Gi7w0rm

Threat Intelligence Analyst |
Projects: & |
If I post false intel, contact me!
Support me:

[Gi7w0rm @Gi7w0rm]

New #OperationEndgame actions revealed.
This time targeting: #StealC

The blip video is hardcore.
1. #StealC Admin stole data from his affiliates/users
2. #StealC was so vulnerable, even Law Enforcement is laughing about them, directly mentioning the exploits being leveraged to steal their stuff.
3. Also a lot of affiliates seem to be named on the number plates of the vehicles, showing #OpEndgame knows exactly who they are up against.
4. Seems Law Enforcement themselves realized that they are only a "Bonus Stage" to ending an already completely broken product XD

I guess we can call this blip
#EndgameLevelTrolling ^^

More links on this in the first comment below.

[Mullvad.net @mullvadnet]

Chat Control 1 is back. Despite the European Parliament voting down the legislation twice this year, the Council of the European Union and parts of the Parliament today managed – through an urgent procedure – to extend it for another two years. The law was originally introduced as temporary legislation, so that its effectiveness could be evaluated. At the end of 2025, the European Commission itself concluded that it was not possible to determine whether the law had any measurable effect. Even so, it has now been pushed through.

Some of today's amendments could have stopped the law. And a majority of the voting MEPs wanted to do so. By a margin of 314-276, the Parliament voted to reject the proposal through these amendments. However, since it was an urgent procedure, 361 votes were required. As a result, the majority lost today and Chat Control 1 was passed. The urgent procedure was a dirty play by the Council and parts of the Parliament – it’s a procedure not meant to be used on legislation already rejected by the Parliament.

For now, Chat Control 1 will remain in effect. This means that tech companies may continue scanning communications without a warrant or suspicion.

However, the real battle is Chat Control 2. Unlike Chat Control 1, it would require all providers to scan communications, and to do so far more extensively than Chat Control 1 ever has.

[Gi7w0rm @Gi7w0rm]

@pancak3lullz Oh god, this is just what I thought when seeing the tweet. Thanks for speaking it out.

[Gi7w0rm @Gi7w0rm]

@UK_Daniel_Card As with a lot of things humans only find them concerning ones they see them in action and realize what it means in detail.

[Gi7w0rm @Gi7w0rm]

@vxunderground Dutch Gov - Microsoft Edge sends full browsing data via telemetry.
https://t.co/jQ2ugKQLek
German BSI:
https://t.co/2XaZ9E4v41
Windows 10 Telemetry is a Data Privacy Nightmare

[vx-underground @vxunderground]

> Peter Stokes
> Scattered Spider guy
> Arrested
> Microsoft helps FBI
> Read court documents
> Page 12
> Microsoft tracks Stokes from GDID
> Microsoft Global Device Identifier (GDID)
> Stokes used Windows
> Page 34
> GDID assigned to each OS install
> GDID unique to each device
> GDID only change if OS wiped
> Stokes GDID 6755467234350028
> GDID reported internet activity to Microsoft
> GDID showed Stokes using Ngrok
> GDID reported Stokes IP address
> GDID showed Stokes web activity
> GDID showed timestamps of web activity
> GDID mapped with video game activity
> GDID showed games played
> GDID undocumented
> GDID only mentioned in one MSDN document
> Azure UCDOStatus
> Azure Monitor Logging

[Gi7w0rm @Gi7w0rm]

@DailyDarkWeb Imagine German Government entities would move to .gov.de ...
It would be so much easier to know something is Gov owned...

[Gi7w0rm @Gi7w0rm]

@vxunderground @UK_Daniel_Card That's what I meant by my recent tweet, it is very likely someone is doing it on purpose to annoy cybersec researchers.

[Gi7w0rm @Gi7w0rm]

This happend to me in the last wave a month ago. Now a new wave is ongoing. I appealed and my account was unlocked after review. I have the feeling someone is intentionally targeting researchers here with automated botted reports to silence them.

[vx-underground @vxunderground]

Cybersecurity researchers keep getting flagged and/or suspended on X.

