Guy Ngongang

White hat Hacker , Digital forensics expert and malware adventurer.

[VirusTotal @virustotal]

Uncovering a Colombian Malware Campaign with AI Code Analysis

https://t.co/EkAvpD2Jn9

[Guy Ngongang @malware28]

@equant_org Why about remote collection of artefacts?

[Guy Ngongang @malware28]

Using guymager in Kali Linux
#digitalforensics
#guymager

[Nextron Systems @nextronsystems]

Persistence without malware?
Here's how attackers abuse T1547.001 using only built-in Windows tools - and how to catch them. 🕵️

🔍 https://t.co/1jrmvtDwrh

[Minoru Kobayashi @unkn0wnbit]

Unix-like Artifacts Collector (UAC) v3.2.0 has been released #DFIR

https://t.co/wZ4kvw9wf4

[Virus Bulletin @virusbtn]

The Silent Push team investigates SocGholish and its TA569 operator. SocGholish functions as a MaaS vendor, uses "fake browser update" as lures, and leverages TDSs like Parrot TDS & Keitaro TDS. TA569 acts as an IAB enabling other notorious groups. https://t.co/rnJuGZ5V0y

[Virus Bulletin @virusbtn]

ANSSI has published details about the Houken intrusion campaign, which seeks initial access to the networks of French entities through the exploitation of several zero-day vulnerabilities on Ivanti Cloud Service Appliance devices. https://t.co/6KwHGr5mCt

[Kyle Cucci @d4rksystem]

Sharing my slides from BotConf 2025: "Elephant in the Sandbox: An Analysis of DBatLoader’s Unique Evasion Techniques". If you want to learn about weird and stupid evasion techniques, then look no further.

Ps. The URL title doesn't match, I know. 😄

https://t.co/o3CiuZh55A

[Virus Bulletin @virusbtn]

Sophos researchers analyse a Lumma Stealer campaign using fake CAPTCHA sites that instructed victims to paste a (malicious) PowerShell-encoded command into Windows’ command-line interface. https://t.co/llVsnysDzM

[DFIR Training @DFIRTraining]

Autopsy 4.22.0: BitLocker Support, Cyber Triage Sidecar, Library Updates https://t.co/sOr5oDkzOe #DFIR

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Comparison of tools that extract files from #PCAP
📖 Chaosreader
⛏️ NetworkMiner
🐿️ Suricata
🌊 tcpflow
🦈 Wireshark
👁️ Zeek
https://t.co/K8r0zJpJT8

[JPCERT/CC @jpcert_en]

New Blog Post: DslogdRAT Malware Installed in Ivanti Connect Secure ^TN
https://t.co/9DwygWTmN1

[Matthew Green 🌻 @mgreen27]

Been looking at AI recently and added some Velociraptor AI capabilities:

1. Ollama and refactored Open AI enrichment artefacts . Learn more:
- Ollama: https://t.co/3soqwm7Ulu
- Open AI Enrichment: https://t.co/GEWaHYulHn

2. Proof of Concept (POC) Velociraptor MCP server.
Works fairly well in my testing but needs some finesse on context windows. Check it out here:
https://t.co/EcP6ABdVCf
@velocidex

[Clandestine @akaclandestine]

GitHub - DarkSpaceSecurity/SpyAI: Intelligent Malware that takes screenshots for entire monitors and exfiltrate them through Trusted Channel Slack to the C2 server that's using GPT-4 Vision to analyze them and construct daily activit https://t.co/oGQtoK8zC8

[Ali Hadi | B!n@ry @binaryz0ne]

Using Windows Sandbox - Course

This is another FREE course to learn howto setup and use Windows Sandbox for #malware analysis or anything you want. #DFIR #infosec #CyberSecurity

Check it out:
https://t.co/NZCNVPvXg9

[Kseniia \n @naumovax]

Just friday network tweet 👾

I decided to show you #Stealer #EncryptHub (aka #Fickle) C2 communication in network traffic in more details ⬇️
(from https://t.co/eoSvZHz3He)

Sandbox examples:
https://t.co/GeB4AAFEfn
https://t.co/IoGKt8ackQ

[Yogesh Khatri @SwiftForensics]

Found an interesting location storing wifi connect/disconnect information on #macos
#DFIR
https://t.co/RhB3ejH4mP

[JPCERT/CC @jpcert_en]

Some presentation videos from #JSAC2025 have been posted on JPCERT/CC YouTube channel! ^YU

https://t.co/hUzj29NWvl

[Steven Lim @0x534c]

Detecting Palo Alto Firewall Exploits

Palo Alto Networks has found a new firewall bug that attackers are actively using. This, along with two earlier flaws, targets unpatched PAN-OS firewalls. GreyNoise reports a rise in attack attempts, with 25 IP addresses involved.

[NetworkChuck @NetworkChuck]

Stop using ipconfig. Use this instead👇

[Lontz @lontze7]

Google dork to find #LummaStealer disguised as cracked software (games, applications and security tools)

site:https://t.co/vWHbNu0wmb intitle:Crack AND intitle:Download AND intext:"you have come to the right place"

payload servers were subdomains of saferedirect.]top