Top Tweets for #Malcerts
919b0560991c6bff4ce3c8fd91fd66d84eb672287526ab163ffa1886f8ae5702
Might be a win, with some casualties? #MalCerts #APT
#CarbonOrchestrator #RussianAPT @IntezerAISOC
cc: @skocherhan @userlolxxl @KulinskiArkadi @LevelBlueCyber OTX 2096
cc: @virusfinder
https://t.co/EGl7wa1RsG
@virustotal @RecordedFuture
JFC @userlolxxl you a damn gem.
cc: @skocherhan @KulinskiArkadi @ADanielHill @petikvx @usetraceix <3
Buckle up folks - #Certificates are #Malware #Ransomware now = #MalCerts
1/vt @virustotal detections by @Maxxecure
It says trojan, but gives ‘network stealth worm FAFO energy’
- - -
cc: @TeamNAIT @UCPGoA23 [ the @nextronsystems @thor_scanner rules used to grab everything signed by them were by @albertzsigovits btw <3 ].
- - -
Available on: @virustotal @usetraceix @RecordedFuture @filescan_itsec and #Education #Government #Healthcare devices en La Provinciá de Alberta
…how to revoke…@magicswordio @unpacme = ??
![medsci_yb3r's tweet photo. JFC @userlolxxl you a damn gem.
cc: @skocherhan @KulinskiArkadi @ADanielHill @petikvx @usetraceix <3
Buckle up folks - #Certificates are #Malware #Ransomware now = #MalCerts
1/vt @virustotal detections by @Maxxecure
It says trojan, but gives ‘network stealth worm FAFO energy’
- - -
cc: @TeamNAIT @UCPGoA23 [ the @nextronsystems @thor_scanner rules used to grab everything signed by them were by @albertzsigovits btw <3 ].
- - -
Available on: @virustotal @usetraceix @RecordedFuture @filescan_itsec and #Education #Government #Healthcare devices en La Provinciá de Alberta
…how to revoke…@magicswordio @unpacme = ??](https://pbs.twimg.com/media/HWON88HbEAAHNDt.jpg)
![medsci_yb3r's tweet photo. JFC @userlolxxl you a damn gem.
cc: @skocherhan @KulinskiArkadi @ADanielHill @petikvx @usetraceix <3
Buckle up folks - #Certificates are #Malware #Ransomware now = #MalCerts
1/vt @virustotal detections by @Maxxecure
It says trojan, but gives ‘network stealth worm FAFO energy’
- - -
cc: @TeamNAIT @UCPGoA23 [ the @nextronsystems @thor_scanner rules used to grab everything signed by them were by @albertzsigovits btw <3 ].
- - -
Available on: @virustotal @usetraceix @RecordedFuture @filescan_itsec and #Education #Government #Healthcare devices en La Provinciá de Alberta
…how to revoke…@magicswordio @unpacme = ??](https://pbs.twimg.com/media/HWON88Eb0AEkPmt.jpg)
![medsci_yb3r's tweet photo. JFC @userlolxxl you a damn gem.
cc: @skocherhan @KulinskiArkadi @ADanielHill @petikvx @usetraceix <3
Buckle up folks - #Certificates are #Malware #Ransomware now = #MalCerts
1/vt @virustotal detections by @Maxxecure
It says trojan, but gives ‘network stealth worm FAFO energy’
- - -
cc: @TeamNAIT @UCPGoA23 [ the @nextronsystems @thor_scanner rules used to grab everything signed by them were by @albertzsigovits btw <3 ].
- - -
Available on: @virustotal @usetraceix @RecordedFuture @filescan_itsec and #Education #Government #Healthcare devices en La Provinciá de Alberta
…how to revoke…@magicswordio @unpacme = ??](https://pbs.twimg.com/media/HWON88EbQAAs3IX.jpg)
![medsci_yb3r's tweet photo. JFC @userlolxxl you a damn gem.
cc: @skocherhan @KulinskiArkadi @ADanielHill @petikvx @usetraceix <3
Buckle up folks - #Certificates are #Malware #Ransomware now = #MalCerts
1/vt @virustotal detections by @Maxxecure
It says trojan, but gives ‘network stealth worm FAFO energy’
- - -
cc: @TeamNAIT @UCPGoA23 [ the @nextronsystems @thor_scanner rules used to grab everything signed by them were by @albertzsigovits btw <3 ].
