Tommy M (TheAnalyst)

Threat Researcher @proofpoint | @Cryptolaemus1

[Tommy M (TheAnalyst) @ffforward]

So I have started a new job this week, as a Threat Researcher for @proofpoint. Can you imagine working with such an awesome team that finds and shares stuff like this? 🙌👏🥳

[Threat Insight @threatinsight]

Proofpoint has identified a compromised private military email account delivering #SunSeed Lua malware. Threat research related to this activity is detailed in this blog. https://t.co/qYqj8PLGC2

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam Looked at this one a bit last week

[Tommy M (TheAnalyst) @ffforward]

Found some IOCs here too: https://t.co/Yv3S62HXpe
Something's off, second set of domains (but same actor) is used against RU and BY. Also odd w. english panel imo. (won't link, unprotected and has live IP but easy to figure out). Moving to EtherHiding for the injects too.

[Simon Kenin @k3yp0d]

1/4 🇺🇦

@500mk500 @_CERT_UA
An ongoing campaign compromised multiple Ukrainian websites to display a fake Cloudflare verification ClickFix lure:

[Tommy M (TheAnalyst) @ffforward]

@UK_Daniel_Card DS them self are soft-routing to 4.1-Flash even if you select Pro because they think it's superior. But I wonder if it isn't better to have both Qwen3.8-Flash-Next and GLM-5.3-Flash working together if you have access to run models of that size?

[Tommy M (TheAnalyst) @ffforward]

@cyb3rops Getting these kind of refusals from 3.7, worked when stepping back to 3.6

[Tommy M (TheAnalyst) @ffforward]

No, #Trickbot is NOT back. What Fortinet forgot to mention is that the samples they analyzed are known Anchor DNS from 2020. I'm not even kidding.

Better read from back then: https://t.co/3ph1X7rfdH

[Hackread.com @HackRead]

🚨 TrickBot is back with a stealthier command and control method.

The new variant replaces traditional HTTP communications with DNS tunneling, making malicious traffic harder to detect on Windows.

Listen/Read: https://t.co/quziPWQcE3

#CyberSecurity #Malware #TrickBot #Windows

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam Always fun to ask Gemini about the SPA JS on these 😅

[Tommy M (TheAnalyst) @ffforward]

ErrTraffic C2 cdnpro-987[.]xyz
PS Payload domain cdnportal-us[.]xyz (dynamic PowerShell command and URI path)
PowerShell downloads a 16MB encrypted 7z file, > EXE. The EXE will do profiling (including refresh rate) > #NetSupportRAT and run it.
NetSupport C2 178[.]16[.]55[.]191.

[Tommy M (TheAnalyst) @ffforward]

So for those interested, the "scam" was an #ErrTraffic affil that got their inject on the site. It served NetSupport RAT to Win users and another (possibly broken) payload to mac users. If you did follow any of the fake #ClickFix captcha your computer might be infected. >

[Gizmodo @Gizmodo]

We identified and resolved a security incident on our site earlier today. A compromised account was exploited to inject a malicious script, briefly exposing users to scam content. The site was taken offline immediately, the script removed, and the account secured.

We're back up. If you notice anything unusual, reach out.

[Tommy M (TheAnalyst) @ffforward]

@DarkandDarkerWA @vxunderground Yeah, the command you get is dynamically built so the full URI and filename it will be saved as will differ over time. The zip is encrypted and contains an exe in this case. That EXE will profile the machine and if passed, it will drop and run NetSupprt.

[Tommy M (TheAnalyst) @ffforward]

@eastsidemccarty @Gizmodo It's not from ads, some #ErrTraffic affiliate has compromised them. Inject is in main response.

[Tommy M (TheAnalyst) @ffforward]

@DanielStitzel @Gizmodo Yes, compromised by some #ErrTraffic #ClickFix affiliate. Inject is in main response

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam Likely who we call TA4922, some details in https://t.co/Gi3kCf3Py2
Some outlets calls them "Silver Fox APT" based on... that they, like every small-time Chinese threat actors, use WinOS 4.0/ValleyRAT where the source code was leaked... in 2022... 🤷‍♂️

[Threat Insight @threatinsight]

Proofpoint threat researchers identified a new malware-as-a-service named #TrustConnect.

Notably, it masquerades as a legitimate remote monitoring and management tool, marking an evolution in how attackers weaponize trust around enterprise tooling. https://t.co/jRtLARQ3sN

[Squiblydoo @SquiblydooBlog]

Thanks to the proofpoint team for highlighting "TrustConnect Software PTY LTD".

The actor got the cert hoping to look like a legitimate RMM—but in collaboration with Proofpoint—we didn't let them maintain the illusion.

See Proofpoint's blog for all the details.

[Tommy M (TheAnalyst) @ffforward]

Would you run AdobeReader.exe from a days-old company called "TrustConnect Software PTY LTD" just because they managed to purchase an Extended Validation certificate?
New blog out together with @proofpoint @threatinsight
https://t.co/O6ciTfSP8g

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam Bot that is installed after the stealer in this campaign for example:
https://t.co/BtEwiLazM1
Exfils data > 38.244.158[.]56/contact > Trojanize Ledger (sassonco[.]com/zxc/app.zip and Trezor sassonco[.]com/zxc/apptwo.zip> above URL via installBot(homeDir, cachedPassword, botUrl)

[Threat Insight @threatinsight]

As the security landscape evolves and expands, Proofpoint observed many threat actors disappear from email threat data in 2025.

But TA584 maintained operational consistency, w/ recent shifts demonstrating its attempt to infect a broader range of targets. https://t.co/GbpBLVugOZ

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam @LogMeIn Resolve, a lot of abuse of it right now. companyid=621183840131085098

[Tommy M (TheAnalyst) @ffforward]

@malwrhunterteam Some similarities how the PowerShell loader works. But if I recall correctly this older thing instead used Deno to to download and run Python+script, not sure I looked much deeper than that