#magicweb - Twitter Hashtag

mercury 💎🕹️ || comms open @faerie_lites

3 months ago

she convinced him to let her try out his webshooters #magicweb

venus ♡’s guy 🌷🇲🇽 @VENUIRO

3 months ago

please draw your yumeships in this pose oh my god

12

4K

466

2K

116K

0

17

2

0

346

Snow Flakes @SnowFlakesMeme

11 months ago

GM 🐻☕ I'm spending the morning with my friends — and guess what, I have a new buddy: Longman @TosinOmooluwa Coffee, fresh air, and good vibes. ✨ This image was created by the Flake s team. Follow us! #FlakeOnChain #LongmanVibes #SnowflakesOnChain #CryptoCub #MagicWeb

SnowFlakesMeme's tweet photo. GM 🐻☕
I'm spending the morning with my friends — and guess what, I have a new buddy: Longman @TosinOmooluwa
Coffee, fresh air, and good vibes.

✨ This image was created by the Flake s team.
Follow us!

#FlakeOnChain #LongmanVibes #SnowflakesOnChain #CryptoCub #MagicWeb https://t.co/9EOSKfyS5s

2

1

0

227

MagicWeb @agenceMagicWeb

over 3 years ago

🖌 MagicWeb : une nouvelle charte graphique ! 🪄✨ #magicweb #agenceMagicWeb #agenceWeb #agenceCommunication #communicationDijon #agenceDijon #webagency #dijon #bourgogne #cotedor #logo #chartegraphique #identiteVisuelle

0

1

0

Quorum Cyber @QuorumCyber

almost 4 years ago

Cyber threat group #NOBELIUM (APT29), responsible for the 2020 SolarWinds attack, has released #malware utilising a new capability that has been designated as #MagicWeb by Microsoft. For more information, you can read our #QuickInfo: https://t.co/J5soajQaFj #WeFightBullies

QuorumCyber's tweet photo. Cyber threat group #NOBELIUM (APT29), responsible for the 2020 SolarWinds attack, has released #malware utilising a new capability that has been designated as #MagicWeb by Microsoft.
For more information, you can read our #QuickInfo: https://t.co/J5soajQaFj

#WeFightBullies https://t.co/X44040teyN

0

1

0

SOC Prime @SOC_Prime

almost 4 years ago

Grab a #Sigma rule to detect the latest post-compromise tricks of the #NOBELIUM #APT leveraging #MagicWeb #malware to maintain persistent access to compromised environments. Sigma rule: https://t.co/OkVgmZKWvl #threathunting #BlueTeam #DFIR #CTI #mitre #infosec

SOC_Prime's tweet photo. Grab a #Sigma rule to detect the latest post-compromise tricks of the #NOBELIUM #APT leveraging #MagicWeb #malware to maintain persistent access to compromised environments.

Sigma rule: https://t.co/OkVgmZKWvl

#threathunting #BlueTeam #DFIR #CTI #mitre #infosec https://t.co/sm2MXO8Vv5

0

8

4

1

0

Martial Gervaise @argevise

almost 4 years ago

Des conseils de Microsoft sur la manière de renforcer les réseaux et de protéger l'infrastructure d'identité et d'authentification. #Nobelium #MagicWeb https://t.co/6hUceggqci

argevise's tweet photo. Des conseils de Microsoft sur la manière de renforcer les réseaux et de protéger l'infrastructure d'identité et d'authentification. #Nobelium #MagicWeb
https://t.co/6hUceggqci https://t.co/31uVoLHC4c

0

3

2

1

0

francescofaenzi

@francescofaenzi

almost 4 years ago

A recap of #ADFS, the land of #MagicWeb, the new #NOBELIUM #backdoor for #persistence in #Microsoft environments. BTW, remember that #Identity is the new #Endpoint (https://t.co/MQfES0rSed) * What is AD FS #ActiveDirectory Federation Services is an ide…https://t.co/ZZyMf9lJb7

