Axel_jg

RIPE NCC Cert.Ekspert ds. Bezpieczeństwa IPv6
(admin1/4)
and Axelo
A.K J.G58-500

[Axel_jg @KulinskiArkadi]

Phishing
82.109.254.2(82.109.248.0/21)
AS 62468( VpsQuan L.L.C. )

https://t.co/xJzmqwYGpN

[Axel_jg @KulinskiArkadi]

windows-setup.bat
4234f544d40ccbf91b5101a6edf0a29ab0fae8a7a52c10c03eb2fc3b76b8ed2e

https://t.co/EVVyeptxzA

[Axel_jg @KulinskiArkadi]

Alerts:
procmem_yara
antiemu_wine_func
dynamic_function_loading
reads_self
dropper
injection_rwx
MD5-a8da0fb5f8e9f309f3c3b6a823c508f7
SHA-256
9d6731a1c13741e5026c2ef79aba6d1330607e71f71e66e5324c8d802d1264aa

https://t.co/DsHB3q5PgZ
https://t.co/CVd9N3XrCA

[Axel_jg @KulinskiArkadi]

@userlolxxl @jessica_ps1 @Namecheap @500mk500 @skocherhan @medsci_yb3r @UCPGoA23 https://t.co/AaSx2r25bX Indicators
033371284e50ad5b9d3dfbb2dfce67d08867eb593bf67ac335f8ed18e74d88e6
https://t.co/gvj74GhyfO
https://t.co/BS87tBevmL

[Axel_jg @KulinskiArkadi]

@Namecheap @userlolxxl @jessica_ps1 @500mk500 @skocherhan @medsci_yb3r @UCPGoA23 👍Dziękuję!

[Namecheap.com @Namecheap]

@KulinskiArkadi @userlolxxl @jessica_ps1 @500mk500 @skocherhan @medsci_yb3r @UCPGoA23 We have suspended the abusive service.

[Axel_jg @KulinskiArkadi]

@userlolxxl @CanadianPro2 @UCPGoA23 @medsci_yb3r @TeamNAIT @skocherhan Physical entities are everything that exists within space-time, possesses mass and energy, and can interact with its surroundings. Non-material entities lack mass, do not occupy space, and are not composed of atoms or energy in the physical sense.

[Axel_jg @KulinskiArkadi]

Phishing
82.109.254.2(82.109.248.0/21)
AS 62468( VpsQuan L.L.C. )

https://t.co/xJzmqwYGpN

[White Coat Black Cat @medsci_yb3r]

@userlolxxl @jessica_ps1 @Namecheap @500mk500 @skocherhan @KulinskiArkadi @UCPGoA23 Nice find…hmmmmm…give you a hint…something here doesn’t quite look right…almost like there is a pattern or something…

[userlolxxl @userlolxxl]

@jessica_ps1 @Namecheap @500mk500 @skocherhan yes! blockstamp .info resolves malic 188[.]114.96.3 https://t.co/udExDiTODz compare https://t.co/bmJmKyKtNu it seems to be cryptocoin-related stuff cc @KulinskiArkadi please if you find minute check, especially https://t.co/1AvnY2MyaS UofA @medsci_yb3r @UCPGoA23 @skocherhan

[Axel_jg @KulinskiArkadi]

@userlolxxl @medsci_yb3r @skocherhan It’s lovely to hear from you, too. Best wishes.

[userlolxxl @userlolxxl]

@medsci_yb3r @CanadianPro2 @UCPGoA23 @TeamNAIT @skocherhan @KulinskiArkadi 👇

[Axel_jg @KulinskiArkadi]

@alMansourQasimi „BTC”

[Ransom-DB @Ransom_DB]

🚨 Ransom group "Panzer" publishes "Grupa ABS" - Poland 🇵🇱

📍 Location: Częstochowa, Poland
🏢 Industry: Information Technology Services & Software Development
🔗 Website: N/A

Grupa ABS is a Polish tech company founded in 2010, providing IT services and custom software development from its HQ in Częstochowa. Serving business clients across Poland, the firm reported PLN 24.8M in 2024 revenue, reflecting a solid presence in the national IT market.

[Axel_jg @KulinskiArkadi]

Malware ip
5.101.140.80 (5.101.136.0/21)
AS 42831( UK Dedicated Servers Limited )

[Axel_jg @KulinskiArkadi]

Malicious
www.link72[.]com
link72[.]com

https://t.co/m7cAuuYmgj

[White Coat Black Cat @medsci_yb3r]

Security Threat Update for Alberta: Something is Broken

Yesterday afternoon onwards, after contacting @RCMPAlberta (Leduc Detachment) to follow up on a case (i.e. w. Officers & w. Victim Services) to ask where they would like their HR files to go & to warn of impending threats (was ultimately not provided guidance or help by the admin).

A Threat Actor affiliated w. #ShinyHunters (i.e. the messy SLSH version) went on a tear, & spread an ‘upgraded & updated’ version of BlueLeaks 2.0 (forked) across the web.

This means: @youralberta @ualberta @AHS_media AND Officer Data ( @RCMPAlberta @Edmontonpolice @CalgaryPolice @CrimeStoppersAB ) PII/PHI is currently circulating ‘in the wild’. Assessment and investigation of spread has not been conducted. @RCMPAlberta has been filled in via dm/

This is a Catastrophic and Serious risk to: Officers, those REPORTING and/or providing tips, and to VICTIMS.

If you are an officer of the law in #Alberta - please take extra care of yourselves and those you protect.

FFSS People

[Yogesh Londhe @suyog41]

Observed LLHN Stealer v2.0, advertised on a cybercrime forum, with a panel supporting browser, Discord, Steam and wallet data collection.

IOC:
• ad781dcd83ccbc4f5438525b4cd17c86

Reported capabilities include browser credential/cookie theft, Discord/Steam/Riot tokens, MetaMask data, screenshots, clipboard collection, persistence and exfiltration via Telegram, Discord webhooks and file-sharing services.

#ThreatIntel #IOC #Stealer #DFIR

[Axel_jg @KulinskiArkadi]

https://t.co/qvh5BL9zyO
de5ae2809d7e8800bff4be9bb2c03055a607952d3072729f6c02d5f309908fe4

https://t.co/4Cg5oocSB1