J6n_____

[Hacking Articles @hackinarticles]

🔥 Windows DFIR Artifacts MindMap

🔥 Telegram: https://t.co/upuP8k8ckB
✴️ Twitter: https://t.co/Za7rYILz6E

🕵️ Windows Forensics = knowing where the evidence lives.

This cheat sheet brings together 100+ Windows DFIR artifacts that can help investigators reconstruct system and user activity.

🔍 Key areas covered:

🧩 Registry Hives & Keys
📜 Windows Event Logs
⚙️ Persistence Evidence
🚀 Program Execution
👤 User Activity
🌐 Network & Lateral Movement
📁 NTFS Artifacts
💾 Databases & Application Artifacts
🧠 Memory Dumps
🔐 Authentication & Security Logs
📦 Browser & Office Artifacts
🗑️ Recycle Bin & File System Evidence

⭐ Artifacts worth knowing:

🟢 Prefetch
🟣 SRUM
🔵 $MFT
🟡 Amcache
🟠 Memory Dumps
🔴 AppLocker Events
🟢 PowerShell Logs
🟣 Jump Lists
🔵 ShellBags
🟡 Registry Hives

🎯 Perfect reference for DFIR, SOC analysts, threat hunters, incident responders & Windows forensic investigators.

📌 Save this cheat sheet.
🔁 Repost to help another DFIR practitioner.

#DFIR #DigitalForensics #WindowsForensics #CyberSecurity #ThreatHunting #IncidentResponse #SOC #BlueTeam #InfoSec #CyberDefense

[Hacking Articles @hackinarticles]

🚨 LOTTunnels — LIVING OFF THE TUNNELS 🔥

🔥 Telegram: https://t.co/upuP8k8ckB
✴️ Twitter: https://t.co/Za7rYILz6E

Attackers don't always need custom infrastructure.

Sometimes, legitimate tunneling services can become part of the attack chain. 🌐⚔️

LOTTunnels is a community-driven project documenting digital tunnels that can be abused for:

🔹 Access
🔹 Shell Access
🔹 Data Exfiltration
🔹 Persistence
🔹 Phishing
🔹 Payload Download

The catalog includes tools/services such as:

⚡ ngrok
⚡ Cloudflared
⚡ https://t.co/0p5W7wIUmY
⚡ LocalXpose
⚡ PageKite
⚡ Pinggy
⚡ Serveo
⚡ Tmate
⚡ TunnelTo
⚡ VSCode Tunnels

🎯 Why should Red Teamers & Defenders care?

Tunneling can create legitimate-looking network traffic while providing paths for remote access, command execution, or data movement.

For defenders, these services should be part of attack-surface discovery, detection engineering, and network monitoring.

🔗 Explore LOTTunnels:
https://t.co/NavsvQ5z4s

📌 Bookmark this resource for your next Red Team / Blue Team / Threat Hunting research.

⚠️ Use these techniques only in authorized environments.

♻️ REPOST & SHARE with your cybersecurity community!

#LOTTunnels #LivingOffTheLand #CyberSecurity #RedTeam #BlueTeam #ThreatHunting #Pentesting #C2 #NetworkSecurity #InfoSec

[Hunt.io @Huntio]

📌 From Exposed Infrastructure to Nuclear and Naval Targets

Two weeks ago, we published one of those investigations that’s worth coming back to.

Attack Capture surfaced an open directory containing custom scripts, offensive tooling, and stolen data tied to a Philippine nuclear research body and a marine engineering company serving the Philippine Navy.

The activity involved known ownCloud and WordPress vulnerabilities, credential brute-forcing, and carefully organized stolen material.

A recovered CSV also pointed to roughly 9 GB of data stolen from the nuclear agency and evidence suggesting a possible third victim.

