Tommy M (TheAnalyst)

Threat Researcher @proofpoint | @Cryptolaemus1

[Tommy M (TheAnalyst) @ffforward]

So I have started a new job this week, as a Threat Researcher for @proofpoint. Can you imagine working with such an awesome team that finds and shares stuff like this? 🙌👏🥳

[Threat Insight @threatinsight]

Proofpoint has identified a compromised private military email account delivering #SunSeed Lua malware. Threat research related to this activity is detailed in this blog. https://t.co/qYqj8PLGC2

[Tommy M (TheAnalyst) @ffforward]

@HuntressLabs Before this causes too much confusion it's "CastleLoader", and final payload doesn't have anything to do with Lumma. @LawrenceAbrams @BleepinComputer wrote about the campaign a year ago https://t.co/Woe3UFP2hy and it hasn't changed much since then.

[Tommy M (TheAnalyst) @ffforward]

@vxunderground @malwrhunterteam Best part is that it has been around on the compromised sites since July 🤷
https://t.co/Bk7xotbNvB

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam 3196034ef1196c9151395859019674e14e3c06e3fdbf230c7e0d0c5f6211824a seen on various websites since end of July:
https://t.co/mYHaFMSNBV

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam 3196034ef1196c9151395859019674e14e3c06e3fdbf230c7e0d0c5f6211824a seen on various websites since end of July:
https://t.co/mYHaFMSNBV

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam You guys have done a lot already and IDed it, but for completeness:

[Tommy M (TheAnalyst) @ffforward]

@smica83 @abuse_ch @k3yp0d This is a variant of "Device Manager Agent" (which in it's turn is just a throwaway name). C2 over DNS tunneling on 158[.]94[.211[.]185. Likely ClickFix affil and used for automated task deployment. Belongs to a cluster where both me and @k3yp0d takes issues with attribution 😅

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam Looked at this one a bit last week

[Tommy M (TheAnalyst) @ffforward]

Found some IOCs here too: https://t.co/Yv3S62HXpe
Something's off, second set of domains (but same actor) is used against RU and BY. Also odd w. english panel imo. (won't link, unprotected and has live IP but easy to figure out). Moving to EtherHiding for the injects too.

[Simon Kenin @k3yp0d]

1/4 🇺🇦

@500mk500 @_CERT_UA
An ongoing campaign compromised multiple Ukrainian websites to display a fake Cloudflare verification ClickFix lure:

[Tommy M (TheAnalyst) @ffforward]

@UK_Daniel_Card DS them self are soft-routing to 4.1-Flash even if you select Pro because they think it's superior. But I wonder if it isn't better to have both Qwen3.8-Flash-Next and GLM-5.3-Flash working together if you have access to run models of that size?

[Tommy M (TheAnalyst) @ffforward]

@cyb3rops Getting these kind of refusals from 3.7, worked when stepping back to 3.6

[Tommy M (TheAnalyst) @ffforward]

No, #Trickbot is NOT back. What Fortinet forgot to mention is that the samples they analyzed are known Anchor DNS from 2020. I'm not even kidding.

Better read from back then: https://t.co/3ph1X7rfdH

[Hackread.com @HackRead]

🚨 TrickBot is back with a stealthier command and control method.

The new variant replaces traditional HTTP communications with DNS tunneling, making malicious traffic harder to detect on Windows.

Listen/Read: https://t.co/quziPWQcE3

#CyberSecurity #Malware #TrickBot #Windows

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam Always fun to ask Gemini about the SPA JS on these 😅

[Tommy M (TheAnalyst) @ffforward]

ErrTraffic C2 cdnpro-987[.]xyz
PS Payload domain cdnportal-us[.]xyz (dynamic PowerShell command and URI path)
PowerShell downloads a 16MB encrypted 7z file, > EXE. The EXE will do profiling (including refresh rate) > #NetSupportRAT and run it.
NetSupport C2 178[.]16[.]55[.]191.

[Tommy M (TheAnalyst) @ffforward]

So for those interested, the "scam" was an #ErrTraffic affil that got their inject on the site. It served NetSupport RAT to Win users and another (possibly broken) payload to mac users. If you did follow any of the fake #ClickFix captcha your computer might be infected. >

[Gizmodo @Gizmodo]

We identified and resolved a security incident on our site earlier today. A compromised account was exploited to inject a malicious script, briefly exposing users to scam content. The site was taken offline immediately, the script removed, and the account secured.

We're back up. If you notice anything unusual, reach out.

[Tommy M (TheAnalyst) @ffforward]

@DarkandDarkerWA @vxunderground Yeah, the command you get is dynamically built so the full URI and filename it will be saved as will differ over time. The zip is encrypted and contains an exe in this case. That EXE will profile the machine and if passed, it will drop and run NetSupprt.

[Tommy M (TheAnalyst) @ffforward]

@eastsidemccarty @Gizmodo It's not from ads, some #ErrTraffic affiliate has compromised them. Inject is in main response.

[Tommy M (TheAnalyst) @ffforward]

@DanielStitzel @Gizmodo Yes, compromised by some #ErrTraffic #ClickFix affiliate. Inject is in main response

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam Likely who we call TA4922, some details in https://t.co/Gi3kCf3Py2
Some outlets calls them "Silver Fox APT" based on... that they, like every small-time Chinese threat actors, use WinOS 4.0/ValleyRAT where the source code was leaked... in 2022... 🤷‍♂️

[Threat Insight @threatinsight]

Proofpoint threat researchers identified a new malware-as-a-service named #TrustConnect.

Notably, it masquerades as a legitimate remote monitoring and management tool, marking an evolution in how attackers weaponize trust around enterprise tooling. https://t.co/jRtLARQ3sN

[Squiblydoo @SquiblydooBlog]

Thanks to the proofpoint team for highlighting "TrustConnect Software PTY LTD".

The actor got the cert hoping to look like a legitimate RMM—but in collaboration with Proofpoint—we didn't let them maintain the illusion.

See Proofpoint's blog for all the details.