Top Tweets for #malcerts
919b0560991c6bff4ce3c8fd91fd66d84eb672287526ab163ffa1886f8ae5702
Might be a win, with some casualties? #MalCerts #APT
#CarbonOrchestrator #RussianAPT @IntezerAISOC
cc: @skocherhan @userlolxxl @KulinskiArkadi @LevelBlueCyber OTX 2096
cc: @virusfinder
https://t.co/EGl7wa1RsG
@virustotal @RecordedFuture
JFC @userlolxxl you a damn gem.
cc: @skocherhan @KulinskiArkadi @ADanielHill @petikvx @usetraceix <3
Buckle up folks - #Certificates are #Malware #Ransomware now = #MalCerts
1/vt @virustotal detections by @Maxxecure
It says trojan, but gives ‘network stealth worm FAFO energy’
- - -
cc: @TeamNAIT @UCPGoA23 [ the @nextronsystems @thor_scanner rules used to grab everything signed by them were by @albertzsigovits btw <3 ].
- - -
Available on: @virustotal @usetraceix @RecordedFuture @filescan_itsec and #Education #Government #Healthcare devices en La Provinciá de Alberta
…how to revoke…@magicswordio @unpacme = ??
![medsci_yb3r's tweet photo. JFC @userlolxxl you a damn gem.
cc: @skocherhan @KulinskiArkadi @ADanielHill @petikvx @usetraceix <3
Buckle up folks - #Certificates are #Malware #Ransomware now = #MalCerts
1/vt @virustotal detections by @Maxxecure
It says trojan, but gives ‘network stealth worm FAFO energy’
- - -
cc: @TeamNAIT @UCPGoA23 [ the @nextronsystems @thor_scanner rules used to grab everything signed by them were by @albertzsigovits btw <3 ].
- - -
Available on: @virustotal @usetraceix @RecordedFuture @filescan_itsec and #Education #Government #Healthcare devices en La Provinciá de Alberta
…how to revoke…@magicswordio @unpacme = ??](https://pbs.twimg.com/media/HWON88HbEAAHNDt.jpg)
![medsci_yb3r's tweet photo. JFC @userlolxxl you a damn gem.
cc: @skocherhan @KulinskiArkadi @ADanielHill @petikvx @usetraceix <3
Buckle up folks - #Certificates are #Malware #Ransomware now = #MalCerts
1/vt @virustotal detections by @Maxxecure
It says trojan, but gives ‘network stealth worm FAFO energy’
- - -
cc: @TeamNAIT @UCPGoA23 [ the @nextronsystems @thor_scanner rules used to grab everything signed by them were by @albertzsigovits btw <3 ].
- - -
Available on: @virustotal @usetraceix @RecordedFuture @filescan_itsec and #Education #Government #Healthcare devices en La Provinciá de Alberta
…how to revoke…@magicswordio @unpacme = ??](https://pbs.twimg.com/media/HWON88Eb0AEkPmt.jpg)
![medsci_yb3r's tweet photo. JFC @userlolxxl you a damn gem.
cc: @skocherhan @KulinskiArkadi @ADanielHill @petikvx @usetraceix <3
Buckle up folks - #Certificates are #Malware #Ransomware now = #MalCerts
1/vt @virustotal detections by @Maxxecure
It says trojan, but gives ‘network stealth worm FAFO energy’
- - -
cc: @TeamNAIT @UCPGoA23 [ the @nextronsystems @thor_scanner rules used to grab everything signed by them were by @albertzsigovits btw <3 ].
- - -
Available on: @virustotal @usetraceix @RecordedFuture @filescan_itsec and #Education #Government #Healthcare devices en La Provinciá de Alberta
…how to revoke…@magicswordio @unpacme = ??](https://pbs.twimg.com/media/HWON88EbQAAs3IX.jpg)
![medsci_yb3r's tweet photo. JFC @userlolxxl you a damn gem.
cc: @skocherhan @KulinskiArkadi @ADanielHill @petikvx @usetraceix <3
Buckle up folks - #Certificates are #Malware #Ransomware now = #MalCerts
1/vt @virustotal detections by @Maxxecure
It says trojan, but gives ‘network stealth worm FAFO energy’
- - -
cc: @TeamNAIT @UCPGoA23 [ the @nextronsystems @thor_scanner rules used to grab everything signed by them were by @albertzsigovits btw <3 ].