Check out the full article here 👉 https://t.co/jtxB58TYeH

#ThreatHunting #ThreatIntel #CyberSecurity

[Unit 42 @Unit42_Intel]

Fake IT support campaign delivers a malicious MSI that sideloads a trojanized DLL via a signed binary, then uses WMI to launch a custom reverse shell tunneled over a local port (localhost:9001) to an AWS API Gateway C2. Detection and indicators: https://t.co/821NAc1bSo

[Tom Dörr @tom_doerr]

ISO 27001:2022 toolkit for ISMS implementation

https://t.co/MHUjtlUHro

[Cyber Detective💙💛 @cyb_detective]

China Web OSINT Search Dorks

Guide by ArgeliusLabs:

A practical China OSINT workflow
Baidu search syntax and operator behavior
People and professional-biography dorks
Government, regulatory, and licensing dorks

and more.

https://t.co/jBN1jxvo3D

[hiro_ @papa_anniekey]

#Splunk #Exploit CVE-2026-20253な攻撃、現在も断続的に観測しています。少しパラメータを変化させたりして試行錯誤している様子。狙いはpsqlのpasswd
C2: 45.79.238\.166
#Fortigate のCustom Sigも順調！公式リリースは未？よかったら使ってください↓
https://t.co/VTeAeod8df

[Dark Web Intelligence @DailyDarkWeb]

🇹🇭 Thailand Union Auction Database Allegedly Offered for Sale

A threat actor is advertising the sale of a database allegedly belonging to https://t.co/qn6vIgYy6N (Union Auction).

* Union Auction is a major vehicle and asset auction company operating in Thailand.
* The seller claims the dataset contains 12,059 registered member records.
* The database is reportedly available in JSON or CSV format.
* Sample data shown in the post appears to reference bidder information, account identifiers, user details, and other member-related records.
* No independent verification has been provided to confirm the authenticity or scope of the alleged dataset.
* The post suggests the data is being offered directly to interested buyers on a cybercrime forum.

Analyst Note: Although the claimed record count is relatively small compared to large-scale breaches, auction and marketplace platforms often contain identity, contact, and financial-related information that can be leveraged for fraud, account takeover attempts, and targeted phishing campaigns.

#DDW #Intelligence #DarkWeb #Thailand

[Mohamed Alzhrani @0xMaz]

Hello guys،

Do you want to Bypass all production EDR ?

Read my new research to enjoy in kicking EDRs defenses.

https://t.co/Y0QMWXM9GZ

The proof-of-concept implementation is available at https://t.co/CAUeRcumK5

#Maldev

[Dark Web Informer @DarkWebInformer]

Matkap: A Python OSINT tool for hunting exposed malicious Telegram bot tokens and chat IDs via FOFA and URLScan, then analyzing or exporting captured bot activity.

GitHub: https://t.co/ECExxHF9ux

Credit: @0x6rss

[International Cyber Digest @IntCyberDigest]

‼️🚨 This is alarming: Researchers found a one-click data exfiltration vulnerability in M365 Copilot. A single click on a trusted microsoft[.]com link let attackers pull emails, MFA codes, meeting notes, and SharePoint/OneDrive files, no permissions or second click required.

Microsoft has patched it as CVE-2026-42824, rated critical.

[Steven Lim @0x534c]

🆕 NightmareEclipse Bitlocker Bypass 0-Day Detection

GreatXML is a Windows zero‑day that bypasses BitLocker by abusing the Windows Recovery Environment (WinRE) and Defender Offline Scan workflow, allowing an attacker to gain an unrestricted shell and access encrypted drives without credentials.

Here's a GreatKQL to compliment the detection 🤭

https://t.co/DfFnZMnZqb

#Cybersecurity #NightmareEclipse #GreatXML #GreatKQL

[Dark Web Intelligence @DailyDarkWeb]

🇹🇭 Alleged Thailand Citizen Database Offered for Sale

A threat actor is advertising what they claim to be a database containing information on approximately 36.1 million Thai citizens.

* According to the listing, the dataset allegedly contains:
* Full names
* Phone numbers
* National ID card numbers
* Dates of birth
* Gender information
* Physical addresses

* The seller claims the records represent roughly 50–70% of Thailand's adult population.

* The actor further alleges the information was collected from multiple sources, including government agencies and private-sector organizations.

* The dataset is reportedly being offered for sale for $100,000 in Monero (XMR).

