hashp4

🇫🇷 - Threat Research @Sekoia_io • Previously Threat Hunting @WithSecure • I like malwares, forensics and CTI :)

[hashp4 @hashp4_]

Over the last week, I managed to complete the Waifu University APT emulation lab (IR on AlphV/Blackcat ransomware breach)

Thanks to @XintraOrg, @inversecos & the lab contributors for this great experience ❤️

You can find the investigation on my blog 👇

https://t.co/aDflFApMGd

[Renwa @RenwaX23]

"Dad, what was it like playing CTFs before AI?"

[Malcat dev @malcat4ever]

We tested 9 LLMs on real-world #malware triage and static unpacking tasks, using only #Malcat’s MCP server.
We compared not only their results, but also their speed and cost.
Full write-up:
https://t.co/z9KN3SR4P4

[R136a1 @TheEnergyStory]

Have you noticed that those deep-dive stories about complex Windows malware have pretty much vanished, especially in recent years? It feels like the era of "blockbuster" Windows malware has just gone silent, and this blog post tries to give some answers why.

https://t.co/sFsf3uPm5o

[Vitaly Kamluk @vkamluk]

After 11 years of silence at Black Hat, I am delivering a speech today.
In memory of a legendary APT Hunter, Mr Sergey Mineev, who passed away 40 days ago.
If you cannot attend, here is the write-up: https://t.co/JUO4VBtnSZ

[Graham Helton (too much for zblock) @GrahamHelton3]

This is a wild read. Someone spent a lot of time thinking through this implant...

https://t.co/OP87kzbHKA

[GrapheneOS @GrapheneOS]

We were contacted by a journalist at Le Parisien newspaper with this prompt:

> I am preparing an article on the use of your secure personal data phone solution by drug traffickers and other criminals. Have you ever been contacted by the police? Are you aware that some of your clients might be criminals? And how does the company manage this issue?

Absolutely no further details were provided about what was being claimed, who was making it or the basis for those being made about it. We could only provide a very generic response to this.

Our response was heavily cut down and the references to human rights organizations, large tech companies and others using GrapheneOS weren't included. Our response was in English was translated by them: "we have no clients or customers" was turned into "nous n’avons ni clients ni usagers", etc...

GrapheneOS is a freely available open source privacy project. It's obtained from our website, not shady dealers in dark alleys and the "dark web". It doesn't have a marketing budget and we certainly aren't promoting it through unlisted YouTube channels and the other nonsense that's being claimed.

GrapheneOS has no such thing as the fake Snapchat feature that's described. What they're describing appears to be forks of GrapheneOS by shady companies infringing on our trademark. Those products may not even be truly based on GrapheneOS, similar to how ANOM used parts of it to pass it off as such.

France is an increasingly authoritarian country on the brink of it getting far worse. They're already very strong supporters of EU Chat Control. Their fascist law enforcement is clearly ahead of the game pushing outrageous false claims about open source privacy projects. None of it is substantiated.

iodéOS and /e/OS are based in France. iodéOS and /e/OS make devices dramatically more vulnerable while misleading users about privacy and security. These fake privacy products serve the interest of authoritarians rather than protecting people. /e/OS receives millions of euros in government funding.

Those lag many months to years behind on providing standard Android privacy and security patches. They heavily encourage users to use devices without working disk encryption and important security protections. Their users have their data up for grabs by apps, services and governments who want it.

There's a reason they're going after a legitimate privacy and security project developed outside of their jurisdiction rather than 2 companies based in France within their reach profiting from selling 'privacy' products.

https://t.co/uWVPGoiEUs

Here's that article:

https://t.co/5TvYFemejg

[deceptiq @deceptiq_]

Once in a blue moon as a red teamer, we encountered environments with canary technology deployed across their infrastructure. The tables flipped. Blue teams caught us immediately.

Canary technology uniquely detects adversaries by exploiting their behavior - digital assets with no legitimate use that trigger immediate, high-fidelity alerts when interacted with.

However, most organizations struggle to extract these benefits. Existing canary solutions don't provide the primitives, token catalog, automation, and tooling needed for deployment and management at scale. They require dedicated security engineers to own and maintain.

As a result, high-fidelity detection has remained reserved for the most mature security teams.

For organizations already utilizing canary technology - did it catch your last red team engagement?

Today we're launching DeceptIQ - the cloud-native canary technology platform built from first principles.

We looked at enterprises who successfully deployed canary technology - what they did, what worked, what they wanted. Coupled with our experience as adversaries, we rebuilt the tried and tested concept from first principles. We spent eight months researching how to fingerprint our own tokens, then doing it again and again.

The result: the most comprehensive, configurable, scalable canary token platform available. over 15 new canary token providers designed to exploit adversary behavior - including 5 ephemeral that each scale to over a million an hour, and 10 new persistent canary tokens.

