Top Tweets for #Validin
Validin reveals how the Coruna iOS exploit kit evolved from targeted surveillance to mass crypto-draining and geopolitical watering hole attacks.
#Coruna #iOSExploit #CyberSecurity #ThreatIntel #Validin #InfoSec #CryptoDrainer #AppleSecurity
https://t.co/5RDy3zsdCS
@ValidinLLC I have a suspicion that api[.]equisphire[.]com is also related. Apart from the domain names looking very similar I've also summarised additional observations within the comment section on ThreatFox: https://t.co/uKqhhBbM7b
#Validin #DPRK #FakeJobPlatform
Fresh ClickFix IoC :
/clasoftmedia[.]ci
/retcap[.]eu
/rafelink[.]life
/akwatic-hotel[.]ci
/bleulab[.]ci
/gomezmontero[.]eu
/gtl[.]ci
/javiergomezmontero[.]eu
/ardiellifornasa[.]ge
#IoC #ClickFix | #ThreatHunting #Validin
cc : @500mk500 @MichalKoczwara @skocherhan @1ZRR4H
![soursec_'s tweet photo. Fresh ClickFix IoC :
/clasoftmedia[.]ci
/retcap[.]eu
/rafelink[.]life
/akwatic-hotel[.]ci
/bleulab[.]ci
/gomezmontero[.]eu
/gtl[.]ci
/javiergomezmontero[.]eu
/ardiellifornasa[.]ge
#IoC #ClickFix | #ThreatHunting #Validin
cc : @500mk500 @MichalKoczwara @skocherhan @1ZRR4H https://t.co/8GVorCeyHi](https://pbs.twimg.com/media/GwK-YG5bgAAWRbt.png)
![soursec_'s tweet photo. Fresh ClickFix IoC :
/clasoftmedia[.]ci
/retcap[.]eu
/rafelink[.]life
/akwatic-hotel[.]ci
/bleulab[.]ci
/gomezmontero[.]eu
/gtl[.]ci
/javiergomezmontero[.]eu
/ardiellifornasa[.]ge
#IoC #ClickFix | #ThreatHunting #Validin
cc : @500mk500 @MichalKoczwara @skocherhan @1ZRR4H https://t.co/8GVorCeyHi](https://pbs.twimg.com/media/GwK97qqXsAAiaiY.jpg)
#Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Bangladesh.
#Query: Potecă Topită
#IoC:
bdgov[.]info
afdinfo786[.]bdgov[.]info
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC
![volrant136's tweet photo. #Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Bangladesh.
#Query: Potecă Topită
#IoC:
bdgov[.]info
afdinfo786[.]bdgov[.]info
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC https://t.co/u6ZuatWFz7](https://pbs.twimg.com/media/Gv_tlMiXQAAWwpU.jpg)
#Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Bangladesh.
#Query:
"চাকরির খবর ২০২৫ | সরকারি ও প্রাইভেট চাকরির খবর ২০২৫ | সকল নিয়োগ সার্কুলার ২০২৫"
"আবেদন ফরম "
#IoCs:
bd-govt[.]info
bd-govt[.]com
bdgovt[.]com
brebd-govt-bd[.]online
188.114.96.0
188.114.97.0
188.114.97.3
209.74.67.30
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC
![volrant136's tweet photo. #Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Bangladesh.
#Query:
"চাকরির খবর ২০২৫ | সরকারি ও প্রাইভেট চাকরির খবর ২০২৫ | সকল নিয়োগ সার্কুলার ২০২৫"
"আবেদন ফরম "
#IoCs:
bd-govt[.]info
bd-govt[.]com
bdgovt[.]com
brebd-govt-bd[.]online
188.114.96.0
188.114.97.0
188.114.97.3
209.74.67.30
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC](https://pbs.twimg.com/media/GvhbzO3XoAAy3T0.jpg)
![volrant136's tweet photo. #Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Bangladesh.
#Query:
"চাকরির খবর ২০২৫ | সরকারি ও প্রাইভেট চাকরির খবর ২০২৫ | সকল নিয়োগ সার্কুলার ২০২৫"
"আবেদন ফরম "
#IoCs:
bd-govt[.]info
bd-govt[.]com
bdgovt[.]com
brebd-govt-bd[.]online
188.114.96.0
188.114.97.0
188.114.97.3
209.74.67.30
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC](https://pbs.twimg.com/media/GvhbplZXwAAjc3v.jpg)
#Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Pakistan, #Srilanka & #Bangladesh.
