Fray Glow

Director of Threat Research @ Binary Division, Inc.

[Fray Glow @fray_glow]

@mustarbn @srslypascal @pancak3lullz Something like this one: https://t.co/9OZi4ImyWF

[Fray Glow @fray_glow]

@mustarbn @srslypascal @pancak3lullz Ah, you must be right, sorry.

His insignia only has one red stripe in the middle, compared to the one on the Wikipedia image, which has two red stripes.

[Fray Glow @fray_glow]

@srslypascal @pancak3lullz this is a Russian police uniform, with a polkovnik (colonel) rank insignia

[Fray Glow @fray_glow]

@techwithtaz https://t.co/Le4dVVAiaf

[Fray Glow @fray_glow]

@dor0n1 @S0ufi4n3 @ValeryMarchive @ransomwaremap @uuallan @GossiTheDog that's definitely not a trickbot panel, the trickbot panels look something like this

[Fray Glow @fray_glow]

@VK_Intel @VessOnSecurity @BleepinComputer You don't understand this @VessOnSecurity. It's easier to collect potential customers for your boutique consulting firm if you have their email addresses, right? 😉

[Fray Glow @fray_glow]

@VK_Intel Oh noes, the deadly planeswalker is back again? 🤣

[Fray Glow @fray_glow]

@peterkruse Så det var jo ikke Trickbot?

[Fray Glow @fray_glow]

@Horgh_rce @peterkruse 🤣

[Fray Glow @fray_glow]

@peterkruse @chrisdoman @csis_cyber @FireEye Having a rough day again, Mr. Kruse?

[Fray Glow @fray_glow]

@VK_Intel 🤮

[Fray Glow @fray_glow]

@K1ng__J0hn @anthomsec I don't think it is fair to compare it with a flu shot, which is available since the 1940s and had plenty of time to be tried and tested. Does that also mean that you fully trust companies to have tested for potential side effects, regardless of the country of origin? 🙂

[Fray Glow @fray_glow]

@lazyactivist192 @D00RT_RM @MalwareTechBlog You released a blog post including some Yara rules too (I know, that is not even close to publishing a full emulator). But you can be 100% sure that they are going to use it to try to tweak their malware for evasion, so would it be fair if someone called you out for that? No.

[Fray Glow @fray_glow]

@lazyactivist192 @D00RT_RM @MalwareTechBlog Ok, just to make sure we are on the same page: I do NOT consider uncontrolled and senseless release of tools a good idea either (same goes for OST). I'm just saying if someone does it anyway for whatever reasons (there can be many), he should not get flogged publicly for it.

[Fray Glow @fray_glow]

@lazyactivist192 @D00RT_RM @MalwareTechBlog ... has the chance that they will change something, if this concerns you, then don't release stuff publicly. Otherwise stop whining, fix your scripts and move on. There is nothing to see here, really. /2

[Fray Glow @fray_glow]

@lazyactivist192 @D00RT_RM @MalwareTechBlog Malware authors/operators change things all the time. They happen to break detection or scripts every now and then, so when this happens and it makes you angry, that means you are probably not in this industry long enough. Every blog post about malware, every released tool... /1

[Fray Glow @fray_glow]

@MalwareTechBlog "Because a thing seems difficult for you, do not think it impossible for anyone to accomplish." -- Marcus Aurelius