Ghazi Alkofahi

#Cybersecurity #Analyst | #DFIR & #ThreatIntel

[Clandestine @akaclandestine]

GitHub - securityjoes/MasterParser: MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs https://t.co/2ln7QLdamy

[The Hacker News @TheHackersNews]

🚨 WARNING: Over 80,000 files with passwords and keys from governments, banks, and tech firms were found online — all pasted into public code tools like JSONFormatter and CodeBeautify.

Hackers are already scraping and using the data.
And yes — it’s still live.

Details here → https://t.co/TyrWneqt3G

[FalconFeeds.io @FalconFeedsio]

🚨 Latest Scattered Spider update:
The actor is now claiming “the US government paid a ransom” a classic scare-tactic with zero evidence, in line with their long-running disinformation playbook.
They also warn IR teams about more potential attack.

This isn’t credible intel it’s threat theater designed to trigger panic, shape narratives, and keep attention on their Salesforce/Salesloft campaign.

High noise. Low signal. Same psychological ops.

[FAMASoon @FAMASoon]

EvilBytecode/GoDefender: Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY. - https://t.co/ZkgTVh3dXO

[Panos Gkatziroulis 🦄 @ipurple]

SilentButDeadly - a network communication blocker specifically designed to neutralize EDR/AV software by preventing their cloud connectivity using Windows Filtering Platform (WFP).
https://t.co/AASfirUTEi

[Bert-Jan 🛡️ @BertJanCyber]

Some good technical content around the WSUS vulnerability (CVE‑2025‑59287) has been published by @eyesecurity.

https://t.co/9u7bSHniPo

[BleepingComputer @BleepinComputer]

A new phishing technique dubbed 'CoPhish' weaponizes Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests via legitimate and trusted Microsoft domains.

Microsoft told BleepingComputer they plan on fixing it in a future update.
https://t.co/BeJY6YazJy

[Ghazi Alkofahi @galkofahi]

@500mk500

[Ghazi Alkofahi @galkofahi]

New detection cyberstealer #malicious

arbitrationengine[.]com
195.177.94[.]232

[Nicolas Krassas @Dinosn]

Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.
https://t.co/zbsu4clG8B

[Two Seven One Three @TwoSevenOneT]

#malware
"clipup.exe" in System32 is very powerful. It can destroy the executable file of the EDR service 😉. Experimenting with overwriting the MsMpEng.exe file
github: /2x7EQ13/CreateProcessAsPPL
#redteam #BlueTeam

[Steven Lim @0x534c]

𝗭𝗲𝗿𝗼 𝗖𝗹𝗶𝗰𝗸, 𝗢𝗻𝗲 𝗡𝗧𝗟𝗠: 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗣𝗮𝘁𝗰𝗵 𝗕𝘆𝗽𝗮𝘀𝘀

A newly discovered zero-click vulnerability, CVE-2025-50154, bypasses a Microsoft patch, allowing attackers to steal NTLM hashes without user interaction. Microsoft has issued patch in August Patch Tuesday and here's a KQL to detect this bypass. .🫡

https://t.co/DBrJZyRceQ

https://t.co/try0CTqdeN

Detection: https://t.co/6uPWdVCxKU

#cybersecurity #vulnerability #NTLMLeak

[Dark Web Informer @DarkWebInformer]

🚨Alleged Sale of Fortinet 0-Day RCE Exploit

• Industry: N/A
• Threat Actor: WISDOM
• Network: Clearnet, Dark Web
• Price: 0.5 BTC

• Details: A threat actor claims to be selling a 0-day remote code execution (RCE) exploit affecting FortiOS VPN versions 7.4 to 7.6. The listing includes a proof of concept (PoC) available to serious buyers with deposit or established reputation.

[Minoru Kobayashi @unkn0wnbit]

Unix-like Artifacts Collector (UAC) v3.2.0 has been released #DFIR

https://t.co/wZ4kvw9wf4

[Ali Alwashali @ali_alwashali]

Living Off the Pipeline
This project document all the tools that commonly used in CI/CD and can lead to code execution
https://t.co/ZnU1R94BRn

[Ghazi Alkofahi @galkofahi]

@500mk500 @JAMESWT_WT

[Ghazi Alkofahi @galkofahi]

New detection #rat #valsrat

*Possibly Rat Panel

176.123.168[.]175
Valsrat[.]online

[Ghazi Alkofahi @galkofahi]

@500mk500 @JAMESWT_WT

[Ghazi Alkofahi @galkofahi]

#opendir #malware #trojan

92.118.112[.]17[:]8080

db09f8ba6b1ec60f3e02eb61451690beedecb2ff2cf8ef9731736c22f17b32d2

https://t.co/txink4fmVC

[Ghazi Alkofahi @galkofahi]

@JAMESWT_WT Awesome

[Ghazi Alkofahi @galkofahi]

#OpenDir #malware #metastealer

23.177.184[.]243[:]8080