![JAMESWT_WT's tweet photo. #Booking malware
Samples Collection Updated
👇
https://t.co/ifJnZhKh0b
⛔️hxxps://ghanioilandgas.]com/ghanioilandgas.zip
cc @k3dg3 @struppigel https://t.co/DFhBKGKwK5](https://pbs.twimg.com/media/HNRJb2SXkAAoIfS.png)
![Malwarehunterr's tweet photo. Fake Windows Update page delivering a multi-stage malware loader.
The site microsoft[.]updata[.]net[.]cn instructs users to run a PowerShell command that downloads kB2025072926.exe from a Cloudflare R2 bucket.
Dynamic analysis shows kB2025072926.exe first deploys a copy of the legitimate open-source TrafficMonitor application under %AppData%\Roaming\TrafficMonitor\ (including its FAQ shortcut pointing to the official GitHub project).
It then drops a second stage under C:\ProgramData\SystemTools\,
including:
- xaweg.exe
- pnMpWI32.dll
- comsdk.dll
- Cache.pmt
xaweg.exe loads pnMpWI32.dll, which reads Cache.pmt and appears to decrypt and/or decompress it before executing shellcode in memory.
Interestingly, a @urlscanio scan from 2025 on the same fake update site shows it previously delivered WindowsUpdata.exe (SHA256: a71455506d7048f1dbbcdd48100860a8cd2088cbe4a0b3881cc8a179ce494e99), which the community associated with Amadey and Black Basta. The current sample follows a different infection chain, so further analysis is required before attributing it to the same malware family.
IOCs:
microsoft[.]updata[.]net[.]cn
pub-620def1d93ef431dbdf24616a9b11c77[.]r2[.]dev/kB2025072926.exe
%AppData%\Roaming\TrafficMonitor\
C:\ProgramData\SystemTools\xaweg.exe
C:\ProgramData\SystemTools\pnMpWI32.dll
C:\ProgramData\SystemTools\Cache.pmt
Hash:
Filename: xaweg.exe
35ae900295477f1c47edc229cd08c049fa50c1c14fab9f308868027134db778d
Filename: pnMpWI32.dll
7bb5f352f582407330bba12d2ddd15e70a3c5002fe96b7366980e644bec8a565
Filename: Cache.pmt
5a514fb0caceb37000a716df626163f5f8856bc7703adfa2bc3c1b59103c4ff4
Filename: kB2025072926.exe
b127701d2be865e3dc9417f6e0975e73b55b44906f166dc7147c9b392d008a00
#Malware #Fakeupdate #Clickfix #Threathunting @malwrhunterteam @500mk500 @skocherhan @JAMESWT_WT @James_inthe_box](https://pbs.twimg.com/media/HNNxbMTbwAArvBZ.jpg)
![Malwarehunterr's tweet photo. Fake Windows Update page delivering a multi-stage malware loader.
The site microsoft[.]updata[.]net[.]cn instructs users to run a PowerShell command that downloads kB2025072926.exe from a Cloudflare R2 bucket.
Dynamic analysis shows kB2025072926.exe first deploys a copy of the legitimate open-source TrafficMonitor application under %AppData%\Roaming\TrafficMonitor\ (including its FAQ shortcut pointing to the official GitHub project).
It then drops a second stage under C:\ProgramData\SystemTools\,
including:
- xaweg.exe
- pnMpWI32.dll
- comsdk.dll
- Cache.pmt
xaweg.exe loads pnMpWI32.dll, which reads Cache.pmt and appears to decrypt and/or decompress it before executing shellcode in memory.
Interestingly, a @urlscanio scan from 2025 on the same fake update site shows it previously delivered WindowsUpdata.exe (SHA256: a71455506d7048f1dbbcdd48100860a8cd2088cbe4a0b3881cc8a179ce494e99), which the community associated with Amadey and Black Basta. The current sample follows a different infection chain, so further analysis is required before attributing it to the same malware family.
