higefox

My tweet are focusing Cyber Security related. Opinions are my own. My favorite keywords are DFIR, REM, APT, OSINT, YARA, CTI. @[email protected]

[Volexity @Volexity]

.@Volexity recently released GoResolver v1.4, bringing significant updates to our #opensource tool for recovering symbol data from obfuscated Go binaries. This release is available on GitHub: https://t.co/vW6Xua87Y3 [1/8]

[ぴんく @PINKSAWTOOTH]

マルウェア解析のLLMベンチマークやっている人いた
https://t.co/b4MN6fxIsX

[田中ザック (Zach Mathis) @yamatosecurity]

Unit 42/DFIR ReportのDFIRプロ、Renzon (@r3nzsec) が(Intel/ARM) MacネイティブのCSVタイムライン分析ツール IRFlow Timeline をリリース！🎉🥳

CSVだけでなくTSV/XLSX/EVTX/Plasoにも対応。イメージは“Timeline ExplorerのMac版”だけど、アナライザーも豊富で圧倒的に優秀！💪
ずっと欲しかったツール…嬉しい…🥹🙏 #DFIR

🔗 https://t.co/iczzGaD7NV
🔗 https://t.co/RuZE1m5KMe

追伸：TEは約1GBまでだけど、IRFlow Timelineは約20GBまでインポート可能（それを超えるとクラッシュするので、その場合はTimesketch等のSIEMに…）

[DirectoryRanger @DirectoryRanger]

DFIR4vSphere. PowerShell module collects logs and forensics artefacts on both ESXi hosts and the vCenter console, by @ANSSI_FR
https://t.co/JronMUzwSN

[Victor M. Alvarez @plusvic]

I'm happy to introduce the official YARA language server for Visual Studio Code.
https://t.co/FptFOFZvgG

Many thanks to Albert Tikaiev for putting the first stone in this initative (https://t.co/fsAMenmkea)

[Brett Shavers 🙄 @brettshavers]

An Attribution Framework in #DFIR.
https://t.co/792Cy3RFnc

[0xor0ne @0xor0ne]

pyghidra-mcp: headless Model Context Protocol (MCP) server for Ghidra by @clearbluejar

Blog post: https://t.co/sSqlJnxbDL

Repository: https://t.co/reNui9NTmM

#infosec

[Victor M. Alvarez @plusvic]

YARA-X is now stable! https://t.co/3W02P8sQ9o

[Inoreader @Inoreader]

Pocket may be shutting down, but your saved articles don’t have to go. Bring them over to Inoreader and keep reading without interruption!

Learn how to transfer your articles from Pocket in just a few steps 👇

https://t.co/ME7dBs8S4P

[Cookie Connoisseur @browsercookies]

DPRK

[higefox @higefox]

Announcing the Official Parity Release of Volatility 3!
https://t.co/wxHkz99j1J
Volatility 3 has reached feature parity; Volatility 2 is now deprecated.

[higefox @higefox]

I also remember struggling with mounting LVM. It seems there are tools available now.
https://t.co/XXkLz1LruO

[Victor M. Alvarez @plusvic]

YARA-X v0.14.0 has ben released! https://t.co/1rVneFLYzE

[x64dbg @x64dbg]

11 years after XP's end-of-life we have decided to completely stop supporting operating systems older than Windows 10.

The project will slowly transition to Visual Studio 2022 and Qt 5.15 with CMake, to make it easier for new people to contribute. Exciting updates are coming!

[hasherezade @hasherezade]

#PEbear (https://t.co/kmOynDCBFU) is now available via WinGet (https://t.co/g7XyM84ElQ)! You can install it easier than ever - just type: `winget install pe-bear` from Powershell.

[Costin Raiu @craiu]

🚨 New i-Soon C2 infrastructure from DOJ indictment:

Domains (Namecheap, hosted at Choopa/Vultr):

* ecoatmosphere[.]org
* newyorker[.]cloud
* outlook.newyorker[.]cloud
* heidrickjobs[.]com
* maddmail[.]site
* asiaic[.]org

IPs:

* 40.82.48[.]85
* 45.77.132[.]157
* 149.28.66[.]186
* 140.82.48[.]85
* 149.248.57[.]11
* 95.179.202[.]21
* 45.61.136[.]31
* 104.168.135[.]87

Details: https://t.co/9vYzyn406r #CyberSecurity #APT #iSoon

[AhnLab Security Information @AhnLab_SecuInfo]

Larva-24005, 한국·일본 대상 피싱 공격 수행
#Kimsuky 하위 그룹인 Larva-24005가 국내 서버를 침해하여 피싱 인프라를 구축하고 북 연구 종사자 및 대학 교수를 표적으로 삼아 공격을 수행하고 있습니다.

자세히 보기: https://t.co/ZvZdUftYfF
안랩 위협 관리 분류 체계: https://t.co/uCuEjUmMqa

[CHA Minseok(Jacky) @mstoned7]

Larva-24005 (Kimsuky) sent phishing emails to Japanese people. My colleague wrote a post analyzing the server that sent the phishing mail.
https://t.co/7fGB91QiwH (Korean)

[higefox @higefox]

FBI refers to this specific North Korean malicious cyber activity as "#TraderTraitor."

[higefox @higefox]

Alert Number: I-022625-PSA
February 26, 2025
North Korea Responsible for $1.5 Billion Bybit Hack
https://t.co/GHgvyYhATr