- - -
Available on: @virustotal @usetraceix @RecordedFuture @filescan_itsec and #Education #Government #Healthcare devices en La Provinciá de Alberta
…how to revoke…@magicswordio @unpacme = ??](https://pbs.twimg.com/media/HWON87-bUAAlbrg.jpg)
Thanks @UCPGoA23 @TeamNAIT
cc: @magicswordio @unpacme
Just 20 zips of System 32 things (all signed)
Up on @RecordedFuture TRIAGE VM & @virustotal
Lines up with @thor_scanner <3 & #YARA for detecting #MalCerts that need revocation
SHA-256: 8fecc23badd5e9e7f59a6370a208165a7a447c1bd1aa642d3686196dcc22fc02
https://t.co/nZVfvX4uA1
Nearly zero detections…annoying. #MalCerts
#YARA detections on some by @nextronsystems and some picked up by @HybridAnalysis @DeepInstinctSec too
Up on @virustotal
https://t.co/GsZgTha6oT
Also @LevelBlueCyber OTX 2096
cc: @userlolxxl @skocherhan @KulinskiArkadi @magicswordio
@medsci_yb3r @skocherhan @TheKn0ck0ut @AHS_media @userlolxxl We gave it an update (the graph). Ran out of VT credits. Links to #APT28 #VECT
Not sure what it means exactly.
@abuse_ch has our #VECT samples (we forgot to put them into VT). But all are signed. #MalCerts
Question @ADanielHill for some expertise here
[ re: #MalCerts #Certificates whathaveyou… ]
Where do #Canada #Poland #Uraguay #Slovakia #Ukraine collide?
- - -
Any relation to this below?
https://t.co/sdXlPUoTaN
- - -
Found by @userlolxxl ( one of our all-stars of @LevelBlueCyber OTX 2096 )
cc: @KulinskiArkadi
@medsci_yb3r e-factura, certificate valid until today 1 November 2026 look at certificate abitabov.crl https://t.co/gTE8TyfZpS ->Abitab SSL Organization issuser maybe @KulinskiArkadi could know more PL - CA - UY👉E67D18639367C5B29BF7A5683B56B0F0C23155C8FE9452BCFE51681436023742
@medsci_yb3r @nextronsystems @HybridAnalysis @DeepInstinctSec @virustotal @LevelBlueCyber @userlolxxl @skocherhan @KulinskiArkadi @magicswordio Here you go champ -> @cyfarelabs @RecordedFuture @TheRecord_Media @virustotal
@LevelBlueCyber OTX 2096 @magicswordio
TRIAGE VM #MalCerts #Ransomware #Persistence #Spyware #YEG #abpoli
https://t.co/2rgIv821fm
8fecc23badd5e9e7f59a6370a208165a7a447c1bd1aa642d3686196dcc22fc02
Nearly zero detections…annoying. #MalCerts
#YARA detections on some by @nextronsystems and some picked up by @HybridAnalysis @DeepInstinctSec too
Up on @virustotal
https://t.co/GsZgTha6oT
Also @LevelBlueCyber OTX 2096
cc: @userlolxxl @skocherhan @KulinskiArkadi @magicswordio
Mondays...