IOCs:
microsoft[.]updata[.]net[.]cn
pub-620def1d93ef431dbdf24616a9b11c77[.]r2[.]dev/kB2025072926.exe
%AppData%\Roaming\TrafficMonitor\
C:\ProgramData\SystemTools\xaweg.exe
C:\ProgramData\SystemTools\pnMpWI32.dll
C:\ProgramData\SystemTools\Cache.pmt
Hash:
Filename: xaweg.exe
35ae900295477f1c47edc229cd08c049fa50c1c14fab9f308868027134db778d
Filename: pnMpWI32.dll
7bb5f352f582407330bba12d2ddd15e70a3c5002fe96b7366980e644bec8a565
Filename: Cache.pmt
5a514fb0caceb37000a716df626163f5f8856bc7703adfa2bc3c1b59103c4ff4
Filename: kB2025072926.exe
b127701d2be865e3dc9417f6e0975e73b55b44906f166dc7147c9b392d008a00
#Malware #Fakeupdate #Clickfix #Threathunting @malwrhunterteam @500mk500 @skocherhan @JAMESWT_WT @James_inthe_box](https://pbs.twimg.com/media/HNNxStjagAAtCLO.png)
![Malwarehunterr's tweet photo. Fake Windows Update page delivering a multi-stage malware loader.
The site microsoft[.]updata[.]net[.]cn instructs users to run a PowerShell command that downloads kB2025072926.exe from a Cloudflare R2 bucket.
Dynamic analysis shows kB2025072926.exe first deploys a copy of the legitimate open-source TrafficMonitor application under %AppData%\Roaming\TrafficMonitor\ (including its FAQ shortcut pointing to the official GitHub project).
It then drops a second stage under C:\ProgramData\SystemTools\,
including:
- xaweg.exe
- pnMpWI32.dll
- comsdk.dll
- Cache.pmt
xaweg.exe loads pnMpWI32.dll, which reads Cache.pmt and appears to decrypt and/or decompress it before executing shellcode in memory.
Interestingly, a @urlscanio scan from 2025 on the same fake update site shows it previously delivered WindowsUpdata.exe (SHA256: a71455506d7048f1dbbcdd48100860a8cd2088cbe4a0b3881cc8a179ce494e99), which the community associated with Amadey and Black Basta. The current sample follows a different infection chain, so further analysis is required before attributing it to the same malware family.
IOCs:
microsoft[.]updata[.]net[.]cn
pub-620def1d93ef431dbdf24616a9b11c77[.]r2[.]dev/kB2025072926.exe
%AppData%\Roaming\TrafficMonitor\
C:\ProgramData\SystemTools\xaweg.exe
C:\ProgramData\SystemTools\pnMpWI32.dll
C:\ProgramData\SystemTools\Cache.pmt
Hash:
Filename: xaweg.exe
35ae900295477f1c47edc229cd08c049fa50c1c14fab9f308868027134db778d
Filename: pnMpWI32.dll
7bb5f352f582407330bba12d2ddd15e70a3c5002fe96b7366980e644bec8a565
Filename: Cache.pmt
5a514fb0caceb37000a716df626163f5f8856bc7703adfa2bc3c1b59103c4ff4
Filename: kB2025072926.exe
b127701d2be865e3dc9417f6e0975e73b55b44906f166dc7147c9b392d008a00
#Malware #Fakeupdate #Clickfix #Threathunting @malwrhunterteam @500mk500 @skocherhan @JAMESWT_WT @James_inthe_box](https://pbs.twimg.com/media/HNNsOrta8AE1er-.jpg)
Olivia
Online
pandazhengzheng
@panda_zheng
Malware Analysis Expert & Threat Intelligence Expert & APT Hunter
People's Republic of China
Joined December 2014
882 Following
862 Followers
17.3K Posts
FUD 'Crypto.dll' seen from Albania @abuse_ch
3f4bc881830db866b1d2e73e178766d85fb3928afd6071e5fb8173effffcdf7a
https://t.co/EUDBl77MEb
@skocherhan
'PROPERTY LEASING AGENCY AGREEMENT.exe' seen from Cambodia @abuse_ch
8a72afcb3bdd892ae106b2e6c7bd3df4e4be98f151342509603e31d7efd555f3
https://t.co/sbJBkRZzVL
FUD Domain: zhugel5(.)com
FUD IP: 206.119.81(.)53
'AdobeFix_WRQ4CT0J.vbs' seen from Brazil @abuse_ch
e78621a003939efda0a6eab548c07a25167275be9fd70da1d4c2b8833fbff104
https://t.co/I7oJgD2DWr
Next stage:
hxxps://storage.googleapis(.)com/protesto-att/agent.msi
21e5d1db878d6830f1830e8f6675250cac209c9d8453617436ce8d1f09c1d9ae
https://t.co/jWINi0gbFR
Sample is now on VT!
