Top Tweets for #WikiLoader

over 1 year ago

#WikiLoader - #TA544 - url > .msi > .dll #Signed - Canton Pure Jonna Network Technology msiexec.exe /I GlobalProtect64.msi C:\Users\*\AppData\Roaming\NitroSoftNPv1.3\notepad.exe (sideload)👇 \AppData\Roaming\NitroSoftNPv1.3\mimeTools.dll (1/3) IOC's https://t.co/f3w7FvTf81

$Cryptolaemus1's tweet photo. #WikiLoader - #TA544 - url > .msi > .dll #Signed - Canton Pure Jonna Network Technology msiexec.exe /I GlobalProtect64.msi C:\Users\*\AppData\Roaming\NitroSoftNPv1.3\notepad.exe (sideload)👇 \AppData\Roaming\NitroSoftNPv1.3\mimeTools.dll (1/3) IOC's https://t.co/f3w7FvTf81 https://t.co/tGqRIYVy22$

Anonymous🐾🐈‍⬛ @YourAnonRiots

almost 2 years ago

A new #malware campaign is spoofing Palo Alto Networks' GlobalProtect #VPN to deliver #WikiLoader via SEO malvertising. https://t.co/vtyCcLdfsP #cybersecurity

424

Hackread.com @HackRead

almost 2 years ago

Beware of fake #GlobalProtect VPN downloads! A new malware campaign uses SEO poisoning and spoofed websites to deliver WikiLoader malware. #CyberSecurity #WikiLoader #Malware #VPN #SEO Read: https://t.co/5RRgvzcrmY

Amitav Bhattacharjee

@bamitav

almost 2 years ago

Cyberattackers Spoof Palo Alto VPNs to Spread #WikiLoader Variant https://t.co/PIoWCCjMmQ #paloalto #VPN #vulnerability #2fa #RCE #ZeroTrust #ZeroDay #cybercrime #hacker #privacy #APT #bot #CISO #DDoS #hacking #phishing #CyberAttack #cybersecurity #Security #infosec #AppSec #CyberSec #databreach #Hacked #dataprotection #DataPrivacy #DataSecurity #fraud #ScamAlert #scammer #malware

327

キタきつね

@foxbook

almost 2 years ago

パロアルトの GlobalProtect VPN が偽装され、新たなマルウェアの亜種が配信される Palo Alto's GlobalProtect VPN Spoofed to Deliver New Malware Variant #InfoSecurityMagazine (Sep 3) #VPNセキュリティ #PaloAltoNetworks #マルウェア #WikiLoader #リモートワークセキュリティ https://t.co/wIUwpmEsUr

323

Dark Reading

@DarkReading

almost 2 years ago

Cyberattackers Spoof Palo Alto VPNs to Spread WikiLoader Variant: https://t.co/9YP6gTS1Kp #wikiloader

Threat Intelligence @threatintel

almost 2 years ago

#ThreatProtection #WailingCrab, a #WikiLoader variant, targets U.S. education and transport sectors with spoofed VPNs. Read more about Symantec's protection: https://t.co/UghuozCyC1 #CyberSecurity #Malware #VPN

Cyber_OSINT @Cyber_O51NT

almost 2 years ago

Unit 42 has revealed the use of WikiLoader malware spoofing GlobalProtect VPN, uncovering evasion techniques, malicious URLs, and mitigation strategies. #CyberSecurity #WikiLoader #GlobalProtect https://t.co/8ImbzfDJEm

Cryptolaemus @Cryptolaemus1

about 2 years ago

#WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll wscript.exe Invoice-808.js wscript.exe sso.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.4.portable.x64\notepad.exe (sideload)👇 \npp.8.6.3.portable.x64\plugins\mimeTools.dll (1/3)👇 IOC's https://t.co/xy84rOTmCv

$Cryptolaemus1's tweet photo. #WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll wscript.exe Invoice-808.js wscript.exe sso.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.4.portable.x64\notepad.exe (sideload)👇 \npp.8.6.3.portable.x64\plugins\mimeTools.dll (1/3)👇 IOC's https://t.co/xy84rOTmCv https://t.co/GNUlY3bN1g$

Andrea (Drego) Draghetti 👨🏻‍💻 🎣 @AndreaDraghetti

about 2 years ago

Campagne #Malware #Italy Week 16 👻💣🔥☠️ #AgentTesla: Offerta #Remcos: Fattura #WikiLoader: Delivery #Guloader: Ordine #Irata: APK Bank #DarkCloud: Preventivo #Formbook: Quote #StrRat: Pagamento #mwitaly

AndreaDraghetti's tweet photo. Campagne #Malware #Italy Week 16

👻💣🔥☠️

#AgentTesla: Offerta
#Remcos: Fattura
#WikiLoader: Delivery
#Guloader: Ordine
#Irata: APK Bank
#DarkCloud: Preventivo
#Formbook: Quote
#StrRat: Pagamento

#mwitaly https://t.co/wHySWCusSi

693

Dmitry Bestuzhev

@dimitribest

about 2 years ago

#Notepad++ Plugin Installer Compromised: #WikiLoader #Malware Deployed https://t.co/PDLxAK8woa

Ali Aqeel @aaqeel87

about 2 years ago

@Cryptolaemus1 https://t.co/YwUDvUt1U4 20 minutes timeout to get #Wikiloader

136

Cryptolaemus @Cryptolaemus1

about 2 years ago

#WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll wscript Invoice_818493.js wscript out.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.4.portable.x64\notepad.exe (sideload)👇 \npp.8.6.3.portable.x64\plugins\mimeTools.dll (1/3) 👇 IOC's https://t.co/tTvH3jenU0