- - -
Available on: @virustotal @usetraceix @RecordedFuture @filescan_itsec and #Education #Government #Healthcare devices en La Provinciá de Alberta
…how to revoke…@magicswordio @unpacme = ??](https://pbs.twimg.com/media/HWON87-bUAAlbrg.jpg)
Thanks @UCPGoA23 @TeamNAIT
cc: @magicswordio @unpacme
Just 20 zips of System 32 things (all signed)
Up on @RecordedFuture TRIAGE VM & @virustotal
Lines up with @thor_scanner <3 & #YARA for detecting #MalCerts that need revocation
SHA-256: 8fecc23badd5e9e7f59a6370a208165a7a447c1bd1aa642d3686196dcc22fc02
https://t.co/nZVfvX4uA1
Nearly zero detections…annoying. #MalCerts
#YARA detections on some by @nextronsystems and some picked up by @HybridAnalysis @DeepInstinctSec too
Up on @virustotal
https://t.co/GsZgTha6oT
Also @LevelBlueCyber OTX 2096
cc: @userlolxxl @skocherhan @KulinskiArkadi @magicswordio
@medsci_yb3r @skocherhan @TheKn0ck0ut @AHS_media @userlolxxl We gave it an update (the graph). Ran out of VT credits. Links to #APT28 #VECT
Not sure what it means exactly.
@abuse_ch has our #VECT samples (we forgot to put them into VT). But all are signed. #MalCerts
Question @ADanielHill for some expertise here
[ re: #MalCerts #Certificates whathaveyou… ]
Where do #Canada #Poland #Uraguay #Slovakia #Ukraine collide?
- - -
Any relation to this below?
https://t.co/sdXlPUoTaN
- - -
Found by @userlolxxl ( one of our all-stars of @LevelBlueCyber OTX 2096 )
cc: @KulinskiArkadi
@medsci_yb3r e-factura, certificate valid until today 1 November 2026 look at certificate abitabov.crl https://t.co/gTE8TyfZpS ->Abitab SSL Organization issuser maybe @KulinskiArkadi could know more PL - CA - UY👉E67D18639367C5B29BF7A5683B56B0F0C23155C8FE9452BCFE51681436023742
@medsci_yb3r @nextronsystems @HybridAnalysis @DeepInstinctSec @virustotal @LevelBlueCyber @userlolxxl @skocherhan @KulinskiArkadi @magicswordio Here you go champ -> @cyfarelabs @RecordedFuture @TheRecord_Media @virustotal
@LevelBlueCyber OTX 2096 @magicswordio
TRIAGE VM #MalCerts #Ransomware #Persistence #Spyware #YEG #abpoli
https://t.co/2rgIv821fm
8fecc23badd5e9e7f59a6370a208165a7a447c1bd1aa642d3686196dcc22fc02
Nearly zero detections…annoying. #MalCerts
#YARA detections on some by @nextronsystems and some picked up by @HybridAnalysis @DeepInstinctSec too
Up on @virustotal
https://t.co/GsZgTha6oT
Also @LevelBlueCyber OTX 2096
cc: @userlolxxl @skocherhan @KulinskiArkadi @magicswordio
Mondays...
3/3 teams (#Canada) based (#YEG #Alberta) confirmed what we're NOT prepared for
#VECT #Avaddon #MalCerts #Certificates #abpoli #UAlberta #Alberta #Cybersecurity
@LevelBlueCyber OTX 2096 for our #Data & #Evidence (Links in ALT)
#Government #Healthcare #Education
@medsci_yb3r @TeamNAIT @skocherhan @KulinskiArkadi @userlolxxl @RecordedFuture @virustotal @MetaDefenderCLD @youralberta @ualberta @ahs_media should the @RCMPAlberta (Leduc / #YEG) get their sh*t together & look at report 2026972763 or keep letting this hit our critical infrastructure? @medsci_yb3r @albertaradios @ElectionsAB #VECT #MalCerts @abuse_ch #YARA
https://t.co/VkgyPaa3Zc
@malwrhunterteam Well if ya'll want to talk about #MalCerts #PhantomCerts #Certificates...
We got a few we're stuck on.
https://t.co/vimQRg09Uz
Pseudo-Related to...
https://t.co/nSUTKh6oLP
@medsci_yb3r @userlolxxl @skocherhan @KulinskiArkadi @TeamNAIT
Don’t Worry #Alberta: You’re safe as long as you haven’t used #Government, #Education, or #Healthcare or renewed your licenses or voted in #Alberta recently.
-Just ‘eye-balling’ it, as this sample device was connected to @youralberta @UAlberta @AHS_media
#Data & #Evidence up on @LevelBlueCyber OTX 2096
-i.e. the #Data & results myself nor 100+ other people can’t get to @RCMPAlberta or to @AlbertaNDP @NathanIpYEG
-Well that’s a pickle.
Somewhat outlined by @magicswordio here:
https://t.co/2jbFX3wI5o
@userlolxxl @medsci_yb3r @TeamNAIT @skocherhan @KulinskiArkadi @ADanielHill @RCMPAlberta @nextronsystems @nextronresearch @EFF @cybercentre_ca @cse_cst @Safety_Canada @accessnow This is just a signed ( #MalCerts ) #APT28 implant. One of many. MANY.
