Justin Grosfelt

Love/hate relationship with malware that leads to drinking a lot of bourbon. Thoughts are my own and you won't want them anyways.

[Jerri P @_whoisnt]

1/ We just published new research on TAG-195 (“Golden Chickens”/“Venom Spider”), documenting a major evolution of one of cybercrime’s longest-running Malware-as-a-Service ecosystems.
https://t.co/tsVcIaFk8Y

[Greg Lesnewich @greglesnewich]

Big take aways from @pivot_con :

- we disrupt to make the actor pivot 😤🔨
- [redacted]
- [redacted]
- [TLP-RED]
- [redacted]
- volleyball is much fun
- fresh fish is uniquely delicious
- [redacted]
- [TLP-RED]
- ideas shared were so good I was working on the plane ride home

[Justin Grosfelt @jgrosfelt]

Insikt Group identified two new malware families — TerraStealerV2 and TerraLogger — linked to the financially motivated threat actor Golden Chickens (also known as Venom Spider). https://t.co/eNJRJQQVwc

[Justin Grosfelt @jgrosfelt]

Freshen your breath (I know, this is horrible) with Insikts MintsLoader analysis. https://t.co/ukQNqlNjR3

[Alexander Leslie @aejleslie]

Read more! This report includes an extensive list of net new Rhysida infrastructure and so, so much more!

Huge shoutout to the entire Insikt Group team on this effort — especially @JulianVoeg, @calwarez, @theidr0p, and @jgrosfelt. Amazing work.

PDF: https://t.co/ZJ28bt52bV

[Justin Grosfelt @jgrosfelt]

For those of you who have analyzed Rhadamanthys before, Insikt Group feels your pain. We got you covered for version 0.7.0, take a break until 0.8.0 comes out. :) #rhadamanthys #insiktgroup https://t.co/Es62Bi2J2f

[c2_links @C2Links]

You too can scan for #Hodur :) Check out my latest blog inspired by @cci_forensics #MustangPanda #MaliciousInfrastructure
https://t.co/wsumMHZ8cP

[c2_links @C2Links]

Want to learn more about how to scan for malicious infrastructure? https://t.co/D031lB6xG8

[Justin Grosfelt @jgrosfelt]

@RussianPanda9xx To be honest, there are a lot of times when I look at some of the stupid things malware developers do and am like, yea, I probably would have been that stupid too. Maybe that is just me though :)

[Justin Grosfelt @jgrosfelt]

@pstirparo https://t.co/vOUBcVpcn6

[Christopher Ahlberg @cahlberg]

Thrilled to be able to continue to support Ukraine and our friends and colleagues there in the war to dislodge russia from their country. Slava Ukraini!

[Justin Grosfelt @jgrosfelt]

@TheQueenofELF @SecureWithHUMAN Congrats @TheQueenofELF !!!

[Lindsay Kaye @TheQueenofELF]

So happy to see my report on pre-ransomware TTPs for ESXi available to the public! Check it out here: https://t.co/nIx8kh6tc9

[Justin Grosfelt @jgrosfelt]

@greglesnewich

[Justin Grosfelt @jgrosfelt]

@Hacker0x01 Quick act busy, the boss is comming

[Justin Grosfelt @jgrosfelt]

Looks like I can finally sleep and enjoy weekends again :) Loved every single challenge, 8 was like a nightmare wrapped in a nightmare only to wake up in hell. Till next year! #flareon9

[avallach (@[email protected]) @xorhex]

https://t.co/twoDe3SSDX

#TA413 #LOWZERO

[Justin Grosfelt @jgrosfelt]

Gotta say, the cover graphic is pretty sick.

[Lindsay Kaye @TheQueenofELF]

This was a fun report to work on with @jgrosfelt on Sigma rules for cloud https://t.co/kWxvoyefZT

[Christopher Ahlberg @cahlberg]

Great to see ⁦@RecordedFuture⁩ next to ⁦@CISAgov⁩ at RSA - great partners as neighbors

[Justin Grosfelt @jgrosfelt]

@sudochrisahearn Fair enough, but why can’t it just all fit in one pour?

[Justin Grosfelt @jgrosfelt]

It sure would be nice to be able to pour a full container of windshield wiper fluid in my car without having the 1/5th at the bottom that I will never use