medjay

IT Security

[lazarusholic @lazarusholic]

The brand-new https://t.co/GhlEI5W6nL is here! https://t.co/rYKbq3JCQ1

[Aaron Jornet @RexorVc0]

🫡 A promise is a promise, the Kindle edition of "The Art of Threat Hunting" is now available on Amazon for those who prefer reading digitally.

🙇Thank you to everyone who reached out asking for an eBook version or for those who support this kind of work, it's greatly appreciated!!

Whether you want it in paperback or Kindle format, you can buy it today on Amazon 👇

🔗Amazon: https://t.co/r1h2BQSSSC

🦖 Remember that you can find out if it's right for you at: https://t.co/xhONG9AEZl

#ThreatHunting #BlueTeam #Cybersecurity #Research #CTI

[NetAskari @NetAskari]

EXCLUSIVE: How the track foreigners in China - We got rare access to demo system developed by the Ministry of Public Security in China for the prefecture of Zhangjiakou, to track and surveil foreigners visiting or being residents ( actually it applies to most nationals as well, but in this case it seems to be aimed at foreigners ). It is officially known as "Dynamic control platform for overseas personnel". 1/12

[Thomas Roccia 🤘 @fr0gger_]

🤓 Imagine instead of reading a threat report, you can navigate through it visually, exploring technical details with diagrams that show how it works on the fly.

Well, you can already do it with this new concept called Flipbook.

I just tried it with a recent report about the Axios compromise. Check this out 👇

[MalwareHunterTeam @malwrhunterteam]

In recent weeks, more and more people retweeting or sharing shit from this BreakGlass AI thing... That in itself is a sad thing... but - unfortunately - not really surprising.
Until now, I didn't said anything about this publicly. But today, after seeing @JRoosen retweeted a tweet sharing that "quality" article + the "Official Twitter page of the 780th Military Intelligence Brigade (Cyber)" account tweeted that article, I have to ask: what the fuck is going on? Like, random people sharing random things is a thing... but more and more supposedly knowledgeable (in relation to malware/reversing/etc I mean, of course) people, and some also who not only supposedly, but seriously have knowledge are sharing these shits is not great, to say it nicely...
Anyway, the only reason I looked at that article was because when I saw the title containing "a Cardiff University GovRoam Relay", I was like "that could be something interesting if it's true, so let's just quickly look at the article and see if somehow it's true this time". So looked, and of course it turned out that it is wrong.
The article says right after "The Cardiff University Connection" that "This is the finding that prompted this writeup." - so the most important thing in the whole article is wrong.
The C2 IP (so not a domain, but an IP) of that sample is this: 151.242.152[.]131 - it has absolutely nothing to do with Cardiff University.
Also the article mentions 3 ports for that. The first two are clearly wrong, and about the third one I have no idea at all. The right base port is 4408, with a sandbox also showing traffic on port 4409 too.
😫

[rainygirl @rainygirl_]

AI 등장 이후 더 우울해진 개발자 분들 계시면 RT 눌러주세요. 전 세계에 얼마나 되는지 보려고요.

[Kristian Csepcsar @KristianCsep]

More than 10 of my bitcoin friends got hacked in the past month. All had 2FA enabled. It didn’t help. Here’s how they almost got me too 👇

HOW THEY FOOL YOU

1️⃣ Someone from your contacts messages you to schedule a call. This is already a stolen account. A friend who got scammed before you.

2️⃣ They send you a calendar invite first. Then, right before the call, they send a Zoom link. At a quick glance it looks legit. The preview looks identical to real Zoom. The trick is subtle: the hostname and subdomain are swapped.

This is the fake Zoom link they sent me. A real Zoom link would have those two words around the dot swapped.

👀 https:// zoom (DOT) webus05. us/j/47369507762?pwd=7kiAzRm6PNBvNFdBBEY04cr6LLzHPk.1

Easy to miss, even if you know what to look for. Especially when it comes from someone you trust.

3️⃣ The fake Zoom app looks flawless. Perfect copy of the real Zoom UI. No red flags.

4️⃣ You immediately see your friend on video. This is NOT A DEEPFAKE. It’s a recording of your friend from seconds before they got scammed in the previous session. That’s why it looks perfect and trustworthy.

HOW THEY GAIN CONTROL

5️⃣ The fake Zoom app says your audio is broken and asks you to update.

6️⃣ The update “fails” and you’re shown a command line troubleshooting guide.

⚠️7️⃣ If you paste that command into your terminal, it’s over. You just gave the attacker remote access to your computer.