@TeamNAIT you said this might be @ASIRT_AB ?? Never heard of them. @medsci_yb3r any idea who they are??
@userlolxxl we think the problems are getting bigger than 3 teams in #YEG #Alberta s
Well that worked, thx @medsci_yb3r & @albertzsigovits for a good first step.
@thor_scanner loaded & remixed to track #MalCerts
@magicswordio @LevelBlueCyber OTX 2096
https://t.co/Jv7hqevIo0
https://t.co/M6O1ZooFD6
https://t.co/nkho0r8bzZ
https://t.co/xS4cbsz4U3
@MondoABx @medsci_yb3r @ElectionsAB @whiteintel_io @RockHudsonRock @YourAlberta @RebelNews_CA @GlobalEdmonton @GlobalCalgary @gilmcgowan @albertaradios @ABLabourToday @ABProsperityPrj @CanadianPro2 @CourtEllingson @RCMPAlberta @edmontonpolice @CrimeStoppersAB @CalgaryPolice @CPS_Commission One would think - we have problems piling on top of problems.
The big complication ( indirect consequence of things from @medsci_yb3r ) = #MalCerts (no need fo vulnerabilities or spooky backdoors when you have the literal keys to the front door, & a set of signed info-stealers)
@skocherhan @medsci_yb3r @ElectionsAB @whiteintel_io @RockHudsonRock @YourAlberta @RebelNews_CA @GlobalEdmonton @GlobalCalgary @gilmcgowan @albertaradios @ABLabourToday @ABProsperityPrj @CanadianPro2 @CourtEllingson @userlolxxl @KulinskiArkadi @ADanielHill NO - these are the #MalCerts #Certificates #PhantomCerts // @skocherhan @medsci_yb3r @userlolxxl @kulinskiarkadi can you elaborate for us: 1) Where these come from & 2) How to get rid of them?
https://t.co/XSr9nwA0An @virustotal
https://t.co/mc3Pwo4Gsk @LevelBlueCyber
@medsci_yb3r -> Check it bruh (@RCMPAlberta contact him for #VECT samples collected from @AHS_media infrastructure).
- - -
You will not detect it b/c they are 'signed' by #Certificates #MalCerts #PhantomCerts
- - -
Available on @abuse_ch @LevelBlueCyber OTX 2096
Hey @medsci_yb3r @skocherhan @KulinskiArkadi @UCPGoA23 @CanadianPro2 cca 4m ago we discussed #Vect #ransomware'Vect ransomgroup: IOCs coll. unit42 Paloaltonetworks' https://t.co/azjYlTEKcR check #TeamPCP IOCs https://t.co/xV0kJQkWUV =>arested https://t.co/oIwEDStUqg（￣︶￣）↗
@UCPGoA23 @TELUS @TELUSsupport @Google @GooglePixel_US @Norton @LifeLock @GenDigitalInc @YourAlberta @CrimeStoppersAB @RCMPAlberta @ADanielHill @rcmpgrcpolice @virustotal @UAlberta @NANOantivirus @LevelBlueCyber @HybridAnalysis @kaspersky Given these are signed with #Malcerts #Certificates #PhantomCerts -> Undetectable then & likely undetectable now. #UAlberta
Ditto w. the #InfoStealers they’ve got on most devices on campus (personal or otherwise).
@RockHudsonRock ->
https://t.co/qW5QdEaeom
#MALCERTS as are/were all WinCATs "The digital signature of the object did not verify" 129.2.4[.]2 AS 27 University of Maryland UNIVER-262-Z https://t.co/UCXyo03g2n https://t.co/JpPX28ApWI ❗️thanks❗️@KulinskiArkadi & 'ms..'❗️https://t.co/MzcgdwHy4K cc: @medsci_yb3r @skocherhan
![userlolxxl's tweet photo. #MALCERTS as are/were all WinCATs "The digital signature of the object did not verify" 129.2.4[.]2 AS 27 University of Maryland UNIVER-262-Z https://t.co/UCXyo03g2n https://t.co/JpPX28ApWI ❗️thanks❗️@KulinskiArkadi & 'ms..'❗️https://t.co/MzcgdwHy4K cc: @medsci_yb3r @skocherhan https://t.co/YYOzfmFAa8](https://pbs.twimg.com/media/HO7-lK5WQAAnv6z.jpg)
![userlolxxl's tweet photo. #MALCERTS as are/were all WinCATs "The digital signature of the object did not verify" 129.2.4[.]2 AS 27 University of Maryland UNIVER-262-Z https://t.co/UCXyo03g2n https://t.co/JpPX28ApWI ❗️thanks❗️@KulinskiArkadi & 'ms..'❗️https://t.co/MzcgdwHy4K cc: @medsci_yb3r @skocherhan https://t.co/YYOzfmFAa8](https://pbs.twimg.com/media/HO7-SCzWQAAKAJt.jpg)
![userlolxxl's tweet photo. #MALCERTS as are/were all WinCATs "The digital signature of the object did not verify" 129.2.4[.]2 AS 27 University of Maryland UNIVER-262-Z https://t.co/UCXyo03g2n https://t.co/JpPX28ApWI ❗️thanks❗️@KulinskiArkadi & 'ms..'❗️https://t.co/MzcgdwHy4K cc: @medsci_yb3r @skocherhan https://t.co/YYOzfmFAa8](https://pbs.twimg.com/media/HO78XQPWsAErZAM.jpg)
