V

Threat Intelligence Researcher | Adversarial Infrastructure
Thanks to & for supporting my research

[V @orlof_v]

Part 2 is live 🔍

Followed the Ethereum wallet trail and found 4 more contracts, 2 live C2 domains, and a Russian comment in the source code.

The operator is actively iterating. The blockchain is forever.

https://t.co/wD03cSEolh

#ThreatIntel #Remus #EtherHiding #CTI #DFIR

[V @orlof_v]

@VECERTRadar Thanks for the update.
The Belgian centre for Cybersecurity published a bulletin about a month ago about active exploitation of a CVE affecting Joomla CMS. Could that be the entry point?

https://t.co/6NQ45WQ2eQ

[V @orlof_v]

@TomHegel Great vid but now we need to know who tipped him!

[V @orlof_v]

Blocking is one aspect but how about getting more context out of it? Grab cert information, subject fields, before-after expiration dates, check for lookalikes or similar domains based on content header/hashes, passive DNS analysis, fingerprinting etc. From there create detection rules instead of just blocking an indicator in your DB that will (or should) expire soon.

[V @orlof_v]

@MalforsHQ Finally, they kept rebranding /renaming and continued operations for far too long. Way to go! 🇳🇱

[V @orlof_v]

@IntCyberDigest Davey! 🤗

[V @orlof_v]

@ryanaraine @craiu @juanandres_gs @a_greenberg You know the episode is going to be good when you have to do homework.
Can't wait

[V @orlof_v]

🔎New blog: C2 in the Ether
🔗https://t.co/O2LwIA9mpu

Remus infostealer hides its C2 inside an Ethereum smart contract. The malware calls it at runtime, decodes the response, connects to its C2.

The immutability that makes blockchain C2 resilient is the same property that makes it permanently auditable. The attacker can't erase their history.

#ThreatIntel #Malware #EtherHiding #Remus #CTI

[V @orlof_v]

@DailyDarkWeb Netherlands and Belgium are heavily targeted lately.

[V @orlof_v]

@ryanaraine Sorry but it had to be done! 😂

[V @orlof_v]

@HaifeiLi Well done man! Thanks for the writeup and updates.

[V @orlof_v]

@EXPMON_ Congrats guys, great find!

[V @orlof_v]

@HaifeiLi Thanks for this and great work on the writeup!

[V @orlof_v]

@Proton_Pass Nice breakdown here
https://t.co/p8VmyN8qIB

Haven't changed the validity of data on all countries but the results for NL are pretty accurate.

[V @orlof_v]

Junior cybersec analysts now

[V @orlof_v]

@IntCyberDigest I respect and follow your work but that's kind of a clickbait. He didn't cure cancer.

[V @orlof_v]

@Hannan_Nozari @banthisguy9349

[V @orlof_v]

@RacWatchin8872 Nice one! Same thing happened with the lumma disruption, they reach a point where they are just too big to fail.

[V @orlof_v]

@RacWatchin8872 @g0njxa @500mk500 They also disrupted Lumma a few months back but it's still pretty active. I think your bot's job is safe

[V @orlof_v]

@loezzieloes You can use https://t.co/lb3zWYCrhR to see if your email is in the data.
If it's there, then your personal info that you provided when registering a number with Odido will be in the database.

[V @orlof_v]

📢 Digging deeper in the Odido breach and it's worse than I thought. This is huge.

ℹ️ The Saleforce DB contains 14 categaories and 335 data fields including:

- Full names, birthdates, gender, nationality, and government ID numbers
- Bank account numbers (IBANs), payment methods, billing scenarios
- Phone numbers, email addresses, fax numbers
- Full residential addresses including street, city, postal code, country
- Customer value scores, segments, brands, VIP status, churn risk
- Chamber of Commerce numbers, tax IDs, company details and more

Since Odido has not disclosed the full scope to its customers, I created an interactive catalog of all the fields found in the database.

You can view the categories and data fields below 👇
🔗 https://t.co/prqF4GN3mM

To be clear, this is a static page showing only field names. No personal data is or will be shared — the page is not connected to the actual database.

#odido #shinyhunters #databreach #netherlands #infosec