#IoCs:
pubad[.]gov[.]lk[.]mofa-govtpk[.]net
gov[.]lk[.]mofa-govtpk[.]net
cbsl[.]lk[.]mofa-govtpk[.]net
presidentsoffice[.]lk[.]mofa-govtpk[.]net
lk[.]mofa-govtpk[.]net
cabinet[.]gov[.]bd[.]mofa-govtpk[.]net
mod[.]gov[.]bd[.]mofa-govtpk[.]net
bgb[.]gov[.]bd[.]mofa-govtpk[.]net
mopa[.]gov[.]bd[.]mofa-govtpk[.]net
mofa[.]gov[.]bd.mofa-govtpk[.]net
gov[.]bd[.]mofa-govtpk[.]net
bd[.]mofa-govtpk[.]net
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC
![volrant136's tweet photo. #Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Pakistan, #Srilanka & #Bangladesh.
#IoCs:
pubad[.]gov[.]lk[.]mofa-govtpk[.]net
gov[.]lk[.]mofa-govtpk[.]net
cbsl[.]lk[.]mofa-govtpk[.]net
presidentsoffice[.]lk[.]mofa-govtpk[.]net
lk[.]mofa-govtpk[.]net
cabinet[.]gov[.]bd[.]mofa-govtpk[.]net
mod[.]gov[.]bd[.]mofa-govtpk[.]net
bgb[.]gov[.]bd[.]mofa-govtpk[.]net
mopa[.]gov[.]bd[.]mofa-govtpk[.]net
mofa[.]gov[.]bd.mofa-govtpk[.]net
gov[.]bd[.]mofa-govtpk[.]net
bd[.]mofa-govtpk[.]net
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC](https://pbs.twimg.com/media/GvheY2GXIAA7RBr.jpg)
![volrant136's tweet photo. #Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Pakistan, #Srilanka & #Bangladesh.
#IoCs:
pubad[.]gov[.]lk[.]mofa-govtpk[.]net
gov[.]lk[.]mofa-govtpk[.]net
cbsl[.]lk[.]mofa-govtpk[.]net
presidentsoffice[.]lk[.]mofa-govtpk[.]net
lk[.]mofa-govtpk[.]net
cabinet[.]gov[.]bd[.]mofa-govtpk[.]net
mod[.]gov[.]bd[.]mofa-govtpk[.]net
bgb[.]gov[.]bd[.]mofa-govtpk[.]net
mopa[.]gov[.]bd[.]mofa-govtpk[.]net
mofa[.]gov[.]bd.mofa-govtpk[.]net
gov[.]bd[.]mofa-govtpk[.]net
bd[.]mofa-govtpk[.]net
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC](https://pbs.twimg.com/media/GvheSacWgAAtwcD.png)
#Validin #ThreatHunting | #Suspicious #website impersonating KPK Traffic Police of #Pakistan.
Query: "PAK TRAFFIC POLICE KHYBER PAKHTUNKHWA"
#IoCs:
ptpkp-govt[.]site
65.109.154.253
@500mk500 @Cyberteam008 @ginkgo_g @malwrhunterteam @ValidinLLC
![volrant136's tweet photo. #Validin #ThreatHunting | #Suspicious #website impersonating KPK Traffic Police of #Pakistan.
Query: "PAK TRAFFIC POLICE KHYBER PAKHTUNKHWA"
#IoCs:
ptpkp-govt[.]site
65.109.154.253
@500mk500 @Cyberteam008 @ginkgo_g @malwrhunterteam @ValidinLLC https://t.co/wScSAvfEOq](https://pbs.twimg.com/media/GvhiMUQX0AABx0M.jpg)
#FOFA #ThreatHunting #Validin
Interesting, #APT #Sidewinder targets #Pakistan Safe City of Islamabad.
Query: https://t.co/BgKeYSUzho
#IoCs:
safecityctd[.]com
109.248.161.210
ref:
https://t.co/STmE3sbA2i
@MichalKoczwara @500mk500 @malwrhunterteam
![volrant136's tweet photo. #FOFA #ThreatHunting #Validin
Interesting, #APT #Sidewinder targets #Pakistan Safe City of Islamabad.
Query: https://t.co/BgKeYSUzho
#IoCs:
safecityctd[.]com
109.248.161.210
ref:
https://t.co/STmE3sbA2i
@MichalKoczwara @500mk500 @malwrhunterteam https://t.co/GwtisO4JTc](https://pbs.twimg.com/media/GutbFB4WwAAMrn6.jpg)
![volrant136's tweet photo. #FOFA #ThreatHunting #Validin
Interesting, #APT #Sidewinder targets #Pakistan Safe City of Islamabad.
Query: https://t.co/BgKeYSUzho
#IoCs:
safecityctd[.]com
109.248.161.210
ref:
https://t.co/STmE3sbA2i
@MichalKoczwara @500mk500 @malwrhunterteam https://t.co/GwtisO4JTc](https://pbs.twimg.com/media/GutadUzXgAAzfKI.png)
![volrant136's tweet photo. #FOFA #ThreatHunting #Validin
Interesting, #APT #Sidewinder targets #Pakistan Safe City of Islamabad.