3/3 teams (#Canada) based (#YEG #Alberta) confirmed what we're NOT prepared for
#VECT #Avaddon #MalCerts #Certificates #abpoli #UAlberta #Alberta #Cybersecurity
@LevelBlueCyber OTX 2096 for our #Data & #Evidence (Links in ALT)
#Government #Healthcare #Education
@medsci_yb3r @TeamNAIT @skocherhan @KulinskiArkadi @userlolxxl @RecordedFuture @virustotal @MetaDefenderCLD @youralberta @ualberta @ahs_media should the @RCMPAlberta (Leduc / #YEG) get their sh*t together & look at report 2026972763 or keep letting this hit our critical infrastructure? @medsci_yb3r @albertaradios @ElectionsAB #VECT #MalCerts @abuse_ch #YARA
https://t.co/VkgyPaa3Zc
@malwrhunterteam Well if ya'll want to talk about #MalCerts #PhantomCerts #Certificates...
We got a few we're stuck on.
https://t.co/vimQRg09Uz
Pseudo-Related to...
https://t.co/nSUTKh6oLP
@medsci_yb3r @userlolxxl @skocherhan @KulinskiArkadi @TeamNAIT
Don’t Worry #Alberta: You’re safe as long as you haven’t used #Government, #Education, or #Healthcare or renewed your licenses or voted in #Alberta recently.
-Just ‘eye-balling’ it, as this sample device was connected to @youralberta @UAlberta @AHS_media
#Data & #Evidence up on @LevelBlueCyber OTX 2096
-i.e. the #Data & results myself nor 100+ other people can’t get to @RCMPAlberta or to @AlbertaNDP @NathanIpYEG
-Well that’s a pickle.
Somewhat outlined by @magicswordio here:
https://t.co/2jbFX3wI5o
@userlolxxl @medsci_yb3r @TeamNAIT @skocherhan @KulinskiArkadi @ADanielHill @RCMPAlberta @nextronsystems @nextronresearch @EFF @cybercentre_ca @cse_cst @Safety_Canada @accessnow This is just a signed ( #MalCerts ) #APT28 implant. One of many. MANY.
@TeamNAIT you said this might be @ASIRT_AB ?? Never heard of them. @medsci_yb3r any idea who they are??
@userlolxxl we think the problems are getting bigger than 3 teams in #YEG #Alberta s
Well that worked, thx @medsci_yb3r & @albertzsigovits for a good first step.
@thor_scanner loaded & remixed to track #MalCerts
@magicswordio @LevelBlueCyber OTX 2096
https://t.co/Jv7hqevIo0
https://t.co/M6O1ZooFD6
https://t.co/nkho0r8bzZ
https://t.co/xS4cbsz4U3
@MondoABx @medsci_yb3r @ElectionsAB @whiteintel_io @RockHudsonRock @YourAlberta @RebelNews_CA @GlobalEdmonton @GlobalCalgary @gilmcgowan @albertaradios @ABLabourToday @ABProsperityPrj @CanadianPro2 @CourtEllingson @RCMPAlberta @edmontonpolice @CrimeStoppersAB @CalgaryPolice @CPS_Commission One would think - we have problems piling on top of problems.
The big complication ( indirect consequence of things from @medsci_yb3r ) = #MalCerts (no need fo vulnerabilities or spooky backdoors when you have the literal keys to the front door, & a set of signed info-stealers)
@skocherhan @medsci_yb3r @ElectionsAB @whiteintel_io @RockHudsonRock @YourAlberta @RebelNews_CA @GlobalEdmonton @GlobalCalgary @gilmcgowan @albertaradios @ABLabourToday @ABProsperityPrj @CanadianPro2 @CourtEllingson @userlolxxl @KulinskiArkadi @ADanielHill NO - these are the #MalCerts #Certificates #PhantomCerts // @skocherhan @medsci_yb3r @userlolxxl @kulinskiarkadi can you elaborate for us: 1) Where these come from & 2) How to get rid of them?
https://t.co/XSr9nwA0An @virustotal
https://t.co/mc3Pwo4Gsk @LevelBlueCyber
@medsci_yb3r -> Check it bruh (@RCMPAlberta contact him for #VECT samples collected from @AHS_media infrastructure).