![userlolxxl's tweet photo. #MALCERTS as are/were all WinCATs "The digital signature of the object did not verify" 129.2.4[.]2 AS 27 University of Maryland UNIVER-262-Z https://t.co/UCXyo03g2n https://t.co/JpPX28ApWI ❗️thanks❗️@KulinskiArkadi & 'ms..'❗️https://t.co/MzcgdwHy4K cc: @medsci_yb3r @skocherhan https://t.co/YYOzfmFAa8](https://pbs.twimg.com/media/HO78OIkWQAA1jKX.png)
@userlolxxl @M_haggis @Securityblog I don’t know about that just yet @userlolxxl - We might want to increase the 7000+ number ‘just a tiny bit’. I got a whole new batch recently that errrrrr…I believe fall into the #MalCerts 2.0 category.
**Opens workstation…
**Closes workstation…
Thanks for having me @ADanielHill & friends. Ya’ll brought some joy to my day <3
1) Busy wrapping my brain around this problem here. Apparently #Certificates CAN be #Malware #Ransomware ( #MalCerts )
2) Careful playing w. those @userlolxxl @skocherhan @kulinskiarkadi -> Looks like #VECT picked up some new tricks from ‘you-know-where’…
3) #Alberta feel free to read up on #Vect RAAS - they also have your #Data & any meaningful #Evidence ya’ll are worried about. They are not some ‘Nothing-Burger’ UCP/Sep. idiot who flies to TX for whatever reason.
4) Get with the times - name & address & random ID is…how do you say…outdated ‘clickbait’?? Status on real report: @AlbertaNDP @NathanIpYEG & @CarrieTait were provided a ‘boatload of #Data’.
Still ‘tip of the iceberg’…sighhhh…
5) To help Translate…if the folks who had your #Data were a pokémon -> ooh that is so accurate.
cc: @TheBlueGem3 @TheBreakdownAB
Here are some rules to use to ‘maybe detect them’ in our #Healthcare #Government #Education systems. Your call.
Task ID:d659b36c-5984-11f1-badc-42010aa4000b
Task ID:aec501cb-5985-11f1-badc-42010aa4000b
Also for reference all ya’ll that is an ‘out-dated’ snapshot in time of ‘where your data was going’ specifically from that website. It’s been updated & put into a more dynamic/interactive format since then.
Think of it as a ‘picture in time’ of a live & ‘in-progress’ #Cybercrime
Yes and no, but I do recognize all the certs signing these. My brain is cooked. re: #Malcerts #Certificates
@malwrhunterteamam @magic@magicswordiowordio would love to chat with ya'll.
I threw together a mess of them zipped (across all the platforms).
@petikvx threw a bunch of them up for me everywhere too <3
---
They need to be burned. Burned with fire. They all @Apple @Microsoft @Google in this batch ( there are more to come...).
New link = https://wormhole[.]app/KBa8JY#dQ78Hmu107uzVwLv-kbekA (good for 24 hours)
---
-> There are a lot of them - I know
-> There be 'reasons' for that (would love to discuss)
-> I don't have the power of revocation (just yet)
They also up on @virustotal & @LevelBlueCyber OTX 2096
---
![medsci_yb3r's tweet photo. Yes and no, but I do recognize all the certs signing these. My brain is cooked. re: #Malcerts #Certificates
@malwrhunterteam @magicswordio would love to chat with ya'll.
I threw together a mess of them zipped (across all the platforms).
@petikvx threw a bunch of them up for me everywhere too <3
---
They need to be burned. Burned with fire. They all @Apple @Microsoft @Google in this batch ( there are more to come...).
New link = https://wormhole[.]app/KBa8JY#dQ78Hmu107uzVwLv-kbekA (good for 24 hours)
---
-> There are a lot of them - I know
-> There be 'reasons' for that (would love to discuss)
-> I don't have the power of revocation (just yet)
They also up on @virustotal & @LevelBlueCyber OTX 2096
---](https://pbs.twimg.com/media/G7PgGNUawAAuJhw.jpg)
Most Popular Users
Elon Musk 
@elonmusk
240.9M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.4M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
66.4M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.6M followers