Top Tweets for #validin
Validin reveals how the Coruna iOS exploit kit evolved from targeted surveillance to mass crypto-draining and geopolitical watering hole attacks.
#Coruna #iOSExploit #CyberSecurity #ThreatIntel #Validin #InfoSec #CryptoDrainer #AppleSecurity
https://t.co/5RDy3zsdCS
@ValidinLLC I have a suspicion that api[.]equisphire[.]com is also related. Apart from the domain names looking very similar I've also summarised additional observations within the comment section on ThreatFox: https://t.co/uKqhhBbM7b
#Validin #DPRK #FakeJobPlatform
Fresh ClickFix IoC :
/clasoftmedia[.]ci
/retcap[.]eu
/rafelink[.]life
/akwatic-hotel[.]ci
/bleulab[.]ci
/gomezmontero[.]eu
/gtl[.]ci
/javiergomezmontero[.]eu
/ardiellifornasa[.]ge
#IoC #ClickFix | #ThreatHunting #Validin
cc : @500mk500 @MichalKoczwara @skocherhan @1ZRR4H
![soursec_'s tweet photo. Fresh ClickFix IoC :
/clasoftmedia[.]ci
/retcap[.]eu
/rafelink[.]life
/akwatic-hotel[.]ci
/bleulab[.]ci
/gomezmontero[.]eu
/gtl[.]ci
/javiergomezmontero[.]eu
/ardiellifornasa[.]ge
#IoC #ClickFix | #ThreatHunting #Validin
cc : @500mk500 @MichalKoczwara @skocherhan @1ZRR4H https://t.co/8GVorCeyHi](https://pbs.twimg.com/media/GwK-YG5bgAAWRbt.png)
![soursec_'s tweet photo. Fresh ClickFix IoC :
/clasoftmedia[.]ci
/retcap[.]eu
/rafelink[.]life
/akwatic-hotel[.]ci
/bleulab[.]ci
/gomezmontero[.]eu
/gtl[.]ci
/javiergomezmontero[.]eu
/ardiellifornasa[.]ge
#IoC #ClickFix | #ThreatHunting #Validin
cc : @500mk500 @MichalKoczwara @skocherhan @1ZRR4H https://t.co/8GVorCeyHi](https://pbs.twimg.com/media/GwK97qqXsAAiaiY.jpg)
#Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Bangladesh.
#Query: Potecă Topită
#IoC:
bdgov[.]info
afdinfo786[.]bdgov[.]info
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC
![volrant136's tweet photo. #Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Bangladesh.
#Query: Potecă Topită
#IoC:
bdgov[.]info
afdinfo786[.]bdgov[.]info
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC https://t.co/u6ZuatWFz7](https://pbs.twimg.com/media/Gv_tlMiXQAAWwpU.jpg)
#Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Bangladesh.
#Query:
"চাকরির খবর ২০২৫ | সরকারি ও প্রাইভেট চাকরির খবর ২০২৫ | সকল নিয়োগ সার্কুলার ২০২৫"
"আবেদন ফরম "
#IoCs:
bd-govt[.]info
bd-govt[.]com
bdgovt[.]com
brebd-govt-bd[.]online
188.114.96.0
188.114.97.0
188.114.97.3
209.74.67.30
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC
![volrant136's tweet photo. #Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Bangladesh.
#Query:
"চাকরির খবর ২০২৫ | সরকারি ও প্রাইভেট চাকরির খবর ২০২৫ | সকল নিয়োগ সার্কুলার ২০২৫"
"আবেদন ফরম "
#IoCs:
bd-govt[.]info
bd-govt[.]com
bdgovt[.]com
brebd-govt-bd[.]online
188.114.96.0
188.114.97.0
188.114.97.3
209.74.67.30
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC](https://pbs.twimg.com/media/GvhbzO3XoAAy3T0.jpg)
![volrant136's tweet photo. #Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Bangladesh.
#Query:
"চাকরির খবর ২০২৫ | সরকারি ও প্রাইভেট চাকরির খবর ২০২৫ | সকল নিয়োগ সার্কুলার ২০২৫"
"আবেদন ফরম "
#IoCs:
bd-govt[.]info
bd-govt[.]com
bdgovt[.]com
brebd-govt-bd[.]online
188.114.96.0
188.114.97.0
188.114.97.3
209.74.67.30
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC](https://pbs.twimg.com/media/GvhbplZXwAAjc3v.jpg)
#Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Pakistan, #Srilanka & #Bangladesh.