- - -
You will not detect it b/c they are 'signed' by #Certificates #MalCerts #PhantomCerts
- - -
Available on @abuse_ch @LevelBlueCyber OTX 2096
Hey @medsci_yb3r @skocherhan @KulinskiArkadi @UCPGoA23 @CanadianPro2 cca 4m ago we discussed #Vect #ransomware'Vect ransomgroup: IOCs coll. unit42 Paloaltonetworks' https://t.co/azjYlTEKcR check #TeamPCP IOCs https://t.co/xV0kJQkWUV =>arested https://t.co/oIwEDStUqg（￣︶￣）↗
@UCPGoA23 @TELUS @TELUSsupport @Google @GooglePixel_US @Norton @LifeLock @GenDigitalInc @YourAlberta @CrimeStoppersAB @RCMPAlberta @ADanielHill @rcmpgrcpolice @virustotal @UAlberta @NANOantivirus @LevelBlueCyber @HybridAnalysis @kaspersky Given these are signed with #Malcerts #Certificates #PhantomCerts -> Undetectable then & likely undetectable now. #UAlberta
Ditto w. the #InfoStealers they’ve got on most devices on campus (personal or otherwise).
@RockHudsonRock ->
https://t.co/qW5QdEaeom
#MALCERTS as are/were all WinCATs "The digital signature of the object did not verify" 129.2.4[.]2 AS 27 University of Maryland UNIVER-262-Z https://t.co/UCXyo03g2n https://t.co/JpPX28ApWI ❗️thanks❗️@KulinskiArkadi & 'ms..'❗️https://t.co/MzcgdwHy4K cc: @medsci_yb3r @skocherhan
![userlolxxl's tweet photo. #MALCERTS as are/were all WinCATs "The digital signature of the object did not verify" 129.2.4[.]2 AS 27 University of Maryland UNIVER-262-Z https://t.co/UCXyo03g2n https://t.co/JpPX28ApWI ❗️thanks❗️@KulinskiArkadi & 'ms..'❗️https://t.co/MzcgdwHy4K cc: @medsci_yb3r @skocherhan https://t.co/YYOzfmFAa8](https://pbs.twimg.com/media/HO7-lK5WQAAnv6z.jpg)
![userlolxxl's tweet photo. #MALCERTS as are/were all WinCATs "The digital signature of the object did not verify" 129.2.4[.]2 AS 27 University of Maryland UNIVER-262-Z https://t.co/UCXyo03g2n https://t.co/JpPX28ApWI ❗️thanks❗️@KulinskiArkadi & 'ms..'❗️https://t.co/MzcgdwHy4K cc: @medsci_yb3r @skocherhan https://t.co/YYOzfmFAa8](https://pbs.twimg.com/media/HO7-SCzWQAAKAJt.jpg)
![userlolxxl's tweet photo. #MALCERTS as are/were all WinCATs "The digital signature of the object did not verify" 129.2.4[.]2 AS 27 University of Maryland UNIVER-262-Z https://t.co/UCXyo03g2n https://t.co/JpPX28ApWI ❗️thanks❗️@KulinskiArkadi & 'ms..'❗️https://t.co/MzcgdwHy4K cc: @medsci_yb3r @skocherhan https://t.co/YYOzfmFAa8](https://pbs.twimg.com/media/HO78XQPWsAErZAM.jpg)
![userlolxxl's tweet photo. #MALCERTS as are/were all WinCATs "The digital signature of the object did not verify" 129.2.4[.]2 AS 27 University of Maryland UNIVER-262-Z https://t.co/UCXyo03g2n https://t.co/JpPX28ApWI ❗️thanks❗️@KulinskiArkadi & 'ms..'❗️https://t.co/MzcgdwHy4K cc: @medsci_yb3r @skocherhan https://t.co/YYOzfmFAa8](https://pbs.twimg.com/media/HO78OIkWQAA1jKX.png)
@userlolxxl @M_haggis @Securityblog I don’t know about that just yet @userlolxxl - We might want to increase the 7000+ number ‘just a tiny bit’. I got a whole new batch recently that errrrrr…I believe fall into the #MalCerts 2.0 category.