Chat, it's only a matter of time for me. If I die, please collect pictures of cats in my honor.

[Gi7w0rm @Gi7w0rm]

@banthisguy9349 @tayvano_ This is not what the author alludes to ;)

[Gi7w0rm @Gi7w0rm]

@500mk500 @UK_Daniel_Card @atomiczsec @NexusFuzzy @Cryptolaemus1 @aejleslie @jstrosch @ViriBack @Merlax_ @malwrhunterteam @James_inthe_box @vxremalware @dr4k0nia @crep1x @1ZRR4H @RussianPanda9xx @SOSIntel @tosscoinwitcher cc:
@vxunderground
@club31337

You might enjoy the peak trolling in here XD

[Gi7w0rm @Gi7w0rm]

New #OperationEndgame actions revealed.
This time targeting: #StealC

The blip video is hardcore.
1. #StealC Admin stole data from his affiliates/users
2. #StealC was so vulnerable, even Law Enforcement is laughing about them, directly mentioning the exploits being leveraged to steal their stuff.
3. Also a lot of affiliates seem to be named on the number plates of the vehicles, showing #OpEndgame knows exactly who they are up against.
4. Seems Law Enforcement themselves realized that they are only a "Bonus Stage" to ending an already completely broken product XD

I guess we can call this blip
#EndgameLevelTrolling ^^

More links on this in the first comment below.

[Gi7w0rm @Gi7w0rm]

Celebration for the Stealer hunters among you:
@500mk500
@UK_Daniel_Card
@atomiczsec
@NexusFuzzy
@Cryptolaemus1
@aejleslie
@jstrosch
@ViriBack
@0xToxin
@Merlax_
@malwrhunterteam
@James_inthe_box
@vxremalware
@dr4k0nia
@crep1x
@1ZRR4H
@RussianPanda9xx
@SOSIntel
@tosscoinwitcher
@0xperator
@Jane_0sint
@OxSaiyangod

[Gi7w0rm @Gi7w0rm]

I know such stories myself, but usually not in regards to simply reporting your own website as compromised. I assume that for simple website breaches you will end up in a database. And while you might not hear back or have imediate action followed, Law Enforcement can then use this data to show the scale of the issue and as investigative datapoints. Ultimately this might be beneficial to get more ressources for investigations, etc.

[Gi7w0rm @Gi7w0rm]

The @FBI @FBICyberDiv have released an advisory regarding #TDS website compromise.
This aims at threats like #SocGholish, #SmartApeSG , #TA2726 #HelpTDS , #ClearFake and others.
If your website get compromised, please report it via the linked sites so the largescale issue that these threats pose are getting increased visibility and more prosecution!
Link to advisory in first comment.

[Gi7w0rm @Gi7w0rm]

@UK_Daniel_Card @ufdsim Yep, I am checking it out right now :)

[Gi7w0rm @Gi7w0rm]

@UK_Daniel_Card @ufdsim I saw that some of the softwares allow you to use real gear. Honestly I am super intrigued by the first person view drones and might look for a simulator that supports glasses and control so I can train before spending 200$ on a real thing ^^

[Gi7w0rm @Gi7w0rm]

https://t.co/AVoNmLqeVK

[Gi7w0rm @Gi7w0rm]

@500mk500
@UK_Daniel_Card
@atomiczsec
@NexusFuzzy
@Cryptolaemus1
@aejleslie
@jstrosch
@ViriBack
@0xToxin
@Merlax_
@malwrhunterteam
@James_inthe_box
@vxremalware
@dr4k0nia
@crep1x
@1ZRR4H
@RussianPanda9xx
@SOSIntel
@tosscoinwitcher
@0xperator
@Jane_0sint
@OxSaiyangod
@vxunderground

[Gi7w0rm @Gi7w0rm]

New season of #OperationEndgame just dropped.
This time, they targeted #SocGholish.
106 servers and domains taken down, 14.971 websites remediated.
Of course, they released a movie like video for it again.
Link to press release in the comments :)
#OpEndgame #SocGholish

[Gi7w0rm @Gi7w0rm]

https://t.co/gwvij6d27D