🚩Hash: 3878dd5c8eba1e5b53ab2e07e7b5482e95a3fd3e98268bcd7861318bc9902376
🎯Actor name: UAT7810
🔹Comment: Cisco Talos is actively tracking infrastructure and malware associated with UAT-7810, an advanced persistent threat (APT) actor responsible for maintaining and proliferating the LapDogs Operational Relay Box (ORB) network, first disclosed by SecurityScorecard in 2025.
🌐URL: https://t.co/gL2LTSKJ5Y
🔎OnVT: https://t.co/JnpVvn4pcC
Sample is now on VT!
🚩Hash: ed2c4429cf27e19aa6881d86bc5b42c21470525564fc53be688b9b26c83db766
🎯Actor name: RUDEPANDA
🔹Comment: compromises of IIS servers with a previously undocumented malicious module which we call “HijackServer”. The associated infection chain involved the use of previously exposed ASP .NET machine keys and a ready-made toolset which notably includes a cus
🌐URL: https://t.co/0wvrt9xENa
🔎OnVT: https://t.co/2pauGK28FG
#Booking malware
Samples Collection Updated
👇
https://t.co/ifJnZhKh0b
⛔️hxxps://ghanioilandgas.]com/ghanioilandgas.zip
cc @k3dg3 @struppigel
![JAMESWT_WT's tweet photo. #Booking malware
Samples Collection Updated
👇
https://t.co/ifJnZhKh0b
⛔️hxxps://ghanioilandgas.]com/ghanioilandgas.zip
cc @k3dg3 @struppigel https://t.co/DFhBKGKwK5](https://pbs.twimg.com/media/HNRJcQkXMAAD7HP.png)
The cat’s finally out of the bag! 🐈
Proud to announce that my book, The (Un)Natural History of Malware, is now available on the @nostarch website! 📖
https://t.co/AO7XL0jPBI
✍️ Technical Analysis Published: Telegram Account Compromised, Wallet Swapped: How Does macOS Malware Break Through Your Defenses?
Our latest investigation reconstructs how a single malware sample chains together Telegram session theft, wallet database exfiltration, offline decryption and fake wallet applications into a complete account takeover workflow.
Our analysis shows:
1️⃣Stolen Telegram Desktop and Telegram for macOS session files can be restored on another Mac without re-entering a phone number, verification code or 2FA password
2️⃣For Telegram for macOS, even after server-side security mechanisms respond, cached chat history may remain accessible instead of being cleared by a forced logout
3️⃣Wallet databases can be paired with passwords collected from Keychain, browsers and Apple Notes for offline decryption, without interacting with the victim's device
4️⃣Fake Ledger and Trezor desktop apps are actually WKWebView-based loaders that replace trusted wallet interfaces with attacker-controlled phishing pages
The malware doesn't rely on a single technique—it combines authenticated sessions, encrypted wallet data and credential material into one attack chain.
💡 Defense tip: Protect your local Telegram session by enabling a Telegram Passcode and using a strong, unique password.
Full analysis and practical mitigation guidance👇
https://t.co/TCLrelsGd3
Mentioned 'interface.scpt' uploaded @abuse_ch
d44dafd48ec502e2512076ad1d66209059511292413123f87965011d5d96262e
https://t.co/Qx3MP0Q1GJ
Fake Windows Update page delivering a multi-stage malware loader.
The site microsoft[.]updata[.]net[.]cn instructs users to run a PowerShell command that downloads kB2025072926.exe from a Cloudflare R2 bucket.
Dynamic analysis shows kB2025072926.exe first deploys a copy of the legitimate open-source TrafficMonitor application under %AppData%\Roaming\TrafficMonitor\ (including its FAQ shortcut pointing to the official GitHub project).
It then drops a second stage under C:\ProgramData\SystemTools\,
including:
- xaweg.exe
- pnMpWI32.dll
- comsdk.dll
- Cache.pmt
xaweg.exe loads pnMpWI32.dll, which reads Cache.pmt and appears to decrypt and/or decompress it before executing shellcode in memory.
Interestingly, a @urlscanio scan from 2025 on the same fake update site shows it previously delivered WindowsUpdata.exe (SHA256: a71455506d7048f1dbbcdd48100860a8cd2088cbe4a0b3881cc8a179ce494e99), which the community associated with Amadey and Black Basta. The current sample follows a different infection chain, so further analysis is required before attributing it to the same malware family.