HOW THEY ROB YOU

8️⃣ The malware they install remotely is simple and runs fast. It takes one or two seconds.

It usually does two things:

A) Scans your computer for bitcoin wallets and steals access.

⚠️B) Steals session cookies from chat apps. This is how they bypass your 2FA later.

ELI5 SESSION COOKIES

When you log into Telegram on your laptop, you enter your password and 2FA once. Telegram then saves a session token on your computer so you don’t have to do it every time. That token is basically: “Yes, this is the same person who gave you the password and 2FA earlier.” When attackers steal it, they present it to Telegram, which sees it as a valid session and lets them in.

So they don’t need your password or your 2FA code. THEY ARE YOU.

If someone gets access to your computer, you’re done. At that point, it’s just damage control.

MY GOLDEN RULE

Life is short and beautiful. No client call is important enough to mess with command line troubleshooting.

Be lazy. Be safe.

PS: unrelated, but we just launched Braiins Hashpower. On-demand bitcoin hashrate. Try it. It’s awesome. Like ice cream when you’re 12 😁

[Tay 💖 @tayvano_]

lol guys stoppppp

> contagious interview is a sophisticated multiplatforn beast operating with surgical precision

> oh yeah also it barely works and they left admin wide open (again)

[Seungjoo Kim (김승주) @skim71]

모의해킹 의무화가 아니라 전수조사 다음에는 요구사항 분석 및 설계단계에서의 위협모델링 의무화를 해야 하는 것임. FDA 가이드라인 등등 안보나?

[BSides Pyongyang @BSidesPyongyang]

Virtual conferences are revolutionizing reeducation! With BSides Pyongyang just around the corner, we're excited to bring you a day of informative talks from anywhere in the world! #BSPY25 #VirtualConferences

https://t.co/7hHKvW3r2w

[Squiblydoo @SquiblydooBlog]

DPRK has an interesting behavior with code-signing.
In this example, "DATASOLUTION Inc" was existing Korean company; they sat on the cert for years before using it.

We saw their malware and reported the cert in Sept. @GenDigitalInc wrote an analysis here:
https://t.co/UcJHCQmbci

[【쏘가리】 @ssogari_dev]

ATM에 이런게 있어도 되는건가요

[medjay @MedjayR]

@Basix1120 non-non-ActiveX 기술이 필요합니다….

[응... 시로코 내꺼 @if1live]

로그는 정말 거지같다
로그 관련 인프라를 안정적으로 운영하는 비용은 비싼데 비싼거 아끼겟다고 내리면 정작 중요한 순간에 로그가 없어서 아무것도 못한다
로그는 정말 거지같다

[Spamhaus @spamhaus]

❗ TAKE ACTION | If you’re using the free #DNSBLs and querying via KoreaTelecom’s infrastructure (@KTgmrt), you need to change your config, or from September 17th, you may face issues with your email stream.

Read why and the steps you need to take to stay protected for free in this blog ⬇️

https://t.co/dXpowyNXRQ

#FreeProtection #FreeData #KoreaTelecom

[lazarusholic @lazarusholic]

"Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey" published by ChollimaGroup. #BABYLONGROUP, #MoonstoneSleet, #DPRK, #CTI https://t.co/2bgcgoDDCT

[lazarusholic @lazarusholic]

"TraderTraitor: Deep Dive" published by @wiz_io. #Bybit, #DMM, #JumpCloud, #NPM, #TraderTraitor, #DPRK, #CTI https://t.co/ggakZuSqcD

[요즘IT @yozm_it]

💜[요즘IT 이벤트] 파이콘 코리아 2025 양일권 증정!

개발자들의 축제, #파이콘2025 @PyConKR
요즘IT가 양일권 3매를 쏩니다!

✅ 참여방법
@yozm_it 팔로우 + 이 트윗 RT (꼭!!)

📅 이벤트 기간: 7/25~7/30
(※ 참여자 수에 따라 조기 마감될 수 있어요!)

📢 당첨자 발표: 7/31
(※ 당첨 인원수 3명 / 티�� 전달을 위해 빠른 정보 회신을 부탁드립니다😉)

🔗 PyCon Korea 정보: https://t.co/Qm4Tezv6dU

[lazarusholic @lazarusholic]

"Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware" published by @silentpush. #BeaverTail, #ContagiousInterview, #InvisibleFerret, #OtterCookie, #FamousChollima, #ClickFix, #DPRK, #CTI https://t.co/uUEkpODoUq