Kafeine

Sleep is a symptom of caffeine deprivation.

[Kafeine @kafeine]

Kafeine's last tweet&post.

Choose Again.
https://t.co/L6Ve7zUEc7

Over and out.

[Kafeine @kafeine]

TFW your favorite actor, Sagrid (TA543), does not come back from vacation

[Kafeine @kafeine]

Is Gootkit gone?

[Kafeine @kafeine]

Archeology: Necurs (crap2p) and its distribution.
If you are interested in what they were doing in 2011,you might want to look at this FakeRean: 7d5ea317f2d1248386b904301bb19bbde44df3e1c3d8d08cd0644fed24362e2a
cc/thx @maciekkotowicz @Antelox

[mak @maciekkotowicz]

I wrote something, it is also first public mention that i have a company and im free to hire ;]

[hadojae @switchingtoguns]

Posting malware wireshark screencaps is pretty cool, but sharing #pcap with @ET_Labs to help protect the community is even cooler.

[grsecurity @grsecurity]

@argvee @halvarflake @imaguid @dinodaizovi the future of users not having control of their own systems is a cure worse than the disease

[Stephen Hilt @sjhilt]

Today @TrendMicroRSRCH published research that me and my colleges have been hard at work on. For 6 months we ran a factory. https://t.co/KjwbQ5ApuW

[Kafeine @kafeine]

@yvesago @malwrhunterteam @Malwaredev Hello, it's Ostap into Trickbot "red4"
Ostap https://t.co/uTmxzBNqQC
C2: http[://185.234.73[.119/0jORh2/OM0n8[.php?sd=s152[...]
Trickbot: https://t.co/WjEKDs4Tw9

[hadojae @switchingtoguns]

2029206 - ET EXPLOIT Possible Citrix Application Delivery Controller Arbitrary Code Execution Attempt (CVE-2019-19781) (exploit.rules) in the @EmergingThreats OPEN set as of Dec 29th

[Kafeine @kafeine]

Unsure yet what this comeback/evolution, after 2 years missing, of Zloader/Terdot.A is about...but this is one of the emerging trend in december 2019. cc/thx @tildedennis @threatinsight

[Fumik0_ @fumik0_]

Let’s play (again) with Predator the thief https://t.co/3VdtbzNpcf

[Kafeine @kafeine]

Illustration of some ServHelper distribution for the past year (TL;DR: it's more than one actor)

[Kafeine @kafeine]

Note:TA505 != Dridex. They were massively spreading it, with, as customer, Necurs. Dridex 125 then 220 and 7200, but also Locky 3, Trickbot mac1 before moving to ServerHelper and FlawedAmmyy. Other actor are spreading Dridex. Smilex was part of the team spreading Dridex 120.

[U.S. Department of Justice @TheJusticeDept]

Russian National Charged w/ Decade-Long Series of Hacking, Bank Fraud Offenses Resulting in Tens of Millions in Losses; 2nd Russian National Charged w/ Involvement in Deployment of “Bugat” Malware. Announced w/ @NCA_UK, @StateINL, @FBI, @WDPAnews, @USAO_NE https://t.co/Qy1cu1gkzB

[Kafeine @kafeine]

Buer loader - https://t.co/FbD6OoLW5a

[Kafeine @kafeine]

@BobbyEberle13 @BobbyEberle13 gopusa is compromised. You probably want to get that clean fast. (illustration - redirect to an Exploit Kit (RIG) itself dropping a malware (Trickbot "nev3") )

[Kafeine @kafeine]

@BobbyEberle13 Hello, could you follow for a quick DM please ?

[Marc-Etienne M.Léveillé @marc_etienne_]

I don’t endorse the vocabulary in this tweet but I’d like to share our side of things and perhaps set the records straight. We never really wanted to (and still don’t want to) discredit Dragos publicly, there is really no point. 1/x

[Kafeine @kafeine]

For the records, sLoad is still dropping Ramnit "fB1oN5frGqf" in Italy.
https://t.co/8CYzCEycYj
cc/thx @reecDeep @Antelox

(cf: https://t.co/n2VqpmxB8n )

[reecDeep @reecdeep]

again 👾#sload #malware #geofenced #italy 🇮🇹

hxxps://passneet.com/cert/leultimenotizie.jpg
same c2: hxxps://rtexo.eu/view/, hxxps://nvroe.eu/view/

@JAMESWT_MHT @malwrhunterteam @matte_lodi @luc4m @vxsh4d0w @VK_Intel @gigafio

#ThreatIntel #ThreatMonitoring #Threat #infosec