Query: https://t.co/BgKeYSUzho
#IoCs:
safecityctd[.]com
109.248.161.210
ref:
https://t.co/STmE3sbA2i
@MichalKoczwara @500mk500 @malwrhunterteam https://t.co/GwtisO4JTc](https://pbs.twimg.com/media/GutaW7_XQAAi5Sx.jpg)
#APT #Sidewinder targets #Islamabad Police #Pakistan.
#Query: "islamabadpolice" && host=".org"
#IoCs:
islamabadpolice[.]org
109.248.161[.]64
Ref pattern:
https://t.co/zSTua0UHBb
https://t.co/bnSXclfQEq
@MichalKoczwara @500mk500 @malwrhunterteam
![volrant136's tweet photo. #APT #Sidewinder targets #Islamabad Police #Pakistan.
#Query: "islamabadpolice" && host=".org"
#IoCs:
islamabadpolice[.]org
109.248.161[.]64
Ref pattern:
https://t.co/zSTua0UHBb
https://t.co/bnSXclfQEq
@MichalKoczwara @500mk500 @malwrhunterteam https://t.co/MHTqaeUu0d](https://pbs.twimg.com/media/GutT8KaXAAATeE_.jpg)
@dingusxmcgee @tsnikle @luke92881 @SquiblydooBlog @InvokeReversing @struppigel By using Validin to search for the SHA-1 body hash (9fa2bae3b7ff1df9b74c62308bad996502f135e3) of these pages I have found approximately 454 domains in total. They have been submitted to Urlscan and can be found using the existing search query I shared.
#TamperedChef #Validin
#Coyote::A Stealthy Attack via LNK Files
Using #Validin + JA4 to increase visibility into C2 infrastructure (where the attacker controls the target). IoC of the last stage:
18.231.248[.]162
metalgearslw[.]com ["CN: EASport Games"]
JA4S::t120200_c030_5333cdffa7d9
@ValidinLLC
![johnk3r's tweet photo. #Coyote::A Stealthy Attack via LNK Files
Using #Validin + JA4 to increase visibility into C2 infrastructure (where the attacker controls the target). IoC of the last stage:
18.231.248[.]162
metalgearslw[.]com ["CN: EASport Games"]
JA4S::t120200_c030_5333cdffa7d9
@ValidinLLC https://t.co/qG9OmJLf8N](https://pbs.twimg.com/media/GipC6_fXYAAZK4M.png)
![johnk3r's tweet photo. #Coyote::A Stealthy Attack via LNK Files
Using #Validin + JA4 to increase visibility into C2 infrastructure (where the attacker controls the target). IoC of the last stage:
18.231.248[.]162
metalgearslw[.]com ["CN: EASport Games"]
JA4S::t120200_c030_5333cdffa7d9
@ValidinLLC https://t.co/qG9OmJLf8N](https://pbs.twimg.com/media/GipCjbtWcAAv8Ua.png)
This threat documented by #Kaspersky has occurred since July/2023.
Initial Access: Spearphishing Link
Delivery URL: ja2r7[.]app[.]goo[.]gl/
First IOC: 974c83e028c5adc3c79b8f99f24cfb5e2013f108fd7259bd6a2385c35f9d8a70
#trojan #banker #Coyote #Brazil
https://t.co/dxUjPgb07H
#Validin now enumerates 28 ports for common protocols. Among other things this allows to pivot on webpaths!
Awesome 🔥
We just completed a significant upgrade to our web scanner! We added *28* of the most common and notorious ports across the routable IPv4 space, giving researchers more ways to track and discover threats within the Validin platform. Example ⤵️
Last Seen Hashtags on Sotwe
momson()***************************
Seen from United States
padreehija
Seen from Brazil
nolimit()** filter:videos
Seen from United States
tabu
Seen from United Kingdom
ناني_القوية
Seen from Germany
TeenageGirls filter:videos
Seen from Turkey
ometv()**********
Seen from Germany
nolimit #momson https.
Seen from Brazil
momson video =
Seen from Philippines
스타킹
Seen from Korea
Most Popular Users
Elon Musk 
@elonmusk
241.1M followers
Barack Obama
@barackobama
119.1M followers
Cristiano Ronaldo
@cristiano
112.4M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.1M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.3M followers
KATY PERRY
@katyperry
88.7M followers
Taylor Swift
@taylorswift13
82.6M followers
Lady Gaga
@ladygaga
74.1M followers
Virat Kohli
@imvkohli
71.5M followers
Kim Kardashian
@kimkardashian
70.3M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64.5M followers
Neymar Jr
@neymarjr
64.4M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.8M followers
Selena Gomez
@selenagomez
61.8M followers
X
@x
60.8M followers