API-first deployment integrates with custom canary channels to enable visibility and deployment of canary tokens across Kubernetes, CI/CD pipelines, MDM platforms, and many more - at scale!

Our success metric: would we catch ourselves on a red team engagement? With today's launch, we believe we can.

We built DeceptIQ to be what we wish every organization we compromised had in place.

[Pavel Durov @durov]

I’m turning 41, but I don’t feel like celebrating.

Our generation is running out of time to save the free Internet built for us by our fathers.

What was once the promise of the free exchange of information is being turned into the ultimate tool of control.

Once-free countries are introducing dystopian measures such as digital IDs (UK), online age checks (Australia), and mass scanning of private messages (EU).

Germany is persecuting anyone who dares to criticize officials on the Internet. The UK is imprisoning thousands for their tweets. France is criminally investigating tech leaders who defend freedom and privacy.

A dark, dystopian world is approaching fast — while we’re asleep. Our generation risks going down in history as the last one that had freedoms — and allowed them to be taken away.

We’ve been fed a lie.

We’ve been made to believe that the greatest fight of our generation is to destroy everything our forefathers left us: tradition, privacy, sovereignty, the free market, and free speech.

By betraying the legacy of our ancestors, we’ve set ourselves on a path toward self-destruction — moral, intellectual, economic, and ultimately biological.

So no, I’m not going to celebrate today. I’m running out of time. WE are running out of time.

[Dan Black @DanWBlack]

Nothing but love for a blog post with summary conclusions of competing hypotheses.

Transparency around how we weigh the diagnostic value of specific evidence lays the foundation for better collective understanding in the long-term.

[1989 @1989x__]

The full technical report details how we took down the C2 infrastructure of Block Blasters drainer malware that @valvesoftware allowed on their platform. We spoke to the threat actors who had no remorse for stealing from a terminally ill cancer patient
https://t.co/9tCnSGN1sx

[Seongsu Park @unpacker]

Excited to share our latest research on APT37(a.k.a ScarCruft, Ruby Sleet, and Velvet Chollima)’s new infection chain and C2 operation:

1⃣ Initial Access: Leveraging LNK and CHM files to deliver Rust-based and PowerShell-based malware.
2⃣ Post-Recon: Deployment of FadeStealer via a Python loader using Process Doppelgänging, followed by hands-on-keyboard activity.
3⃣ C2: A simple yet highly effective C2 script orchestrating the entire operation

Please check this out: https://t.co/P9nUYObvz2

[tsunekoh @tsunek0h]

My presentation “XUnprotect: Reverse Engineering macOS XProtect Remediator” at #BHUSA wrapped up yesterday. Thank you so much to everyone who attended. For those who couldn’t make it to #BHUSA, I’ll be sharing the key points from my research in this thread. (1/22)

[Patrick Wardle @patrickwardle]

Just posted my @defcon slides (talk #1): "Mastering Apple's Endpoint Security for Advanced macOS Malware Detection"

Writing 🍎 security software? You should be using Endpoint Security! But its advanced features are rather nuanced & often misunderstood 🫣

https://t.co/TRn6dRnjV5

[hashp4 @hashp4_]

This year, I'm delighted to have had the opportunity to join the @x33fcon #crew and contribute to the smooth running of the conference as a volunteer.

I had the chance to meet a lot of great people during this week. It truly was an amazing experience.

See you next year! 😉

[/ˈziːf-kɒn/ @x33fcon]

🚀The 9th edition of the #x33fcon conference is behind us! ♥️Heartfelt thanks to all participants, speakers, trainers, sponsors, partners, and volunteers! 👏Thank you so much, and see you next year!

[hashp4 @hashp4_]

@_Euzebius @x33fcon I'll be there! We'll probably see eachothers (:

[GuidedHacking @GuidedHacking]

Stop talking about doing things and just do them.

The incessant theory crafting about how to learn something, what the best books are, what courses to take, where the best place to learn etc... is tedious dithering.

If you actually wanted to do it, you would be doing it.

Endless talking isn't a strategy. You don't need another reddit thread, youtube deep dive or curated book list to get started.

You are not researching, you are procrastinating. If you actually cared about doing the thing, you’d already be doing it.

You romanticize the idea of doing something so much that you forget it actually requires effort. You are stalling because deep down, you know you won’t follow through.

Now prove me wrong and actually start learning how to hack, or whatever it is you never shutup about wanting to do.

[herrcore @herrcore]

Unpacking VMProtect 3 (x64) 🤷‍♂️

[Craig Loewen @craigaloewen]

Very proud to announce that the Windows Subsystem for Linux is now open source!

https://t.co/2yJVi2Xc6U

[Check Point Research @_CPResearch_]

Thread Execution Hijacking is one of the well-known methods that can be used to run implanted code.
In this blog we introduce a new injection method, that is based on this classic technique, but much stealthier - Waiting Thread Hijacking.
Read More : https://t.co/ptdomYaAZG