Bakeneko

Works in IT as Security consultant and Incident Responder

[Bakeneko @manictrains]

@nixcraft "Humans.... fml"

[DFIR Diva @DfirDiva]

📣 I partnered with @13CubedDFIR for a Valentine's Day Giveaway! 🎁

🏆 1 Grand Prize winner will receive one course of their choice from the list below + a 13Cubed Investigator T-Shirt.

Courses:
- Investigating Windows Endpoints
- Investigating Windows Memory
- Investigating macOS Endpoints
- Investigating Linux Devices

Each course comes with a Certificate of Completion as well as Certification attempts.

👕 5 winners will receive 13Cubed Investigator T-Shirts.

To Enter:
✅ Like
✅ Comment with the name of the course you want to win
✅ Repost

On Valentine's Day (February 14th, 2026) entries from across three social media platforms will be combined and winners will be selected.

For more info check out:

13Cubed Courses: https://t.co/xbinmzzOdI

Certification Information: https://t.co/IVM2zdyp62

T-Shirts: https://t.co/021POuAXQL

#DFIR #DigitalForensics #IncidentResponse

[Bakeneko @manictrains]

@DfirDiva @13CubedDFIR Investigating linux devices

[Bakeneko @manictrains]

@SwiftOnSecurity I've always been reluctant switching to Linux because of all the pain points that would bring.
The pain level seem to be more or less the same now, just one option is debloated and free from CoSluggish and other AI-garble jammed down ones throat.
#BringBackNotepad

[Bakeneko @manictrains]

@chrissanders88 I believe the best response I could give at this point is the following:

[Bakeneko @manictrains]

@malmoeb What is ypur preferred tool to investigate these kind of attacks?

[Bakeneko @manictrains]

@brettshavers Unfortunately I was unable to join. :\ Was the session recordeded? Also... when does the new book drop? :)

[Bakeneko @manictrains]

@malmoeb Not verified, so can't DM. But what was the initial attack vector and how long were they in the system?

[Bakeneko @manictrains]

@SecurityAura Would go along way to secure your administrative interface, such as not exposing it to the world as well.... just sayin' 😀

[Bakeneko @manictrains]

@banthisguy9349 @500mk500 @TuringAlex What is the tool displaying data in tabular format? And where is the data from for that matter? 🙂

[Bakeneko @manictrains]

@vxunderground Will you post the translated (and untranslated) leak once you have it in full? :)

[Bakeneko @manictrains]

bfcdaed93c4c3605be7e800daac4299c4aa0df0218798cb64c2e2f01027989b2 a.cmd

[Bakeneko @manictrains]

Quasar RAT delivery through ClickFix

madebyintelbroker.pages[.]dev
-> ClickFix - cmd>curl>call https://lnk1man.pages[.]dev/a.cmd
-> %temp%\\verification.txt.bat

Executes and callbacks to 193.124.205[.]56:350

SHA in comment

https://t.co/A2nZKID0cj

[Bakeneko @manictrains]

Wee! Coming for your malware shortly! :)

[Bakeneko @manictrains]

@TheFigen_ This video makes me want to play Goldeneye on Nintendo 64 again.

[Bakeneko @manictrains]

@watchtowrcyber Any thoughts on the AV as well? I see Citrix has it down as adjacent rather than network.

[Bakeneko @manictrains]

@SinSinology Ah, I figured it played some part as you showcased the defacing that particular StoreFront-endpoint in your exploit demo.

[Bakeneko @manictrains]

@SinSinology Will do. 😄👌
Fortunately StoreFront, which seems to be the target server, should not be exposed on the Internet though, but rather through NetScaler GW.

... although some people probably thought it was a good idea and exposed it anyway just because they like to live dangerous.

[Bakeneko @manictrains]

@UK_Daniel_Card What was his username? Asking for a friend.