny.org

[Threat Intelligence @threatintel]

Ransomware watchers are finding creative ways to track attacks https://t.co/1ha3ue4Pqe

[ThreatMon Ransomware Monitoring @TMRansomMon]

Actor : LockBit
Victim : https://t.co/SUF8VN9jlC
Date : 2023-05-08 10:29 UTC +3

According to the #DarkWeb #Ransomware activity by the ThreatMon Threat Intelligence Team, the “#LockBit” Ransomware group has added https://t.co/SUF8VN9jlC to its victims.

[ThreatMon Ransomware Monitoring @TMRansomMon]

Actor : LockBit
Victim : https://t.co/WfCQ5UUmdE
Date : 2023-05-08 10:29 UTC +3

According to the #DarkWeb #Ransomware activity by the ThreatMon Threat Intelligence Team, the “#LockBit” Ransomware group has added https://t.co/WfCQ5UUmdE to its victims.

[ThreatMon Ransomware Monitoring @TMRansomMon]

Actor : LockBit
Victim : https://t.co/0HrvGspbWX
Date : 2023-05-08 10:29 UTC +3

According to the #DarkWeb #Ransomware activity by the ThreatMon Threat Intelligence Team, the “#LockBit” Ransomware group has added https://t.co/0HrvGspbWX to its victims.

[Ransomware News @RansomwareNews]

Group: lockbit3
Approx. Time: 2023-05-08 10:29:33.381050
Title: https://t.co/J83tYLng2z

[Ransomware News @RansomwareNews]

Group: lockbit3
Approx. Time: 2023-05-08 10:29:28.655484
Title: https://t.co/kiTIJqUVoN

[Ransomware News @RansomwareNews]

Group: lockbit3
Approx. Time: 2023-05-08 10:29:34.535556
Title: https://t.co/oSi2CxKAhE

[Threat Intelligence @threatintel]

#ThreatProtection #FluHorse #Android #malware, read more about Symantec's protection: https://t.co/4rkM7yc0Bx