* At the time of publication, Daily Dark Web could not independently verify:
* The authenticity of the dataset
* The source of the records
* The claimed number of affected individuals
* Whether the data is current, aggregated, or recycled from previous breaches

* No independently verifiable evidence was provided publicly to substantiate the full scope of the claim.

Analyst Note:

If legitimate, a dataset of this scale would represent one of the most significant exposures of Thai citizen information observed on underground forums. Large national identity datasets are frequently leveraged for identity fraud, SIM-swap attacks, financial scams, account recovery abuse, and highly targeted social engineering operations. Claims involving tens of millions of citizens should be treated with caution until validated through technical analysis and corroborating evidence.

#DDW #Intelligence #DarkWeb #Thailand

[Co11ateral @co11ateral]

Evading Detection with Nezha - Persistence

Nezha is a RMM that can be abused to maintain persistence. Highly customizable. Doesn't show up in the tray. The name of the service, executable and other things can be changed. In fact, hackers can easily change the installation script and host it on their infra.

The Defender doesn't have any problem with it.

That's what makes it so dangerous. We also included the forensic artifacts that can help you detect it.

Learn more: https://t.co/8np8jXJSuy

@three_cube @_aircorridor
#apt #redteam

[Steven Lim @0x534c]

EDRChoker has been apprehended 😅

@TwoSevenOneT - Game over for MDE

#Cybersecurity #Threatdetection #RedTeam #EDRChoker

[Anurag @Malwarehunterr]

🚨 Fake Google Meet site distributing Remcos RAT.

Victims are presented with a fake Google Meet page, prompted to "update" their client, and instructed to bypass Microsoft Defender SmartScreen warnings. The downloaded archive contains a renamed Haihaisoft PDF Reader executable (hpreader.exe).

IOCs:

Domain: hxxtp://googlemeet[.]business
file name: hpreader.exe
SHA256: 08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2

#malware #phishing #Remcos @malwrhunterteam @500mk500

[Samir @SBousseaden]

EDRUnChoker😀registers a permanent WMI subscription with a 5-second timer runs embedded VBScript (fileless) that deletes malicious MSFT_NetQosPolicySettingData policies targeting known security products or aggressive app-path throttles.
https://t.co/A1hcrpav2X

[VM @patialavii]

⚠️Observed phishing URLs delivering RMM payload:

RMM: ScreenConnect
Theme: DocuSign
URL: hxxps://right-end[.]com/ftx/
File Download URL: hxxps://pub-5c1cc419e2d946a8a9068d479b2814d8.r2[.]dev/DocuSignInstaller.exe
C2 domain: remote.wrightliggh[.]com:8041
SHA256: 27c452806d169d57ca794e8ea96d5c55afd9e70ab539ad03eafa172f5642ab29

#ThreatIntel #Phishing #RMM

[Hacking Articles @hackinarticles]

Memory Forensics Using Volatility Framework

📲 Telegram: https://t.co/upuP8k8ckB

Discover how investigators analyze RAM memory dumps to uncover hidden processes, credentials, and malicious activity during forensic investigations. 🕵️‍♂️💻

💡 Key Takeaways:
🧠 Memory Acquisition Basics
📦 Supported Memory Dump Formats
🔍 Image Profile Identification
⚙️ Volatility Plugins & Commands
🧾 Process & Network Artifact Analysis
🔐 Credential & Registry Extraction

📖 Full Guide:
https://t.co/ashAztkEhr

#Volatility #MemoryForensics #DFIR #DigitalForensics #CyberSecurity #HackingArticles #Infosec

[Anurag @Malwarehunterr]

Fake #DocuSign themed phishing page hosted on pdfviewerhandler.pages[.]dev validates victim emails and redirects users to another phishing stage using Base64-encoded email parameters.

IOCs:

pdfviewerhandler.pages[.]dev
cloud-document[.]site
cloud-document[.]site/lead/prv.php
cloud-document[.]site/lead/sincan.php
wqmanagementprogv3.pages[.]dev

#phishing @500mk500