Adrien B

Malware research and threat intel
ex #DFIR responder at @Mandiant

[LAB52 @LAB52io]

Download our 142-page #EasterBunny report (open access):
EasterBunny: advanced espionage artifacts attributed to APT29 https://t.co/MZZ9iEhULM #APT29

[Itay Cohen 🌱 @megabeets_]

🚨BREAKING: We uncovered LANDFALL — a commercial-grade Android spyware exploiting a now-patched Samsung zero-day (CVE-2025-21042) through weaponized DNG images sent via WhatsApp, enabling zero-click compromise of Samsung Galaxy devices. 1/
https://t.co/hfTFP1MMX2

[Bill Marczak @billmarczak]

Someone's really having a lot of fun with DNG. Another (!) DNG vuln patched in 2025-10 Samsung update. Google TAG assesses surveillance vendors may have been aware of this vuln (though not presently clear if deployed ITW or not) https://t.co/vjhLnjROf9

[Seth Jenkins @__sethJenkins]

We really should be talking about this more....KASLR is just not working properly on Android right now, and it hasn't for a long time.

https://t.co/AE0vBXEcob

[Cyber_OSINT @Cyber_O51NT]

A recent analysis revealed MystRodX, a sophisticated C++ backdoor, employing dual-mode activation and advanced encryption, has been lurking undetected since 2024, posing a significant threat to network security. #MystRodX #CyberSecurity https://t.co/xrE2pK3IrU

[Lukasz Olejnik @lukOlejnik]

Meta and Russian Yandex engaged in unprecedented internet tracking practices, likely illegal with EU data protection law. Companies designed tracking systems that exploited Android's localhost socket permissions to create covert communication channels between websites and native mobile apps, bypassing Android's app sandboxing protections. Android allows any app with internet permission to listen on localhost ports without user consent, and web browsers can access these localhost interfaces. When users visit websites containing Meta Pixel or Yandex Metrica scripts, the JavaScript tracking code sends data directly to specific localhost ports (Meta uses UDP ports 12580-12585 via WebRTC, Yandex uses TCP ports 29009-30103 via HTTP). Facebook, Instagram, and Yandex apps run background services that actively listen on these predetermined ports to receive tracking data, then link this anonymous web activity to authenticated user accounts and transmit the combined data to company servers.

This technique affects billions of Android users and renders privacy protections like incognito mode, VPNs, and cookie clearing completely ineffective. Meta Pixel attempted localhost communications on over 17,000 of the top 100,000 websites, with 78% doing so without user consent. The method allows comprehensive profile building linking anonymous browsing to real identities, tracking everything from shopping to sensitive site visits. It also creates vulnerabilities where malicious apps could eavesdrop on browsing history by listening on the same localhost ports.

This surveillance operated without disclosure. Following public disclosure, Meta immediately ceased the practice and removed related code while browser vendors scrambled to implement protections.

The practice violates multiple GDPR and ePrivacy principles. The technique transforms supposedly anonymous first-party cookies into cross-site tracking identifiers without explicit consent, violating ePrivacy Directive requirements for cookie consent and GDPR's lawful basis for processing. By secretly linking web browsing to app-based identities, it constitutes undisclosed profiling that undermines user expectations and data minimization principles. This is a material for max #GDPR fine. https://t.co/ktHWwllWr4

[Ramin Nafisi @MalwareRE]

The Microsoft Threat Intelligence Center (MSTIC) is looking for malware reverse engineers and security researchers to join our team! Come join our brilliant, world-class team of malware REs and intelligence researchers:

Principal Security Researcher (United States): https://t.co/xIij8dMb17

Security Researcher (Canada): https://t.co/ZoJF2hmwnc

Additional MSTIC openings: https://t.co/YLR0y1lTGL

#mstic #reverengineering #threatintel #cybersecurity

[Microsoft Threat Intelligence @MsftSecIntel]

Based on our findings and those reported by governments and other security vendors, Microsoft Threat Intelligence assesses the Russian nation-state actor we track as Secret Blizzard has used the tools and infrastructure of at least 6 other threat actors during the past 7 years.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft identified multiple vulnerabilities in the open-source platform OpenVPN, integrated into millions of devices worldwide, which could be exploited to create an attack chain allowing remote code execution (RCE) and local privilege escalation (LPE). https://t.co/QXOprJov3u

[__mat__ @matthieu_faou]

We are looking for a strategic threat intel analyst to join @ESETresearch. Interested in cyber-espionage and geopolitics? Apply!
https://t.co/6I2tK39tsv

[George Kurtz @George_Kurtz]

CrowdStrike is actively working with customers impacted by a defect found in a single content update for Windows hosts. Mac and Linux hosts are not impacted. This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed. We refer customers to the support portal for the latest updates and will continue to provide complete and continuous updates on our website. We further recommend organizations ensure they’re communicating with CrowdStrike representatives through official channels. Our team is fully mobilized to ensure the security and stability of CrowdStrike customers.

[Victor M. Alvarez @plusvic]

Welcome to the future of YARA:
https://t.co/v3U8kcqeSu

[Virus Bulletin @virusbtn]

Trend Micro's Christopher So looks into two techniques used by Earth Freybug (a subset of APT41) in the UNAPIMON malware: dynamic-link library hijacking & application programming interface (API) unhooking to prevent child processes from being monitored. https://t.co/ZZ1XZopFds

[Greg Lesnewich @greglesnewich]

#100DaysofYARA Day 07 - another condition only rule this time looking for the HTTPSnoop and PipeSnoop families found by Talos

a little avant garde, but both store config info in the .data section, XOR'd with a 1 byte key following the same structure

https://t.co/FoK5XW2Cxz

[Thomas Roccia 🤘 @fr0gger_]

#100DaysOfYara Day 6: Yara can be used to access specific data at a given position. 👇

This feature is often used to identify Magic Numbers (used to determine the file format) to match your rule against a specific file type, such as a PE (0x4D5A), for example.

Today, no specific rule, but I'm working on creating a list of potential Magic Numbers you can use with Yara. Feel free to update, edit, and modify... It is far from perfect! 🤓

More to come 😉 #Yara

https://t.co/M57BfiUEU9

[Greg Lesnewich @greglesnewich]

#100DaysofYARA Day 6

sometimes our pals in TA404/Zinc/Temp.HERMIT/Diamond Sleet reuse export names and add a dubya ("W") to the end of the second name.

lets create a loose rule looking for duplicates like that!

Examples in the second pic thanks to Ronnie Coleman

[Aleksandar Milenkoski @milenkowski]

[1/4] Joined by @vmptrst (@PwC) and @MsftSecIntel, we release attribution information on the Sandman #APT, first revealed at @labscon_io '23.

Link 👇
https://t.co/qkdKvBM5pr

[Adrien B @Int2e_]

@greglesnewich @craiu @juanandres_gs @stvemillertime Yes Spicydoor was the name :)