Mon - ᜋ᜔ᜈ᜔

Level 29 Human Lurker. Founder: @hackstreetboys and @pwndemanila

[Oliver Fish @_Oliver_Fish]

$300 for a bug that gives free access to OpenAI’s paid models with no API key or account.

Zero reason to report anything else I find to them.

[Gabby Roncone 🇺🇦 🇵🇸 @gabby_roncone]

Today, @Mandiant / @Google is opening up a Can o’ Sandworms. I’m incredibly proud to have led the year+ long effort with a brilliant group of colleagues to graduate Sandworm into APT44. https://t.co/XfqYByA9wR

[Hamish 🍻 @Hamsack_PTP]

@Wyss_ccg Broooooo! What a game. WHAT. A. GAME!

[DMArmada @armada_dm]

SPOILER ALERT FOR PTLA:

I had to do it. Too long for a YT short, so I guess it'll live on here. #fabtcg #protour #insane

[Mon - ᜋ᜔ᜈ᜔ @mzer0n]

@ImposeCost sad. great exercise, though! 😁

[Flipper Devices @flipper_net]

We have a limited batch of Transparent Flipper Zero. What should we do with it? 🤔

Please respond to this tweet if you are really want it. We need to measure the demand 📊

[John @Big_Bad_W0lf_]

🧵Excited to share new details on the campaign by #UNC4841 that targeted Barracuda ESGs worldwide with CVE-2023-2868. This blog highlights some of the ways UNC4841 reacted to remediation efforts as well as some of their most selectively deployed tooling.

https://t.co/X5AEYpc1G1

[Mathew @mittypk]

@Mandiant Just dropped our deep-dive analysis on the #UNC4841 🇨🇳 global espionage campaign exploiting a 0-day in Barracuda ESG appliances since OCT 2022. We include more information about how #UNC4841 responded to remediation activities
https://t.co/w5hqXv5XTy

[Jake Williams @MalwareJake]

If you're starting out in security and find the breadth of stuff you "need to know" daunting, I want to give you some perspective:
1. The field has broadened - dramatically. The "baseline knowledge" grows every year. Anyone saying otherwise is lying or uninformed. 1/

[ROOTCON @rootconorg]

ROOTCON 17 Theme!
This year's theme revolves around surveillance, privacy, and technology.

Surveillance, privacy, and technology are all closely interconnected topics that have become increasingly important in the modern world.

More details: https://t.co/j7ahPypi9x

[MDSec @MDSecLabs]

We've just published a quick write up on CVE-2023-23397, which allows a remote adversary to leak NetNTLMv2 hashes: https://t.co/xDxGwJfY2e by @domchell

[Samir @SBousseaden]

interesting #maldoc prod.doc :
- antisandbox (sleep check + doc path check)
- amsi patch
- hide b64 encoded hta (cert) in doc header

[Samir @SBousseaden]

interesting IMG sample

- wscript from lnk to trigger things
- WpnUserService service hijack (notifsvc via COM hijack for persistence/exec)
- GoRAT
- connects to cloudfront

Kamuoyunun bilgisine sunulur.img
4bc647a3ecaa2766e7cfb88021f91e0f

[Daniel Kelley @danielmakelley]

What's the best online cybersecurity course you've taken?

[ROOTCON @rootconorg]

Streamline security with shift left: A cloud approach by Avinash Jain @logicbomb_1

https://t.co/koBwfAZ9dF

[ROOTCON @rootconorg]

How Did I Get Here? I still don’t know what I’m doing: Getting into The Lifelong Adventure of Learning Cybersecurity & Incident Response by James Kainth @j3st3rjam3s

https://t.co/82EqppiQz7

[ROOTCON @rootconorg]

Microsoft Defender Will Be Defended: MemoryRanger Prevents Blinding Windows AV by @IgorKorkin and @DenisPogonin

https://t.co/7CGMTblSa7

[ROOTCON @rootconorg]

A new secret stash for fileless malware by Denis Legezo
@legezo
https://t.co/NDYXH7Fjlg

[ROOTCON @rootconorg]

AWSGoat : A Damn Vulnerable AWS Infrastructure by Jeswin Mathai @jeswinMathai , Shantanu Kale @4_r43 , and Sanjeev Mahunta @lastMinuteBoi of Pentester Academy / @ine

https://t.co/3uzlGccaC0