IOCs:
microsoft[.]updata[.]net[.]cn
pub-620def1d93ef431dbdf24616a9b11c77[.]r2[.]dev/kB2025072926.exe
%AppData%\Roaming\TrafficMonitor\
C:\ProgramData\SystemTools\xaweg.exe
C:\ProgramData\SystemTools\pnMpWI32.dll
C:\ProgramData\SystemTools\Cache.pmt
Hash:
Filename: xaweg.exe
35ae900295477f1c47edc229cd08c049fa50c1c14fab9f308868027134db778d
Filename: pnMpWI32.dll
7bb5f352f582407330bba12d2ddd15e70a3c5002fe96b7366980e644bec8a565
Filename: Cache.pmt
5a514fb0caceb37000a716df626163f5f8856bc7703adfa2bc3c1b59103c4ff4
Filename: kB2025072926.exe
b127701d2be865e3dc9417f6e0975e73b55b44906f166dc7147c9b392d008a00
#Malware #Fakeupdate #Clickfix #Threathunting @malwrhunterteam @500mk500 @skocherhan @JAMESWT_WT @James_inthe_box
![Malwarehunterr's tweet photo. Fake Windows Update page delivering a multi-stage malware loader.
The site microsoft[.]updata[.]net[.]cn instructs users to run a PowerShell command that downloads kB2025072926.exe from a Cloudflare R2 bucket.
Dynamic analysis shows kB2025072926.exe first deploys a copy of the legitimate open-source TrafficMonitor application under %AppData%\Roaming\TrafficMonitor\ (including its FAQ shortcut pointing to the official GitHub project).
It then drops a second stage under C:\ProgramData\SystemTools\,
including:
- xaweg.exe
- pnMpWI32.dll
- comsdk.dll
- Cache.pmt
xaweg.exe loads pnMpWI32.dll, which reads Cache.pmt and appears to decrypt and/or decompress it before executing shellcode in memory.
Interestingly, a @urlscanio scan from 2025 on the same fake update site shows it previously delivered WindowsUpdata.exe (SHA256: a71455506d7048f1dbbcdd48100860a8cd2088cbe4a0b3881cc8a179ce494e99), which the community associated with Amadey and Black Basta. The current sample follows a different infection chain, so further analysis is required before attributing it to the same malware family.
IOCs:
microsoft[.]updata[.]net[.]cn
pub-620def1d93ef431dbdf24616a9b11c77[.]r2[.]dev/kB2025072926.exe
%AppData%\Roaming\TrafficMonitor\
C:\ProgramData\SystemTools\xaweg.exe
C:\ProgramData\SystemTools\pnMpWI32.dll
C:\ProgramData\SystemTools\Cache.pmt
Hash:
Filename: xaweg.exe
35ae900295477f1c47edc229cd08c049fa50c1c14fab9f308868027134db778d
Filename: pnMpWI32.dll
7bb5f352f582407330bba12d2ddd15e70a3c5002fe96b7366980e644bec8a565
Filename: Cache.pmt
5a514fb0caceb37000a716df626163f5f8856bc7703adfa2bc3c1b59103c4ff4
Filename: kB2025072926.exe
b127701d2be865e3dc9417f6e0975e73b55b44906f166dc7147c9b392d008a00
#Malware #Fakeupdate #Clickfix #Threathunting @malwrhunterteam @500mk500 @skocherhan @JAMESWT_WT @James_inthe_box](https://pbs.twimg.com/media/HNNxfLGaQAABAox.jpg)
Some findings:
- The C2: 54.39.43[.]117 (WIN-6HTEEE5UVML)
- The TA's Firebase project: my-first-metamask-39906
- Firestore collection: wallet_Information
- Previous repo they had but was removed: hxxps://github[.]com/centrelocuslabs/Jackpot-v1/
- Victims across Italy, Belgium, and the US - all within 24 hours.
Lessons learned from here:
- Do not ever connect your crypto wallets on sketchy sites
- Take-homes and "collab repos" from any recruiter, real or fake, run in a VM. No wallets, no creds, no .env, no route back to your home network.
- The profile picture looks AI generated - do your basic OSINT and if that fails - use AI image detectors e.g. wasitai[.]com
![RussianPanda9xx's tweet photo. Some findings:
- The C2: 54.39.43[.]117 (WIN-6HTEEE5UVML)
- The TA's Firebase project: my-first-metamask-39906
- Firestore collection: wallet_Information
- Previous repo they had but was removed: hxxps://github[.]com/centrelocuslabs/Jackpot-v1/
- Victims across Italy, Belgium, and the US - all within 24 hours.