#IoCs:
pubad[.]gov[.]lk[.]mofa-govtpk[.]net
gov[.]lk[.]mofa-govtpk[.]net
cbsl[.]lk[.]mofa-govtpk[.]net
presidentsoffice[.]lk[.]mofa-govtpk[.]net
lk[.]mofa-govtpk[.]net
cabinet[.]gov[.]bd[.]mofa-govtpk[.]net
mod[.]gov[.]bd[.]mofa-govtpk[.]net
bgb[.]gov[.]bd[.]mofa-govtpk[.]net
mopa[.]gov[.]bd[.]mofa-govtpk[.]net
mofa[.]gov[.]bd.mofa-govtpk[.]net
gov[.]bd[.]mofa-govtpk[.]net
bd[.]mofa-govtpk[.]net
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC
![volrant136's tweet photo. #Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Pakistan, #Srilanka & #Bangladesh.
#IoCs:
pubad[.]gov[.]lk[.]mofa-govtpk[.]net
gov[.]lk[.]mofa-govtpk[.]net
cbsl[.]lk[.]mofa-govtpk[.]net
presidentsoffice[.]lk[.]mofa-govtpk[.]net
lk[.]mofa-govtpk[.]net
cabinet[.]gov[.]bd[.]mofa-govtpk[.]net
mod[.]gov[.]bd[.]mofa-govtpk[.]net
bgb[.]gov[.]bd[.]mofa-govtpk[.]net
mopa[.]gov[.]bd[.]mofa-govtpk[.]net
mofa[.]gov[.]bd.mofa-govtpk[.]net
gov[.]bd[.]mofa-govtpk[.]net
bd[.]mofa-govtpk[.]net
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC](https://pbs.twimg.com/media/GvheY2GXIAA7RBr.jpg)
![volrant136's tweet photo. #Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Pakistan, #Srilanka & #Bangladesh.
#IoCs:
pubad[.]gov[.]lk[.]mofa-govtpk[.]net
gov[.]lk[.]mofa-govtpk[.]net
cbsl[.]lk[.]mofa-govtpk[.]net
presidentsoffice[.]lk[.]mofa-govtpk[.]net
lk[.]mofa-govtpk[.]net
cabinet[.]gov[.]bd[.]mofa-govtpk[.]net
mod[.]gov[.]bd[.]mofa-govtpk[.]net
bgb[.]gov[.]bd[.]mofa-govtpk[.]net
mopa[.]gov[.]bd[.]mofa-govtpk[.]net
mofa[.]gov[.]bd.mofa-govtpk[.]net
gov[.]bd[.]mofa-govtpk[.]net
bd[.]mofa-govtpk[.]net
@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC](https://pbs.twimg.com/media/GvheSacWgAAtwcD.png)
#Validin #ThreatHunting | #Suspicious #website impersonating KPK Traffic Police of #Pakistan.
Query: "PAK TRAFFIC POLICE KHYBER PAKHTUNKHWA"
#IoCs:
ptpkp-govt[.]site
65.109.154.253
@500mk500 @Cyberteam008 @ginkgo_g @malwrhunterteam @ValidinLLC
![volrant136's tweet photo. #Validin #ThreatHunting | #Suspicious #website impersonating KPK Traffic Police of #Pakistan.
Query: "PAK TRAFFIC POLICE KHYBER PAKHTUNKHWA"
#IoCs:
ptpkp-govt[.]site
65.109.154.253
@500mk500 @Cyberteam008 @ginkgo_g @malwrhunterteam @ValidinLLC https://t.co/wScSAvfEOq](https://pbs.twimg.com/media/GvhiMUQX0AABx0M.jpg)
#FOFA #ThreatHunting #Validin
Interesting, #APT #Sidewinder targets #Pakistan Safe City of Islamabad.
Query: https://t.co/BgKeYSUzho
#IoCs:
safecityctd[.]com
109.248.161.210
ref:
https://t.co/STmE3sbA2i
@MichalKoczwara @500mk500 @malwrhunterteam
![volrant136's tweet photo. #FOFA #ThreatHunting #Validin
Interesting, #APT #Sidewinder targets #Pakistan Safe City of Islamabad.
Query: https://t.co/BgKeYSUzho
#IoCs:
safecityctd[.]com
109.248.161.210
ref:
https://t.co/STmE3sbA2i
@MichalKoczwara @500mk500 @malwrhunterteam https://t.co/GwtisO4JTc](https://pbs.twimg.com/media/GutbFB4WwAAMrn6.jpg)
![volrant136's tweet photo. #FOFA #ThreatHunting #Validin
Interesting, #APT #Sidewinder targets #Pakistan Safe City of Islamabad.
Query: https://t.co/BgKeYSUzho
#IoCs:
safecityctd[.]com
109.248.161.210
ref:
https://t.co/STmE3sbA2i
@MichalKoczwara @500mk500 @malwrhunterteam https://t.co/GwtisO4JTc](https://pbs.twimg.com/media/GutadUzXgAAzfKI.png)
![volrant136's tweet photo. #FOFA #ThreatHunting #Validin
Interesting, #APT #Sidewinder targets #Pakistan Safe City of Islamabad.
