Jeffrey Sman

Security Researcher @Trellix | Flying paragliders and single engine airplanes 👨🏻‍✈️ | Hobby barista ☕

[Trellix @Trellix]

Our action-packed Ransomware Detection & Response Virtual Summit is happening next month! Bolster your cybersecurity posture with CISO Harold Rivas, cover the anatomy of a ransomware attack with @TrellixARC’s @John_Fokker, and so much more on 8/24. https://t.co/qnQHwf6YQr

[Trellix @Trellix]

Attending #BHUSA? Catch #TeamTrellix onsite 👇

🦹 8/9, 12:40 pm: Gain insights from the Genesis Market takedown

🚀8/9, 4 pm: Leverage the SHAREM Shellcode Analysis Framework

Browse sessions: https://t.co/ACYiOaMTji

[The Brofessor @Glacius_]

Hey :)

New blog post detailing Raccoon V1 management infrastructure (victim storage location, Telegram update server, etc), MaaS infrastructure location + link to CC2BTC marketplace.

Once again, feedback warmly-welcomed 😄

[Jambul Tologonov @j_tologon]

Despite the news of #Conti's death, @TrellixLabs observed a new #ESXi Conti sample similar to the one we analysed here https://t.co/70iNmnzBqY
This Linux sample (https://t.co/DaDM90zyyF) has an embedded URL (containing victim's ID) to Conti Recovery service site which is online:

[Raj Samani @Raj_Samani]

Update on the prevalence of Conti #ransomware - we are seeing activity in 22 countries + multiple sectors. We have included Yara rules/KB articles here: https://t.co/3S7zMyPeHN #cybersecurity #malware H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker @JCMarques15

[Raj Samani @Raj_Samani]

We are seeing prevalence of indicators associated with the Gamaredon Group in 7 countries, including UK, US, Italy - more details/IoCs here: #cybersecurity #malware https://t.co/3S7zMyPeHN H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker @JCMarques15

[Raj Samani @Raj_Samani]

Prevalence of indicators associated with WhisperGate seen in more countries than just Ukraine. Observed countries now stands at 18. more details/IoCs here: https://t.co/3S7zMyPeHN #cybersecurity #malware H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker @JCMarques15

[Steve Povolny (he/him) @spovolny]

Our passion project lives on with Trellix, as we introduce ATR's second annual capture the flag! Upgraded with a theme, discord and all new challenges for all skill levels and interests! Register now- the CTF starts at 11:59pm Friday, Feb 11!
https://t.co/kQ6zLqtqH6
#trellix #atr

[Raj Samani @Raj_Samani]

We recently published details of an espionage campaign that compromised PMOs of a nation - prevalence of indicators however reveal activity in 10 countries. More details/IoCs here: https://t.co/3S7zMyPeHN H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker @JCMarques15

[Raj Samani @Raj_Samani]

Appears increased activity associated with #WhisperGate with prevalence of indicators now detected in 14 countries. More details/tracking available here: https://t.co/3S7zMyPeHN #cybersecurity #malware H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker @JCMarques15

[Raj Samani @Raj_Samani]

Kudos to the team publishing the destructive #malware targeting the Ukraine into Insights. Prevalence reveals 5 countries targeted (inc UA): https://t.co/3S7zMyPeHN #cybersecurity #infosec H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker @JCMarques15 @ChristiaanBeek

[Raj Samani @Raj_Samani]

Activity associated with #log4j remains particularly prevalent - we see indicators across 72 countries and multiple sectors. more details here: https://t.co/3S7zMyPeHN #malware #cybersecurity #infosec H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker @JCMarques15

[Raj Samani @Raj_Samani]

Conti #ransomware remains particularly active with indicators detected in 22 countries - we have Yara rules, IoCs, and KBs here: https://t.co/3S7zMyPeHN #malware #cybersecurity #infosec H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker

[Raj Samani @Raj_Samani]

Activity from the Moses Staff not limited to Israel - Prevalence of indicators reveal activity in 8 countries including US, Italy, Germany. More details/IoCs here: https://t.co/3S7zMyPeHN #malware #cybersecurity H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker

[Raj Samani @Raj_Samani]

Escalated activity from the FIN12 Threat group - The financially motivated actor now prevalent in 10 countries. More details/IoCs here: https://t.co/3S7zMyPeHN #malware #cybersecurity H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker

[Raj Samani @Raj_Samani]

My latest blog looks at the fracturing of relationships between #ransomware developers and affiliates. Gotta say, pretty satisfying to see!! https://t.co/zbisASchw1 via @helpnetsecurity #malware #cybersecurity #infosec

[Jeffrey Sman @Jeffrey_Sman]

@fr0gger_ @McAfee_ATR @Raj_Samani @ChristiaanBeek @John_Fokker @Glacius_ @ValthekOn @spovolny @w3knight @dfirence @Security_FAQs @aboutsecurity @LeandroNVelasco Best of luck with the next chapter in your career!

[Raj Samani @Raj_Samani]

Active exploitation of the RCE vulnerability classified under CVE-2021-40444 is being observed in 18 countries inc, US, UK, Ireland, Israel. More details here: https://t.co/3S7zMyPeHN #malware #cybersecurity H/T @Jeffrey_Sman @Glacius_ @_Fritto_ @tim_hux
@John_Fokker

[Raj Samani @Raj_Samani]

There is a fundamental change in the affiliate model associated with #ransomware as-a-service. Our latest @McAfee_ATR blog details former affiliates of Babuk, known as Groove: https://t.co/zElN3zFVd5 #malware #cybersecurity H/T @John_Fokker @Glacius_ @Libranalysis @Intel471Inc

[Max 'Libra' Kersten @Libranalysis]

Together with @John_Fokker, @Glacius_, and with help from @Intel471Inc, we wrote about the recent developments of the Groove gang, combined with a trend we observed in the RaaS landscape: https://t.co/SurSgSsesx