**Opens workstation…
**Closes workstation…
Thanks for having me @ADanielHill & friends. Ya’ll brought some joy to my day <3
1) Busy wrapping my brain around this problem here. Apparently #Certificates CAN be #Malware #Ransomware ( #MalCerts )
2) Careful playing w. those @userlolxxl @skocherhan @kulinskiarkadi -> Looks like #VECT picked up some new tricks from ‘you-know-where’…
3) #Alberta feel free to read up on #Vect RAAS - they also have your #Data & any meaningful #Evidence ya’ll are worried about. They are not some ‘Nothing-Burger’ UCP/Sep. idiot who flies to TX for whatever reason.
4) Get with the times - name & address & random ID is…how do you say…outdated ‘clickbait’?? Status on real report: @AlbertaNDP @NathanIpYEG & @CarrieTait were provided a ‘boatload of #Data’.
Still ‘tip of the iceberg’…sighhhh…
5) To help Translate…if the folks who had your #Data were a pokémon -> ooh that is so accurate.
cc: @TheBlueGem3 @TheBreakdownAB
Here are some rules to use to ‘maybe detect them’ in our #Healthcare #Government #Education systems. Your call.
Task ID:d659b36c-5984-11f1-badc-42010aa4000b
Task ID:aec501cb-5985-11f1-badc-42010aa4000b
Also for reference all ya’ll that is an ‘out-dated’ snapshot in time of ‘where your data was going’ specifically from that website. It’s been updated & put into a more dynamic/interactive format since then.
Think of it as a ‘picture in time’ of a live & ‘in-progress’ #Cybercrime
Yes and no, but I do recognize all the certs signing these. My brain is cooked. re: #Malcerts #Certificates
@malwrhunterteamam @magic@magicswordiowordio would love to chat with ya'll.
I threw together a mess of them zipped (across all the platforms).
@petikvx threw a bunch of them up for me everywhere too <3
---
They need to be burned. Burned with fire. They all @Apple @Microsoft @Google in this batch ( there are more to come...).
New link = https://wormhole[.]app/KBa8JY#dQ78Hmu107uzVwLv-kbekA (good for 24 hours)
---
-> There are a lot of them - I know
-> There be 'reasons' for that (would love to discuss)
-> I don't have the power of revocation (just yet)
They also up on @virustotal & @LevelBlueCyber OTX 2096
---
![medsci_yb3r's tweet photo. Yes and no, but I do recognize all the certs signing these. My brain is cooked. re: #Malcerts #Certificates
@malwrhunterteam @magicswordio would love to chat with ya'll.
I threw together a mess of them zipped (across all the platforms).
@petikvx threw a bunch of them up for me everywhere too <3
---
They need to be burned. Burned with fire. They all @Apple @Microsoft @Google in this batch ( there are more to come...).
New link = https://wormhole[.]app/KBa8JY#dQ78Hmu107uzVwLv-kbekA (good for 24 hours)
---
-> There are a lot of them - I know
-> There be 'reasons' for that (would love to discuss)
-> I don't have the power of revocation (just yet)
They also up on @virustotal & @LevelBlueCyber OTX 2096
---](https://pbs.twimg.com/media/G7PgGNUawAAuJhw.jpg)
Last Seen Hashtags on Sotwe
裸舞
Seen from United States
sex #hardcore #bbc
Seen from Netherlands
snapchat ()******************* filter:videos
Seen from Turkey
บางสะพานน้อย
Seen from Thailand
maurice
Seen from France
伪娘
Seen from Germany
โคราชนัดเจอ
Seen from Thailand
طيز
Seen from Qatar
แอบถ่ายสาวอาบน้ำ
Seen from Thailand
solo
Seen from Denmark
Most Popular Users
Elon Musk 
@elonmusk
240.9M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.4M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
66.4M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.6M followers