Lessons learned from here:
- Do not ever connect your crypto wallets on sketchy sites
- Take-homes and "collab repos" from any recruiter, real or fake, run in a VM. No wallets, no creds, no .env, no route back to your home network.
- The profile picture looks AI generated - do your basic OSINT and if that fails - use AI image detectors e.g. wasitai[.]com](https://pbs.twimg.com/media/HNORtfdWsAAsKbR.png)
Mentioned SYS sample uploaded @abuse_ch
30e56fa70fb5db453cb60d95a3846fe1b0414e8c20bf236e2f2f5d52c1e5c187
https://t.co/oYZwI8Vl7q
#NorthKorea #APT37 #RokRAT
Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2
https://t.co/vwPH3x694y
e5c9bb3938f2a24e755ee39073fc3aca
5.180.208[.]57
5.180.208[.]60
89.147.101[.]197
89.187.161[.]220
160.238.37[.]95
160.238.37[.]100
![cyberwar_15's tweet photo. #NorthKorea #APT37 #RokRAT
Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2
https://t.co/vwPH3x694y
e5c9bb3938f2a24e755ee39073fc3aca
5.180.208[.]57
5.180.208[.]60
89.147.101[.]197
89.187.161[.]220
160.238.37[.]95
160.238.37[.]100 https://t.co/kuw06g8Pl7](https://pbs.twimg.com/media/HNEBqM3aYAAJrgW.jpg)
Observed activity associated with Sidewinder APT.
Lure document:
• Letter of Enquiry - CEH Certification Training.docx
• 25b31199ae7689b19839cf71387c98a5
Observed C2 infrastructure:
• ceh[.]download-msoffice[.]com
#Sidewinder #APT #IOC
'ការផ្លាស់ប្តូរថ្មីចំពោះលេខកូដ QR របស់ ABA.rar' seen from Cambodia @abuse_ch
ad6b7658635192bbbb428c0b8b78db842c7d4f3501a4998cd69def8a1fa84b20
https://t.co/qMmQShPmO3
FUD Domain: xieerbi2(.)com
UEFITool / UEFIExtract / UEFIFind NE A75
- more bugfixes for various issues here and there
- further improved Insyde FlashDeviceMap parser
- search for text in information sections
- AMD parser is still not re-enabled, work in progress
https://t.co/rhOheILg8s
'AGGT-N012141 zip' seen from China, Taiwan and Hungary @abuse_ch
File with VHDX extension in it.
36676e250845e80680378907fc59be007fabf6eb8967994cbd5c16fbf69893d6
https://t.co/0yYlkN6CBX
Another related #ValleyRAT sample @abuse_ch
b6f8ec01b7013b192407828582b36f89e4d8bb23a2470fdda9fa5ed401b40932
https://t.co/buNHpHXHFK
'zadost O Cenovou Nabidku Unitex Intex Service Prague, Czech Republic 07092026.gz' seen from Czech Republic @abuse_ch
4003ca6885cba04a837e4cd8954289aa19a8c9b857889c422bdc9ccaf66e0533
https://t.co/iMYmxBqnEl
IP: 94.198.96(.)164
Last Seen Users on Sotwe
Stepdaughter
Seen from Canada
小蛇 
Seen from Vietnam
Nai 💪🏻
Seen from Vietnam
Prince~プリンス (Zay)
Seen from Australia
KONYALI AZGIN
Seen from Turkey
yangviral
Seen from Singapore
Lanny 🏳️⚧️
Seen from Kuwait
thích mbbg
Seen from Vietnam
ibu budi
Seen from Indonesia
🔱35 K 🔞 PAYLAŞIM SAYFASI🔞 🔱🔞 🔱
Seen from Turkey
Most Popular Users
Elon Musk
@elonmusk
241M followers
Barack Obama
@barackobama
119.2M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Cristiano Ronaldo
@cristiano
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.2M followers
KATY PERRY
@katyperry
88.3M followers
Taylor Swift
@taylorswift13
82.2M followers
Lady Gaga
@ladygaga
73.7M followers
Virat Kohli
@imvkohli
70.9M followers
Kim Kardashian
@kimkardashian
70.1M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64.2M followers
Neymar Jr
@neymarjr
63.8M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.8M followers
Selena Gomez
@selenagomez
61.4M followers
X
@x
60.8M followers