0

1

0

Chi Networks @ChiNetworks

almost 4 years ago

SolarWinds Hackers Using New Post-Exploitation Backdoor ‘MagicWeb’ https://t.co/J2eC3AUIo5 via @HackRead #cybersecurity #infosec #cloudsecurity #solarwinds #hackers #magicweb #cyberthreat #cybercrime

0

2

0

Anonymous🐾🐈‍⬛ @YourAnonRiots

almost 4 years ago

#Microsoft uncovered “#MagicWeb,” a new "highly-targeted" post-exploitation #malware used by the Nobelium #APT hackers to maintain persistent access to compromised environments. https://t.co/wCvoe5ZOMR #infosec #cybersecurity #hacking #technews

0

3

0

Hackread.com @HackRead

almost 4 years ago

Beware #Microsoft has warned that the new post-compromise backdoor #MagicWeb lets hackers "authenticate as anyone." Details: https://t.co/9IaNqkxg6y #Security #Malware #BackDoor #Russia #Nobelium

0

6

3

1

0

Qintegra Consulting @QintegraC

almost 4 years ago

🟠Los investigadores de @MSFTSecurity han descubierto una herramienta llamada #MagicWeb, que es utilizada por los atacantes del grupo #NOBELIUM para mantener el acceso persistente a entornos comprometidos. #QintegraNews #ciberseguridad 👇Más detalles:👇 https://t.co/MND9MGNueL

0

6

0

Ramin Nafisi

@MalwareRE

almost 4 years ago

#MagicWeb was discovered by MSFT's Detection and Response Team (DART) in coordination with MSTIC and Microsoft 365 Defender Research during an ongoing incident response investigation. Refer to the blog for additional information including detections, mitigation, & hunting queries

0

7

0

Ramin Nafisi

@MalwareRE

almost 4 years ago

#MagicWeb hooks legitimate AD FS related methods at runtime to intercept calls to the legitimate methods and instead, execute its own custom methods. The methodology/purpose of hooking each legitimate AD FS related method is described in the blog.

MalwareRE's tweet photo. #MagicWeb hooks legitimate AD FS related methods at runtime to intercept calls to the legitimate methods and instead, execute its own custom methods. The methodology/purpose of hooking each legitimate AD FS related method is described in the blog. https://t.co/HC4NpzmuB9

1

4

0

Ramin Nafisi

@MalwareRE

almost 4 years ago

After gaining administrative access to an AD FS server, NOBELIUM edited Microsoft.IdentityServer.Servicehost.exe.config file to specify a different public token for Microsoft.IdentityServer.Diagnostics.dll, which led to loading of the backdoored version of the DLL (#MagicWeb).

MalwareRE's tweet photo. After gaining administrative access to an AD FS server, NOBELIUM edited Microsoft.IdentityServer.Servicehost.exe.config file to specify a different public token for Microsoft.IdentityServer.Diagnostics.dll, which led to loading of the backdoored version of the DLL (#MagicWeb). https://t.co/7qUsDhL1pS

1

6

0

Ramin Nafisi

@MalwareRE

almost 4 years ago

Remember #FoggyWeb (https://t.co/Jd3jYuXabk)? #MagicWeb goes beyond the collection capabilities of FoggyWeb by facilitating covert access directly. MagicWeb is a malicious DLL that allows manipulation of claims passed in tokens generated by an AD FS server.

MalwareRE's tweet photo. Remember #FoggyWeb (https://t.co/Jd3jYuXabk)? #MagicWeb goes beyond the collection capabilities of FoggyWeb by facilitating covert access directly. MagicWeb is a malicious DLL that allows manipulation of claims passed in tokens generated by an AD FS server. https://t.co/bD2NRx8MhN

1

4

0

Ramin Nafisi

@MalwareRE

almost 4 years ago

https://t.co/ab6fy4FikP We are releasing an in-depth analysis of a targeted post-compromise capability we’re calling #MagicWeb, used by #NOBELIUM to bypass all standard Active Directory Federated Services (AD FS) processes (including checks for MFA) & sign in as any user. 🧵⬇️

1

176

72

39

0