Query: https://t.co/BgKeYSUzho
#IoCs:
safecityctd[.]com
109.248.161.210
ref:
https://t.co/STmE3sbA2i
@MichalKoczwara @500mk500 @malwrhunterteam https://t.co/GwtisO4JTc](https://pbs.twimg.com/media/GutaW7_XQAAi5Sx.jpg)
#APT #Sidewinder targets #Islamabad Police #Pakistan.
#Query: "islamabadpolice" && host=".org"
#IoCs:
islamabadpolice[.]org
109.248.161[.]64
Ref pattern:
https://t.co/zSTua0UHBb
https://t.co/bnSXclfQEq
@MichalKoczwara @500mk500 @malwrhunterteam
![volrant136's tweet photo. #APT #Sidewinder targets #Islamabad Police #Pakistan.
#Query: "islamabadpolice" && host=".org"
#IoCs:
islamabadpolice[.]org
109.248.161[.]64
Ref pattern:
https://t.co/zSTua0UHBb
https://t.co/bnSXclfQEq
@MichalKoczwara @500mk500 @malwrhunterteam https://t.co/MHTqaeUu0d](https://pbs.twimg.com/media/GutT8KaXAAATeE_.jpg)
@dingusxmcgee @tsnikle @luke92881 @SquiblydooBlog @InvokeReversing @struppigel By using Validin to search for the SHA-1 body hash (9fa2bae3b7ff1df9b74c62308bad996502f135e3) of these pages I have found approximately 454 domains in total. They have been submitted to Urlscan and can be found using the existing search query I shared.
#TamperedChef #Validin
#Coyote::A Stealthy Attack via LNK Files
Using #Validin + JA4 to increase visibility into C2 infrastructure (where the attacker controls the target). IoC of the last stage:
18.231.248[.]162
metalgearslw[.]com ["CN: EASport Games"]
JA4S::t120200_c030_5333cdffa7d9
@ValidinLLC
![johnk3r's tweet photo. #Coyote::A Stealthy Attack via LNK Files
Using #Validin + JA4 to increase visibility into C2 infrastructure (where the attacker controls the target). IoC of the last stage:
18.231.248[.]162
metalgearslw[.]com ["CN: EASport Games"]
JA4S::t120200_c030_5333cdffa7d9
@ValidinLLC https://t.co/qG9OmJLf8N](https://pbs.twimg.com/media/GipC6_fXYAAZK4M.png)
![johnk3r's tweet photo. #Coyote::A Stealthy Attack via LNK Files
Using #Validin + JA4 to increase visibility into C2 infrastructure (where the attacker controls the target). IoC of the last stage:
18.231.248[.]162
metalgearslw[.]com ["CN: EASport Games"]
JA4S::t120200_c030_5333cdffa7d9
@ValidinLLC https://t.co/qG9OmJLf8N](https://pbs.twimg.com/media/GipCjbtWcAAv8Ua.png)
This threat documented by #Kaspersky has occurred since July/2023.
Initial Access: Spearphishing Link
Delivery URL: ja2r7[.]app[.]goo[.]gl/
First IOC: 974c83e028c5adc3c79b8f99f24cfb5e2013f108fd7259bd6a2385c35f9d8a70
#trojan #banker #Coyote #Brazil
https://t.co/dxUjPgb07H
#Validin now enumerates 28 ports for common protocols. Among other things this allows to pivot on webpaths!
Awesome 🔥
We just completed a significant upgrade to our web scanner! We added *28* of the most common and notorious ports across the routable IPv4 space, giving researchers more ways to track and discover threats within the Validin platform. Example ⤵️
Last Seen Hashtags on Sotwe
momson() nolimit()* filter:native_video
Seen from United States
analfingering
Seen from France
marasgay
Seen from Turkey
straightbait
Seen from Nigeria
TNAiMPACT
Seen from Brazil
milf bikini
Seen from Turkey
momson nolimit
Seen from Mexico
CriminalInvestigation
Seen from Brazil
omegle()*****************************************
Seen from United States
豊満熟女
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.1M followers
Barack Obama
@barackobama
119.1M followers
Cristiano Ronaldo
@cristiano
112.4M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.1M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.3M followers
KATY PERRY
@katyperry
88.7M followers
Taylor Swift
@taylorswift13
82.6M followers
Lady Gaga
@ladygaga
74.1M followers
Virat Kohli
@imvkohli
71.5M followers
Kim Kardashian
@kimkardashian
70.3M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64.5M followers
Neymar Jr
@neymarjr
64.4M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.8M followers
Selena Gomez
@selenagomez
61.8M followers
X
@x
60.8M followers