$Cryptolaemus1's tweet photo. #WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll wscript Invoice_818493.js wscript out.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.4.portable.x64\notepad.exe (sideload)👇 \npp.8.6.3.portable.x64\plugins\mimeTools.dll (1/3) 👇 IOC's https://t.co/tTvH3jenU0 https://t.co/ocwgsCVzr3$

Aura @SecurityAura

about 2 years ago

@wdormann @H4ckManac @shotgunner101 Looked at the article because I recognized that Notepad++ story. It's #WikiLoader. Would've saved a bunch of time if it had been name dropped in the original tweet, like VirusBulletin did: https://t.co/FlzX2QCp2g

Virus Bulletin @virusbtn

about 2 years ago

AhnLab's ASEC team look into a Notepad++ installation file with an altered "mimeTools.dll" plugin leading to WikiLoader. As mimeTools.dll is a basic plugin for Notepad++, it is automatically loaded when you run Notepad++. https://t.co/Th021APNr3

virusbtn's tweet photo. AhnLab's ASEC team look into a Notepad++ installation file with an altered "mimeTools.dll" plugin leading to WikiLoader. As mimeTools.dll is a basic plugin for Notepad++, it is automatically loaded when you run Notepad++. https://t.co/Th021APNr3 https://t.co/gQ9DTlBvnX

240

Cryptolaemus @Cryptolaemus1

about 2 years ago

#WikiLoader - #TA544 - .pdf > url > .zip > .wsf > .js > .dll wscript 959_Copy_03_26_2024.wsf wscript res.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.4.portable.x64\notepad.exe (sideload)👇 \npp.8.6.3.portable.x64\plugins\mimeTools.dll (1/3)👇 IOC's https://t.co/G9paSMTsRV

$Cryptolaemus1's tweet photo. #WikiLoader - #TA544 - .pdf > url > .zip > .wsf > .js > .dll wscript 959_Copy_03_26_2024.wsf wscript res.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.4.portable.x64\notepad.exe (sideload)👇 \npp.8.6.3.portable.x64\plugins\mimeTools.dll (1/3)👇 IOC's https://t.co/G9paSMTsRV https://t.co/liYT4aBjKy$

Cryptolaemus @Cryptolaemus1

about 2 years ago

#WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll wscript Inv_03_20_2024.js wscript confidential-legal.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.4.portable.x64\notepad.exe (sideload)👇 \npp.8.6.3.portable.x64\plugins\mimeTools.dll IOC's https://t.co/vEPqzLdl8r

$Cryptolaemus1's tweet photo. #WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll wscript Inv_03_20_2024.js wscript confidential-legal.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.4.portable.x64\notepad.exe (sideload)👇 \npp.8.6.3.portable.x64\plugins\mimeTools.dll IOC's https://t.co/vEPqzLdl8r https://t.co/zAdF6GFmS9$

JAMESWT @JAMESWT_WT

about 2 years ago

Too in #italy #WikiLoader - #TA544 #quickbooks "Invoice Reminder: Your payment to Allen&Overy LLP " EML>PDF>url>zip>js>js>dll ⚠️zip Url https[:]//infplaute[.]com/international-commercial ❇️Samples https://t.co/5yhkQKUueQ

JAMESWT_WT's tweet photo. Too in #italy #WikiLoader - #TA544 #quickbooks

"Invoice Reminder: Your payment to Allen&Overy LLP "
EML>PDF>url>zip>js>js>dll

⚠️zip Url
https[:]//infplaute[.]com/international-commercial

❇️Samples
https://t.co/5yhkQKUueQ https://t.co/HEH3Ap211F

Cryptolaemus @Cryptolaemus1

about 2 years ago

#WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll wscript 03_07_2024.js wscript affiliated.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.3.portable.x64\notepad.exe (sideload)👇 \npp.8.6.3.portable.x64\plugins\mimeTools.dll IOC's https://t.co/aLfH6jYLme

$Cryptolaemus1's tweet photo. #WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll wscript 03_07_2024.js wscript affiliated.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.3.portable.x64\notepad.exe (sideload)👇 \npp.8.6.3.portable.x64\plugins\mimeTools.dll IOC's https://t.co/aLfH6jYLme https://t.co/M32mXhe0zt$

14K

Cryptolaemus @Cryptolaemus1

about 2 years ago

14K

Cryptolaemus @Cryptolaemus1

over 2 years ago

#WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll wscript invoice 22-2-2024.js wscript on.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.portable.x64\notepad.exe (sideload)👇 \npp.8.6.portable.x64\plugins\mimeTools.dll (1/3) 👇 IOC's https://t.co/PonWJOHgl7

$Cryptolaemus1's tweet photo. #WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll wscript invoice 22-2-2024.js wscript on.js C:\Users\Admin\AppData\Local\Temp\npp.8.6.portable.x64\notepad.exe (sideload)👇 \npp.8.6.portable.x64\plugins\mimeTools.dll (1/3) 👇 IOC's https://t.co/PonWJOHgl7 https://t.co/kDYVgmtNi5$

HP Wolf Security @hpsecurity

over 2 years ago

📎 PDF #malware is on the rise! This quarter, 11% of malware analyzed by our threat research team was in PDF format, including a notable #WikiLoader campaign being used to deliver #Ursnif. 📦 Read our latest report for more: https://t.co/QmXGcXDJAs

Top Tweets for #WikiLoader

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users